}  UEPSON                                                                                                                } .op
.oj off
.po 0"












                          
                                
                               
                            
                               
                                  
                            
 
                             
                                  
                               
                             
                                
                                 
                             
 
                            
                                
                                
                              
                               
                               
                            
 
 
 
 
 


                  Courtesy of M & M Enterprises
                            (c) 1990
.pa  P
-   3                     
.f1 _______________________________________________________________________
.f2e                         Copyright 1990
.f2o                        M & M Enterprises


.pa  1   3                     
.h1 Table of Contents
.h2 _______________________________________________________________________


 	 
 Chapter 1 Introduction . . . . . . . . . . . . . . . . . 1


 	 
 Chapter 2 Tutorials

 	 
 
 	 
 Electronic Toll Fraud Devices (Lex Luthor). . . . . 2

 	 
 
 	 
 Boxing Basics (Dr. Pepper). . . . . . . . . . . . . 5

 	 
 
 	 
 The Blue Box and Ma Bell (Herb Friedman). . . . . . 7

 	 
 
 	 
 How Ma Bell Catches Blue Boxers (Lex Luthor). . . .14

 	 
 
 	 
 Dealing With The Rate & Route Operator 

 	 
 
 	 
 
 	
 
 
 	 
 (Fred Steinbeck). . . . . . . . . . . . .17

 	 
 
 	 
 Step by Step Switching Notes (Phantom Phreaker) . .18

 	 
 
 	 
 Verification (Fred Steinbeck) . . . . . . . . . . .23


 	 
 Chapter 3 International Dialing

 	 
 
 	 
 International Dialing (Dr. Jimmy & Mr. Jim) . . . .26

 	 
 
 	 
 Overseas Boxing (King Blotto) . . . . . . . . . . .28

 	 
 
 	 
 The History of British Phreaking (Lex Luthor) . . .29


 	 
 Chapter 4 The Boxes

 	 
 
 	 
 Aqua Box (Kopy Kat) . . . . . . . . . . . . . . . .34

 	 
 
 	 
 Beige Box (The Exterminator). . . . . . . . . . . .36

 	 
 
 	 
 Beige Box (Cardiac Arrest). . . . . . . . . . . . .39

 	 
 
 	 
 Beige Box (Shooting Shark). . . . . . . . . . . . .44

 	 
 
 	 
 Black Box (Uncle Joe) . . . . . . . . . . . . . . .45

 	 
 
 	 
 Black Box (from Sherwood Forest). . . . . . . . . .46

 	 
 
 	 
 Blue Box (Jester Sluggo). . . . . . . . . . . . . .48

 	 
 
 	 
 Brown Box (Author Unknown). . . . . . . . . . . . .56

 	 
 
 	 
 CheeseBox (Sir Knight). . . . . . . . . . . . . . .57

 	 
 
 	 
 Clear Box (The Bit of the Postman). . . . . . . . .58

 	 
 
 	 
 Gold Box (Dr. Revenge). . . . . . . . . . . . . . .59

 	 
 
 	 
 Green Box (BIOC Agent 006). . . . . . . . . . . . .61

 	 
 
 	 
 Mauve Box (Captain Generic) . . . . . . . . . . . .61

 	 
 
 	 
 Olive Box (Arnold). . . . . . . . . . . . . . . . .63

 	 
 
 	 
 Pearl Box (Dr. D-Code). . . . . . . . . . . . . . .64

 	 
 
 	 
 Pearl Box (Dispater). . . . . . . . . . . . . . . .66

 	 
 
 	 
 Pink Box (Baba O'Riley) . . . . . . . . . . . . . .68

 	 
 
 	 
 Red Box (Pink Panther). . . . . . . . . . . . . . .69

 	 
 
 	 
 Silver Box (Silent Screen). . . . . . . . . . . . .71

 	 
 
 	 
 Silver Box & White Box (Explorer) . . . . . . . . .73

 	 
 
 	 
 Switch Box (Autopsy Saw). . . . . . . . . . . . . .76

 	 
 
 	 
 Tan Box (Samurai Cat) . . . . . . . . . . . . . . .79

 	 
 
 	 
 Urine Box (Wolfgang von Albatros) . . . . . . . . .80

 	 
 
 	 
 White Box (Uncle Joe) . . . . . . . . . . . . . . .82


 	 
 Appendices


 	 
 A
 	 
 Miscellaneous Boxing Notes. . . . . . . . . . . . .84

 	 
 B
 	 
 Line Signals in CCIT Systems (Sherwood Forest II) .88

 	 
 C
 	 
 Various Tone Frequencies. . . . . . . . . . . . . .89

 	 
 D
 	 
 Trunking Off of 911 (The Conflict). . . . . . . . .90

 	 
 E
 	 
 International Dialing Codes . . . . . . . . . . . .91
.pa  4   3                     
.H1  


.PA  1   3                     
.pn1
.op
.h1e #                                               The Boxing Book
.h1o Introduction


 	!
 Chapter 1
                            

 	!
 Introduction
                          ------------


 	 
 Well folks, here is another offering from the never idle 
keyboards of M & M Enterprises. I hope that at least one or two 
of the items herein can be of use.


 	 
 This document was created for one main purpose..to clean up 
my records. Having 500 pages of numerous texts on boxing, some 
one or two pages in length and others much longer, I decided to 
shift through all of them and get rid of the duplicates and 
obviously useless ones. This got the pile down to 200 pages. Now 
came the fun part..editing the remainder. Some were done in 40 
columns, others in all CAPS, and some could be combined with a 
paragraph or two from other similiar files. What is left is 
contained in this far shorter document.


 	 
 I have attempted to correct some of the obvious errors as 
far as electronics design, but since my experience is solely in 
the Blue Box area, you will have to take those articles at face 
value. Good luck and keep the faith- Blue Boxing is not totally 
dead!

.pa  0   3                     
.pn2
.h1o Tutorials                                                     #


 	!
 Chapter 2


 	!
 Tutorials
                            ---------

ELECTRONIC TOLL FRAUD DEVICES by LEX LUTHOR
-----------------------------


 	 
 This file is designed to identify various kinds of ETF 
(Electronic Toll Fraud) devices and to describe their operation, 
according to a booklet put out by Bell entitled: THE INVESTIGA
TION AND PROSECUTION OF ELECTRONIC TOLL FRAUD DEVICES. (For 
official use only).


 	 
 There are several different types of electronic equipment 
which may be generally classified as ETF devices. The most sig
nificant is the 'blue box'. The characteristics of each type of 
device are discussed below.


 	 
 * Cheese Box *

 	 
 --------------


 	 
 Its design may be crude or very sophisticated. Its size 
varies; one was found the size of a half-dollar.


 	 
 A Cheese Box is used most often by bookmakers or betters to 
place wagers without detection from a remote location. The device 
inter-connects 2 phone lines, each having different #'s but each 
terminating at the same location. In effect, there are two phones 
at the same location which are linked together through a Cheese 
Box. It is usually found in an unoccupied apartment connected to 
a phone jack or connecting block. The bookmaker, at some remote 
location, dials one of the numbers and stays on the line. Various 
betters dial the other number but are automatically connected 
with the bookmaker by means of the Cheese Box inter-connection. 
If, in addition to a Cheese Box, a Black Box is included in the 
arrangement, the combined equipment would permit toll-free call
ing on either line to the other line.


 	 
 If a police raid were conducted at the terminating point of 
the conversation --the location of the Cheese Box-- there would 
be no evidence of gambling activity. This device is sometime 
difficult to identify. Law enforcement officials have been ad
vised that when unusual devices are found associated with tele
phone connections, the phone company security representative 
should be contacted to assist in identification. (This probably 
would be good for a BBS, especially with the Black Box set up, 
and if you ever decide to take the board down, you wouldn't have 
to change your phone #. It also makes it so you yourself cannot 
be traced. I am not sure about calling out from one though).

.pa  5   3                     

 	 
 * BLUE BOX * 

 	 
 ------------


 	 
 The 'Blue Box' was so named because of the color of the 
first one found. The design and hardware used in the Blue Box is 
fairly sophisticated, and its size varies from a large piece of 
apparatus to a miniaturized unit that is approximately the size 
of a 'king size' package of cigarettes. The Blue Box contains 12 
or 13 buttons or switches that emit multi-frequency tones charac
teristic of the tones used in the normal operation of the tele
phone toll (long distance) switching network. The Blue Box ena
bles its user to originate fraudulent ('free') toll calls by 
circumventing toll billing equipment. The Blue Box may be direct
ly connected to a phone line, or it may be acoustically coupled 
to a telephone handset by placing the Blue Box's speaker next to 
the transmitter or the telephone handset. The operation of a Blue 
Box will be discussed in more detail below.


 	 
 To understand the nature of a fraudulent Blue Box call, it 
is necessary to understand the basic operation of the Direct 
Distance Dialing (DDD) telephone network. When a DDD call is 
properly originated, the calling number is identified as an 
integral part of establishing the connection. This may be done 
either automatically or, in some cases, by an operator asking the 
calling party for his telephone number. This information is 
entered on a tape in the Automatic Message Accounting (AMA) 
office. This tape also contains the number assigned to the trunk 
line over which the call is to be sent. The information relating 
to the call contained on the tape includes: called number, call
ing number, time of call. The time of disconnect at the end of 
the call is also recorded.


 	 
 Although the tape contains info with respect to many differ
ent calls, the various data entries with respect to a single call 
are eventually correlated to provide billing info for use by your 
Bell accounting department.


 	 
 The typical Blue Box user usually dials a number that will 
route the call into the telephone network without charge. For 
example, the user will very often call a well-known INWATTS (toll 
free) customer's number. The Blue Box user, after gaining this 
access to the network and, in effect, 'seizing' control and 
complete dominion over the line, operates a key on the Blue Box 
which emits a 2600 Hz tone. This tone causes the switching equip
ment to release the connection to the INWATTS customer's line. 
The 2600 Hz tone is a signal that the calling party has hung up. 
The Blue Box simulates this condition. However, in fact the local 
trunk on the calling party's end is still connected to the toll 
network. The Blue Box user now operates the 'KP' (Key Pulse) key 
on the Blue Box to notify the toll switching equipment that 
switching signals are about to be emitted. The user then pushes 
the 'number' buttons on the Blue Box corresponding to the tele
phone # being called. After doing so, he/she operates the 'ST' 
(Start) key to indicate to the switching equipment that the 
signaling is complete. If the call is completed, only the portion    7   3                     of the original call prior to the emission of the 2600 Hz tone is 
recorded on the AMA tape. The tones emitted by the Blue Box are 
not recorded on the AMA tape. Therefore, because the original 
call to the INWATTS # is toll-free, no billing is rendered in 
connection with the call.


 	 
 Although the above is a description of a typical Blue Box 
operation using a common method of entry into the network, the 
operation of a Blue Box may vary in any one or all of the follow
ing respects:
.pm .25"
.lm .5"


 	
 (a) The Blue Box may include a rotary dial to apply the 2600 

 	
 Hz tone and the switching signals. This type of Blue Box is 

 	
 called a 'dial pulser' or 'rotary SF' Blue Box.


 	
 (b) Entrance into the DDD toll network may be effected by a 

 	
 pretext call to other toll-free # such as Universal Directo

 	
 ry Assistance (555-1212) or any # in the INWATTS network, 

 	
 either inter-state or intra-state, working or non-working.


 	
 (c) Entrance into the DDD toll network may also be in the form 

 	
 of 'short haul' calling. A 'short haul' call is a call to 

 	
 any # which will result in a lesser amount of toll charges 

 	
 than the charges for the call to be completed by the Blue 

 	
 Box. For example, a call to Birmingham from Atlanta may cost 

 	
 $.80 for the first 3 minutes while a call from Atlanta to 

 	
 Los Angeles is $1.85 for 3 minutes. Thus, a short haul, 3 

 	
 minute call to Birmingham from Atlanta, switched by use of a 

 	
 Blue Box to Los Angeles, would result in a net fraud of 

 	
 $2.65 for a 3 minute call.


 	
 (d) A Blue Box may be wired into the telephone line or acous

 	
 tically connected to the handset. The Blue Box may even be 

 	
 built inside a regular Touch-Tone phone, using the phone's 

 	
 pushbuttons for the Blue Box's signaling tones.


 	
 (e) A magnetic tape recording may be used to record the Blue 

 	
 Box tones representative of specific phone #'s. Such a tape 

 	
 recording could be used in lieu of a Blue Box to fraudulent

 	
 ly place calls to the phone #'s recorded on the magnetic 

 	
 tape.
.pm 0"
.lm 0"


 	 
 All Blue Boxes, except 'dial pulse' or 'rotary SF' Blue 
Boxes, must have the following 4 common operating capabilities:
.pm .25"
.lm .5"


 	
 (a) It must have signaling capability in the form of a 2600 Hz 

 	
 tone. The tone is used by the toll network to indicate, 

 	
 either by its presence or its absence, an 'on hook' (idle) 

 	
 or 'off hook' (busy) condition of the trunk.


 	
 (b) The Blue Box must have a 'KP' tone that unlocks or readies 

 	
 the multi-frequency receiver at the called end to receive 

 	
 the tones corresponding to the called phone #.
.pa  6   3                     

 	
 (c) The typical Blue Box must be able to emit MF tones which 

 	
 are used to transmit phone #'s over the toll network. Each 

 	
 digit of a phone # is represented by a combination of 2 

 	
 tones. For example, the digit 2 is transmitted by a combina

 	
 tion of 700 Hz and 1100 Hz.


 	
 (d) The Blue Box must have an 'ST' key which consists of a 

 	
 combination of 2 tones that tell the equipment at the called 

 	
 end that all digits have been sent and that the equipment 

 	
 should start switching the call to the called number.
.pm 0"
.lm 0"


 	 
 The 'dial pulser' or 'rotary SF' Blue Box requires only a 
dial with a signaling capability to produce a 2600 Hz tone.


 	 
 * BLACK BOX * 

 	 
 -------------


 	 
 This ETF device is so-named because of the color of the 
first one found. It varies in size and usually has one or two 
switches or buttons. Attached to the telephone line of a called 
party, the Black Box provides toll-free calling *to* that party's 
line. A Black Box user informs other persons beforehand that they 
will not be charged for any calls placed to him. The user then 
operates the device causing a 'non-charge' condition ('no answer' 
or 'disconnect')  to be recorded on the telephone company's bill
ing equipment. A Black Box is relatively simple to construct and 
is much less sophisticated than a Blue Box.


 	 
 * RED BOX * 

 	 
 -----------


 	 
 This device is coupled acoustically to the handset transmit
ter of a single slot coin telephone. The device emits signals 
identical to those tones emitted when coins are deposited. Thus, 
local or toll calls may be placed without the actual deposit of 
coins.




BOXING BASICS By Dr. Pepper
-------------


 	 
 What I will provide here in a summary of the three most 
important boxes, some of the ways Ma Bell tries to catch boxers, 
and some suggestions on avoiding being caught.


 	 
 The most famous box, the blue box, is essentially like a 
portable touch-tone pad, except the tones are not touch-tone 
(DTMF)  -- they are the trunk signaling frequencies (MF). A good 
box also contains the supervision control frequency, 2600 Hz 
(SF).
.pa  5   3                     

 	 
 Hackers use the box by gaining access to a DDD (or other) 
network sender (it's like a dial tone), usually by making a 800 
or 555 call. A much better access is if there are local tandems 
in your area used for non-accounted calls but allowing non-local 
outgoing calls.


 	 
 Phreaks use blue boxes because it allows the introduction of 
network dial codes other than area code and number and opened an 
incredibly complex maze to be explored and toyed with. Other 
people used blue boxes to complete calls without paying. This 
made AT&T intent on stopping the access; to them the phreaks 
tying up tandems from Kalamazoo to Moscow were a nuisance, and 
the others were thieves.


 	 
 One of the most successful means of catching blue boxers was 
and is the feature in the accounting program which calls atten
tion to any number which shows a large number of 800 or 555 
calls. (We know of telecommunications managers on our side who 
have been called by AT&T to find out why so and so - an 
employee-- makes so many calls to the company 800 number). Other 
means include analyzing trunk trouble reports (if your box 
doesn't treat the trunk the same way AT&T's equipment does, it 
can in some cases generate trouble reports).


 	 
 Once the suspicion is there, your local Telco puts a 'pen 
recorder' on your line, and everything you dial -rotary, touch-
tone, or MF gets recorded on paper - this paper will be used as 
evidence against you. Eventually the U.S. Government prosecutes 
you for 'interstate fraud by wire' -- an extremely broad law.


 	 
 In order to eliminate blue boxing, which relies on the use 
of the MF signals on the same circuit that you talk on, Ma Bell 
is converting to a new system, Common Channel Interoffice Signal
ing (CCIS). There are many benefits of CCIS other than eliminat
ing blue boxing, but it will eventually eliminate blue boxing 
because it sends the network signaling information on data links 
between signal transfer points (STPS) associated with various 
switching machines.


 	 
 It will take many years for CCIS to be universally used, but 
it is going in fast. As long as there is one non-CCIS link in the 
network, the phreaks will find it and ply their hobby.


 	 
 To avoid getting caught: don't use your box from the same 
place repeatedly. Don't complete calls to friends and sit and 
gab-- if no 'signs and signals' are transmitted (you don't pass 
information -- you don't communicate) you have not committed 
fraud by wire. You may get charged with possession, if state laws 
where you are caught make boxes illegal.


 	 
 The second famous box is the black box. With the black box, 
you receive calls without the caller being charged. This is 
useless for hackers -- only the freephone people are interested. 
This works in step-by-step (SXS) offices, #1 and #5 Crossbar, and 
some non-Bell offices. Bell's ESS offices are too clever for this    7   3                     trick- your phone isn't connected to the incoming trunk unless 
you are off-hook.


 	 
 Ma Bell catches blank boxers by examining trunk records. Why 
was the trunk in use for so long, but not off-hook? In #5 Cross
bar offices, there will also be funny account entries -- origi
nate followed by disconnect -- a long time later -- with no 
answer in between. ESS offices can generate this data when audits 
are done ( a random occurrence).


 	 
 The best way to avoid being caught is to stay away from this 
one. At least keep your calls short -- the length of 15-20 rings 
or so.


 	 
 The final famous box is the red box. This is the electronic 
equivalent of the chime people used to take to a pay phone so 
that the operator thinks money is being deposited. The gongs were 
easy to record or obtain and operators could be easily fooled. 
The newer phones with the beeps made it necessary to come up with 
something more precise.

     People get caught when an operator gets suspicious and
calls security, or when the accounting info for the phone says
there isn't enough money in the coin box. Bell security then
stakes out the pay phone -- and zap. Never use the same pay
phone twice.




THE BLUE BOX AND MA BELL by Herb Friedman,
------------------------
            Communications Editor 
            Radio Electronics Magazine November 1987



 	 
 Before the breakup of AT&T, Ma Bell was everyone's favorite 
enemy. So it was not surprising that so many people worked so 
hard and so successfully at perfecting various means of making 
free and untraceable telephone calls. Whether it was a "Red Box" 
used by Joe and Jane College to call home, or a "Blue Box" used 
by organized crime to lay off untraceable bets, the technology 
that provided the finest telephone system in the world contained 
the seeds of it's own destruction.


 	 
 The fact of the matter is that the Blue Box was so effective 
at making untraceable calls that there is no estimate as to how 
many calls were made or who made them. No one knows for certain 
whether Ma Bell lost revenues of $100, $100-million, or $1-bil
lion on the Blue Box. Blue Boxes were so effective at making 
free, untraceable calls that Ma Bell didn't want anyone to know 
about them, and for many years denied their existence. They even 
went as far as strong-arming a major consumer science magazine 
into killing an article that had already been prepared on the 
Blue and Red boxes. Further, the police records of a major city    7   3                     contain a report concerning a break-in at the residence of the 
author of that article. The only item missing following the 
break-in was the folder containing copies of the earliest Blue-
Box designs and a Bell-System booklet that described how sub
scriber billing was done by the AMA machine--a booklet that Ma 
Bell denied ever existed. Since the AMA (Automatic Message Ac
counting) machine was the means whereby Ma Bell eventually 
tracked down both the Blue and Red Boxes, we'll take time out to 
explain it. Besides, knowing how the AMA machine works will help 
you to better understand "phone phreaking."


 	 
 WHO MADE THE CALL

 	 
 -----------------


 	 
 Back in the early days of the telephone, a customer's bill
ing was originated in a mechanical counting device, which was 
usually called a "register" or a "meter." Each subscriber's line 
was connected to a meter that was part of a wall of meters. The 
meter clicked off the message units, and once a month someone 
simply wrote down the meter's reading, which was later interpo
lated into message-unit billing for those subscriber's who were 
charged by the message unit. (Flat rate subscriber's could make 
unlimited calls only within a designated geographic area. The 
meter clicked off message units for calls outside that area.)  
Because eventually there were too many meters to read individual
ly, and because more subscribers started questioning their month
ly bills, the local telephone companies turned to photography. A 
photograph of a large number of meters served as an incontestable 
record of their reading at a given date and time, and was much 
easier to convert to customer billing by the accounting depart
ment.
     

 	 
 As you might imagine, even with photographs billing was 
cumbersome and did not reflect the latest technical developments. 
A meter didn't provide any indication of what the subscriber was 
doing with the telephone, nor did it indicate how the average 
subscriber made calls or the efficiency of the information serv
ice (how fast the operators could handle requests). So the meters 
were replaced by the AMA machine. One machine handled up to 
20,000 subscribers. It produced a punched tape for a 24-hour 
period that showed, among other things, the time a phone was 
picked up (went off-hook), the number dialed, the time the called 
party answered, and the time the originating phone was hung up 
(placed on-hook).


 	 
 One other point, which will answer some questions that 
you're certain to think of as we discuss the Red and Blue boxes: 
Ma Bell did not want persons outside their system to know about 
the AMA machine. The reason? Almost everyone had complaints 
--usually unjustified-- about their billing. Had the public been 
aware of the AMA machine, they would have asked for a monthly 
list of their telephone calls. It wasn't that Ma Bell feared 
errors in billing; rather, they were fearful of being buried 
under an avalanche of paperwork and customer complaints. Also, 
the public believed their telephone calls were personal and    7   3                     untraceable, and Ma Bell didn't want to admit that they knew 
about the who, when, and where of every call. And so Ma Bell 
always insisted that billing was based on a meter unit that 
simply "clicked" for each message unit; that there was no record, 
other than for long-distance calls, as to who called whom. Long 
distance was handled by, and the billing information was done by 
an operator, so there was a written record Ma Bell could not 
deny.


 	 
 The secrecy surrounding the AMA machine was so pervasive 
that local, state, and even federal police were told that local 
calls made by criminals were untraceable, and that people who 
made obscene telephone calls could not be tracked down unless the 
person receiving the calls could keep the caller on the line for 
some 30 to 50 minutes so the connections could be physically 
traced by technicians. Imagine asking a woman or child to put up 
with almost an hours worth of the most horrendous obscenities in 
the hope someone could trace the line. Yet in areas where the AMA 
machine had replaced meters, it would have been a simple, though 
perhaps time-consuming task, to track down the numbers called by 
any telephone during a 24-hour period. But Ma Bell wanted the AMA 
machine kept as secret as possible, and so many a criminal was 
not caught, and many a woman was harried by the obscene calls of 
a potential rapist, because existence of the AMA machine was 
denied.


 	 
 As a sidelight as to the secrecy surrounding the AMA ma
chine, someone at Ma Bell or the local operating company decided 
to put the squeeze on the author of the article on Blue Boxes, 
and reported to the Treasury Department that he was, in fact, 
manufacturing them for organized crime--the going rate in the mid 
1960's was supposedly $20,000 a box. (Perhaps Ma Bell figured the 
author would get the obvious message: Forget about the Blue Box 
and the AMA machine or you'll spend lots of time, and much money 
on lawyer's fees to get out of the hassles it will cause.) The 
author was suddenly visited by his place of employment by a 
Treasury agent. Fortunately, it took just a few minutes to con
vince the agent that the author was really just that, and not a 
technical wizard working for the mob. But one conversation led to 
another, and the Treasury agent was astounded to learn about the 
AMA machine. (Wow! Can an author whose story is squelched spill 
his guts.) According to the Treasury agent, his department had 
been told that it was impossible to get a record of local calls 
made by gangsters: The Treasury department had never been in
formed of the existence of automatic message accounting. Needless 
to say, the agent left with his own copy of the Bell System 
publication about the AMA machine, and the author had an appoint
ment with the local Treasury Bureau director to fill him in on 
the AMA Machine. That information eventually ended up with Sena
tor Dodd, who was conducting a congressional investigation into, 
among other things, telephone company surveillance of subscriber 
lines--which was a common practice for which there was detailed 
instructions, Ma Bell's own switching equipment ("crossbar") 
manual.
.pa   7   3                     

 	 
 THE BLUE BOX

 	 
 ------------


 	 
 The Blue Box permitted free telephone calls because it used 
Ma Bell's own internal frequency-sensitive circuits. When direct 
long-distance dialing was introduced, the crossbar equipment knew 
a long-distance call was being dialed by the three-digit area 
code. The crossbar then converted the dial pulses to the CCITT 
tone groups, that are used for international and trunkline sig
nalling. (Not that those do not correspond to Touch-Tone frequen
cies.) The tone groups represent more than just numbers; among 
other things there are tone groups identified as KP (prime) and 
ST (start)--keep them in mind. When a subscriber dialed an area 
code and a telephone number on a rotary-dial telephone, the 
crossbar automatically connected the subscriber's telephone to a 
long-distance truck, converted the dial pulses to CCITT tones 
sent out on the long-distance trunk that set up or selected the 
routing and caused electro-mechanical equipment in the target 
city to dial the called telephone.


 	 
 Operator-assisted long-distance calls worked the same way. 
The operator simply logged into a long-distance trunk and pushed 
the appropriate buttons, which generated the same tones as direct 
dial equipment. The button sequence was KP (which activated the 
long-distance equipment), then the complete area code and tele
phone number. At the target city, the connection was made to the 
called number but ringing did not occur until the operator there 
pressed the ST button. The sequence of events of early Blue Boxes 
went like this: The caller dialed information in a distant city, 
which caused his AMA machine to record a free call to informa
tion. When the information operator answered, he pressed the KP 
key on the Blue Box, which disconnected the operator and gave him 
access to a long-distance trunk. He then dialed the desired 
number and ended with an ST, which caused the target phone to 
ring. For as long as the conversation took place, the AMA machine 
indicated a free call to an information operator. The technique 
required a long-distance information operator because the local 
operator, not being on a long-distance trunk, was accessed 
through local wire switching, not the CCITT tones.


 	 
 CALL ANYWHERE

 	 
 -------------


 	 
 Now imagine the possibilities. Assume the Blue Box user was 
in Philadelphia. He would call Chicago information, disconnect 
from the operator with a KP tone, and then dial anywhere that was 
on direct-dialing service: Los Angeles, Dallas, or anywhere in 
the world the Blue Boxer could get the international codes.


 	 
 The legend often told of one Blue Boxer who, in the 1960's, 
lived in New York and had a girlfriend at a college near Boston. 
Now back in the 1960's, making a telephone call to a college town 
on the weekend was even more difficult than it is today to make a 
call from New York to Florida on a reduced-rate holiday using one 
of the cut-rate long-distance carriers. So our Blue Boxer got on    7   3                     an international operator's circuit to Rome, Blue Boxed through 
to a Hamburg operator, and asked Hamburg to patch through to 
Boston. The Hamburg operator thought the call originated in Rome 
and inquired as to the "operator's" good English, to which the 
Blue Boxer replied that he was an expatriate hired to handle 
calls by American tourists back to their homeland. Every weekend, 
while the Northeast was strangled by reduced-rate long-distance 
calls, our Blue Boxer had no trouble sending his voice almost 
7,000 miles for free.


 	 
 VACUUM TUBES

 	 
 ------------


 	 
 Assembly plans for Blue Boxes were sold through classified 
advertisements in the electronic-hobbyist magazines. One of the 
earliest designs was a two-tube portable model that used a 1.5-
volt "A" battery for the filaments and a 125-volt "B" battery for 
the high-voltage (B+) power supply. It consisted of two phase-
shift oscillators sharing a common speaker that mixed the tones 
from both oscillators. The user placed the speaker over the 
telephone handset's transmitter and simply pressed the buttons 
that corresponded to the desired CCITT tones. It was just that 
simple.


 	 
 Actually, it was even easier then it reads because Blue 
Boxers discovered they did not need the operator. If they dialed 
an active telephone located in certain nearby, but different, 
area codes, they could Blue Box just as if they had Blue Boxed 
through an information operator's circuit. The subscriber whose 
line was blue Box conversation was short, the "dead" phone sud
denly came to life the next time it was picked up. Using a list 
of "distant" numbers, a Blue Boxer would never hassle plain to 
the telephone company. The difference between Blue Boxing off a 
subscriber rather than an information operator was that the Blue 
Boxer's AMA tape indicated a real long-distance telephone call 
--perhaps costing 15 or 25 cents--instead of a freebie. Of 
course, that is the reason why when Ma Bell finally decided to go 
public with "assisted" newspaper articles about the Blue Box 
users they had apprehended, it was usually about some college kid 
or "phone phreak." One never read of a mobster being caught. 
Greed and stupidity were the reasons why the kid's were caught.  
It was the transistor that led to Ma Bell going public with the 
Blue Box. By using transistors and RC phase-shift networks for 
the oscillators, a portable Blue Box could be made inexpensively, 
and small enough to be used unobtrusively from a public tele
phone. The college crowd in the many technical schools went crazy 
with the portable Blue Box; they could call the folks back home, 
their friends, or get a free network (the Alberta and Carolina 
connections--which could be a topic for a whole separate article) 
and never pay a dime to Ma Bell. Unlike the mobsters who were 
willing to pay a small long-distance charge when Blue Boxing, the 
kids wanted it, wanted it all free, and so they used the informa
tion operator routing, and would often talk "free-of-charge" for 
hours on end.
   7   3                     

 	 
 Ma Bell finally realized that Blue Boxing was costing them 
big bucks, and decided a few articles on the criminal penalties 
might scare the Blue Boxers enough to cease and desist. But who 
did Ma Bell catch?  The college kids and the greedies. When Ma 
Bell decided to catch the Blue Boxers she simply examined the AMA 
tapes for calls to an information operator that were excessively 
long. No one talked to an operator for 5, 10, 30 minutes, or 
several hours. Once a long call to an operator appeared several 
times on an AMA tape, Ma Bell simply monitored the line and the 
Blue Boxer was caught. (Now do you understand why we opened with 
an explanation of the AMA machine?) If the Blue Boxer worked from 
a telephone booth, Ma Bell simply monitored the booth. Ma Bell 
might not have known who originated the call, but she did know 
who got the call, and getting that party to spill their guts was 
no problem. The mob and a few Blue Box hobbyists (maybe even 
thousands) knew of the AMA machine, and so they used a real 
telephone number for the KP skip. Their AMA tapes looked perfect
ly legitimate. Even if Ma Bell had told the authorities they 
could provide a list of direct-dialed calls made by local mob
sters, the AMA tapes would never show who was called through a 
Blue Box. For example, if a bookmaker in New York wanted to lay 
off some action in Chicago, he could make a legitimate call to a 
phone in New Jersey and then Blue Box to Chicago. Of course, 
automatic tone monitoring, computerized billing, and ESS (Elec
tronic Switching Systems) now make that all virtually impossible. 
but that's the way it was.


 	 
 You might wonder how Ma Bell discovered the tricks of the 
Blue Boxers. Simple, they hired the perpetrators as consultants. 
While the initial newspaper articles detailed the potential jail 
penalties for apprehended Blue Boxers, except for Ma Bell employ
ees who assisted a Blue Boxer, it is almost impossible to find an 
article on the resolution of the cases because most hobbyist Blue 
Boxers got suspended sentences and/or probation if they assisted 
Ma Bell in developing anti-Blue Box techniques. It is asserted, 
although it can't be easily proven, that cooperating ex-Blue 
Boxers were paid as consultants. (If you can't beat them, hire 
them to work for you.)


 	 
 Should you get any ideas about Blue Boxing, keep in mind 
that modern switching equipment has the capacity to recognize 
unauthorized tones. It's the reason why a local office can leave 
their subscriber Touch-Tone circuits active, almost inviting you 
to use the Touch-Tone service. A few days after you use an unau
thorized Touch-Tone service, the business office will call and 
inquire whether you'd like to pay for the service or have it 
disconnected. The very same central-office equipment that knows 
you're using Touch-Tone frequencies knows if your line is origi
nating CCITT signals.
.pa  2   3                     

 	 
 THE RED BOX

 	 
 -----------


 	 
 The Red Box was primarily used by the college crowd to avoid 
charges when frequent calls were made between two particular 
locations, say the college and a student's home. Unlike the 
somewhat complex circuitry of the Blue Box, a Red Box was nothing 
more than a modified telephone; in some instances nothing more 
than a capacitor, a momentary switch, and a battery. As you 
recall from our discussion of the Blue Box, a telephone circuit 
is really established before the target phone ever rings, and the 
circuit is capable of carrying an AC signal in either direction. 
When the caller hears the ringing in their handset, nothing is 
happening at the receiving end because the ringing signal he 
hears is really a tone generator at his local telephone office.  
The target (called) telephone actually gets it 20 pulses-per-
second ringing voltage when the person who dialed hears nothing 
--in the "dead" spaces between hearing the ringing tone. When the 
called phone is answered and taken off hook, the telephone com
pletes a local-office DC loop that is the signal to stop the 
ringing voltage. About three seconds later the DC loop results in 
a signal being sent all the way back to the caller's AMA machine 
that the called telephone was answered. Keep that three-second 
AMA delay in mind. 


 	 
 Now as we said earlier, the circuit can actually carry AC 
before the DC loop is closed. The Red Box is simply a device that 
provides a telephone with a local battery so that the phone can 
generate an AC signal without having a DC connection to the 
telephone line. The earliest of the Red Boxes was the surplus 
military field telephone, of which there were thousands upon 
thousands in the marketplace during the 1950's and 1960's. The 
field telephone was a portable telephone unit having a manual 
ringer worked by a crank--just like the telephone Grandpa used on 
the farm--and two D-cells. A selector switch set up the unit so 
that it could be connected to a combat switchboard, with the DC 
power supplied by the switchboard. But if a combat unit wasn't 
connected to a switchboard, and the Lieutenant yelled "Take a 
wire," the signalman threw a switch on his field telephone that 
switched in the local batteries. To prevent the possibility of 
having both ends of the circuit feeding battery current into the 
line in opposite polarity--thereby resulting in silence--the 
output from the field telephone when running from its internal 
batteries was only the AC representing the voice input, not 
modulated DC. 


 	 
 PRESS ONCE TO TALK

 	 
 ------------------


 	 
 The Red Box was used at the receiving end; let's assume it's 
the old homestead. The call was originated by Junior (or Sis) at 
their college 1000 miles away from home. Joe gave the family one 
ring and then hung up, which told them that he's calling. Pop set 
up the Red Box. Then Junior redialed the old homestead. Pop 
lifted the handset when the phone rang. Then Pop closed a momen   7   3                     tary switch for about a half-second, which caused the local 
telephone office to silence the ringing signal. When Pop released 
the switch, the folks can talk to Junior without Junior getting 
charged because his AMA tape did not show his call was answered 
(the DC loop must be closed for at least three-seconds for the 
AMA tape to show Junior's call was answered). All the AMA tape 
showed is that Junior let the phone ring at the old homestead for 
almost 30 minutes; a length of time that no Bell Operating Compa
ny is likely to believe twice!


 	 
 A modern Red Box is simply a conventional telephone that's 
been modified to emulate the vintage 1940 military field tele
phone. Aside from the fact that the operating companies can now 
nail every Red Box user because all modern billing equipment 
shows the AMA information concerning the length of time a caller 
let the target phone ring, it's use has often put severe psycho
logical strain on the users.


 	 
 There are no hard facts concerning how many Red Boxes were 
in use, or how much money Ma Bell lost, but one thing is known: 
she had little difficulty in closing down Red Boxes in virtually 
all instances where the old folks were involved because Mom and 
Pop usually would not tolerate what to them was stealing. If you 
as a reader have any ideas about using a Red Box, bear in mind 
that the AMA machine (or it's equivalent) will get you every 
time, even if you use a phone booth, because the record will show 
the number being called, and as with the Blue Box, the people on 
the receiving end will spill their guts to the cops.



HOW BELL CATCHES BLUE BOXERS By LEX LUTHOR AND THE LEGION OF DOOM
----------------------------

 UPDATED: 25-JUNE-84


 	 
 This article describes the investigative procedures used by 
the security department of Ma Bell. Most of the file will talk 
about blue box investigations because of the frequency of the 
blue box cases referred to law enforcement officials for prosecu
tion.


 	 
 The security department may first discover evidence of 
boxing activity from looking at calling patterns to particular 
numbers. Such analyses may reveal abnormal calling patterns which 
possibly are the result of box activity (such as 122 hour calls 
to dir. assist). Also, cases of suspected boxing are referred to 
the security department from the various operating departments of 
Bell, from other telephone companies , or from law enforcement 
officials. In some instances, detection and identification of a 
calling station originating suspected blue box tones can be 
provided by use of a special non-monitoring test equipment.
.pa  5   3                     

 	 
 If initial indications are that there is a good possibility 
that a blue box is being used on a particular phone line, the 
security department determines certain information about the 
line. The name of the subscriber to that line is identified, and 
an inventory is made of the line and station equipment being 
provided to him. A discreet background investigation (record) is 
conducted to establish the subscriber's identity. After this 
preliminary data is gathered, blue box detection units are in
stalled on the suspected line to establish "probable cause" for 
further investigation. If the "probable cause" equipment indi
cates repeated blue box activity on the line, other equipment is 
then installed to document such activity.


 	 
 The "probable cause" equipment ascertains the presence of 
multi-frequency tones on the subscribers end of the line which 
would not be present in normal usage. The "probable cause" device 
now being used by some Bell central offices register each and 
every application of 2600hz tones in single-frequency (sf) sig
naling and or 2600hz tone followed by kp tones used in multi-
frequency (mf) signaling. As previously stated, such tones should 
not normally be present on the line.


 	 
 If "probable cause" is established, other detection, identi
fication and documentation equipment is installed. The primary 
equipment now being used is the dialed number recorder (DNR), 
coupled with an auxiliary tape recorder. The DNR is activated 
when the suspect subscriber's phone goes "off-hook" and prints on 
paper tape the following information concerning the call: the 
date and time of the call and the digits dialed over the suspects 
line. Moreover, the DNR records on the paper tape an indicator of 
the presence of 2600hz tones on the line and the presence of 
multi-frequency signaling tones on the subscriber's line. The 
auxiliary tape recorder is activated *only* after the presence of 
2600hz tone on the line is detected by the DNR (indicating the 
use of a blue box). Once the tape recorder is activated, it 
records the tones being emitted by the blue box, other signaling 
tones, and the ringing cycle on the called end . It also records 
a minimum amount of ensuing conversation for the purpose of:


 	 
 (1) establishing that the fraudulent call was consummated


 	 
 (2) establishing the identity of the fraudulent caller. 


 	 
 The timing duration of the tape recorder is pre-set. A time 
of one-minute (including pulsing, ringing and conversation) is 
the standard setting; however, if the blue box user is suspected 
of making overseas calls, the timing may be set for 2 minutes 
because of the greater time required by the blue box user to 
complete the call. Upon termination of the call, the DNR automat
ically prints the time of termination and the date. It should be 
pointed out that the presence of 2600hz tones *plus* multi-fre
quency signaling tones on a subscriber's line positively estab
lishes that a blue box is being used to place a fraudulent call 
because such tones are not normally originated from a subscribers 
line.   7   3                     


 	 
 Once the raw data described above is gathered, the security 
department collects and formulates the data into legally admissi
ble evidence of criminal activity. Such evidence will establish:
.pm .25"
.lm .5"


 	
 (1) That a fraudulent call was placed by means of an ETF 

 	
 device,


 	
 (2) That conversation ensued,


 	
 (3) That the fraudulent call was placed by an identified 

 	
 individual, and


 	
 (4) That such call was not billed to the subscriber number 

 	
 from which the blue box call originated. 
.pm 0"
.lm 0"


 	 
 The evidence which is then available consists of documents 
and also of expert witness testimony by telephone company person
nel concerning the contents of those documents, the operation of 
the blue box, and the operation of the detection equipment. 
(note- similar techniques are used in the investigation of other 
forms of ETF.)


 	 
 Presentation of Evidence to Prosecutors

 	 
 ---------------------------------------


 	 
 The evidence accumulated by the security department is 
carefully reviewed by the legal department for the purpose of 
determining whether sufficient evidence exists to warrant the 
presentation of the evidence to law enforcement officials. If the 
evidence does warrant such action, it is presented under appro
priate circumstances to the proper law enforcement officials. In 
all cases where prosecution is recommended, a professionally 
investigated and documented summary of the case will be prepared 
and presented by the security department to the prosecutor's 
office. Each case recommended for prosecution will be prepared as 
completely as possible, usually necessitating little or no pre-
trial investigation for the prosecutor. The summary of the case 
will include the following:
.pm .25"
.lm .5"


 	
 (a) A background of the case with details of the defendant's 

 	
 activities and a summary of all pertinent investigative 

 	
 steps and interviews conducted in the course of the investi

 	
 gation.


 	
 (b) Identification of witnesses.
.pm 0"
.lm 0"

.pa  0   3                     
DEALING WITH THE RATE & ROUTE OPERATOR By Fred Steinbeck
--------------------------------------


 	 
 It seems that fewer and fewer people have blue boxes these 
days, and that is really too bad. Blue boxes, while not all that 
great for making free calls (since the TPC can tell when the call 
was made, as well as where it was to and from), are really a lot 
of fun to play with. Short of becoming a real live TSPS operator, 
they are about the only way you can really play with the network.


 	 
 For the few of you with blue boxes, here are some of the 
phrases which may make life easier when dealing with the rate & 
route (R&R) operators. To get the R&R operator, you send a KP + 
141 + ST. In some areas, you may need to put another NPA before 
the 141 (i.e. KP + 213 + 141 + ST), if you have no local R&R 
operator.


 	 
 The R&R operator has a myriad of information, and all it 
takes to get this data is mumbling cryptic phrases. There are 
basically four special phrases to give the R&R operators. They 
are NUMBERS route, DIRECTORY route, OPERATOR route, and PLACE 
NAME.


 	 
 To get an area code for a city, one can call the R&R opera
tor and ask for the numbers route. For example, to find the area 
code for Carson City, Nevada, we'd ask the R&R operator for 
'Carson City, Nevada, numbers route, please' and get the answer, 
'702 plus', meaning that 702 plus 7 digits gets us there.


 	 
 Sometimes directory assistance isn't just NPA + 131. The way 
to get these routings is to call R&R and ask for 'Anaheim, Cali
fornia, directory route, please'. Of course, she'd tell us it was 
714 plus, which means 714 + 131 gets us the D.A. operator there. 
This is sort of a pointless example, but I couldn't come up with 
a better one on short notice.


 	 
 Let's say you wanted to find out how to get the inward 
operator for Sacramento, California. The first six digits of a 
number in that city will be required (the NPA and an NXX). For 
example, let us use 916 756. We would call R&R, and when the 
operator answered, say '916 756, operator route, please'. The 
operator would say, '916 plus 001 plus'. This means that 916 + 
001 + 121 will get you the inward operator for Sacramento.


 	 
 Do you know the city which corresponds to 503 640? The R&R 
operator does, and will tell you that it is Hillsboro, Oregon, if 
you sweetly ask for 'Place name, 503 640, please'.


 	 
 For example, let's say you need the directory route for 
Sveg, Sweden. Simply call R&R, and ask for 'International, Baden, 
Switzerland. TSPS directory route, please'. In response to this, 
you'd get, 'Directory to Sveg, Sweden. Country code 46 plus 
1170'. So you'd route yourself to an international sender, and 
send 46 + 1170 to get the D.A. operator in Sweden.
   7   3                     

 	 
 Inward operator routings to various countries are obtained 
the same way 'International, London, England, TSPS inward route, 
please', and get 'country code 44 plus 121'. Therefore, 44 plus 
121 gets you inward for London.


 	 
 Inwards can get you language assistance if you don't speak 
the language. Tell the foreign inward, 'United States calling. 
Language assistance in completing a call to (called party) at 
(called number)'.


 	 
 R&R operators are people too, so always be polite, make sure 
use of them, and dial with care.

Note: As a result of the break-up, R&R is now KP+800+141+1212+ST



STEP BY STEP SWITCHING NOTES By PHANTOM PHREAKER
----------------------------


 	 
 The following research was done on a class 5 Step By Step 
switching system. Items mentioned in this article are not guaran
teed to work with your particular office. The following interest
ing topics about Step By Step switching are for informational and 
educational purposes only. This article is aimed at people who 
wish to learn more about telephone switching systems.


 	 
 I realize step-by-step switching is dwindling every day, 
with many electromechanical SxS offices being replaced with newer 
electronic/digital switches and Remote Switching Systems (RSS's). 
However, rural areas of the U.S. still use Step, so if you are 
ever in an area served by a SxS CO you may be able to use this 
information.



 	 
 ANI Failure/ONI

 	 
 ---------------


 	 
 To understand this technique, you must understand how ANI 
functions in the Step-by-Step switching system. Your CO sends 
ANI, with your number, in MF or DP to receivers that collect the 
ANI information and store it, along with the called number, on 
the appropriate form of AMA tape. ANI outpulsing in MF can use 
either LAMA (Local Automatic Message Accounting) or CAMA (Cen
tralized Automatic Message Accounting). ANI sent in DP type 
signaling can also be used, but is rare. DP vs MF trunk signaling 
is similar to the difference between DTMF and pulse dialing, 
except on a trunk. DP signaling sends all information in short 
bursts of 2600Hz tones.


 	 
 Causing ANIF's/ONI is an easy task in SxS (and some versions 
of Xbar), because the customer's link to the CO will allow the 
customer to input MF tones to influence a calls completion. This 
can be done by dialing a long distance number and listening to 
the clicks that follow. After the first click when you are done    7   3                     dialing, you will hear a few more. They will be timed very close 
to one another, and the last click occurs right before the called 
telephone rings. The number and speed of the clicks probably 
varies. Basically what these clicks are is the Toll Office that 
serves your CO setting up a route for your call. In order to 
abuse this knowledge, you need access to a MF source, whether it 
be a blue box, a computer with a good sound chip, tape recording, 
etc. Right before you hear the series of clicks, send one of the 
following sequences in MF:

KP+1 (Repeatedly) For Automatic Number Identification Failure (ANIF)

-or-

KP+2 (Repeatedly) For Operator Number Identification (ONI)

(Note:these will not work if your CO uses DP signalling.)


 	 
 Play these tones into the phone at a sufficient volume so 
that they 'drown out' the series of clicks. Do not send an ST 
signal, as you are not actually dialing on a trunk. You must send 
these MF sequences quickly for this method to work correctly. 
After you have played your 'routing' a few times, you will hear a 
TSPS operator intercept your call and ask for the number you are 
calling FROM.


 	 
 When an ANIF is recognized, the call is cut through to a 
TSPS site that serves your area. Now, you can give the operator 
any number in your exchange and she will enter the billing infor
mation manually, and put the call through. The toll charges will 
appear on the customer who owns the number you gave. You can also 
accomplish a similar feat by merely flashing the switchhook 
during the series of clicks. This will send DC pulses that scram
ble the ANI outpulsing and cause your call to be sent to a TSPS 
operator before the dialed number. Be sure to stop sending the MF 
'routing' after the operator attaches or she may know that some
thing's up. Use this method sparingly and with caution. It would 
also be a good idea not to use the same number for billing more 
than one time. Don't use this method in excess, because a toll 
office report will list the number of ANI failures for a specific 
time period. 


 	 
 The ONI method works better because it is assumed ONI is 
needed to identify a caller's DN upon a multi-party line. Too 
many ANI failures will generate a report upon a security/mainte
nance TTY, so if you plan on using this method, use the ONI 
method instead of just ANI Failure.


 	 
 The basic idea behind the ANIF is to scramble your ANI 
information by using MF (or the switchhook) to send your LD call 
to a TSPS operator for Operator Number Identification (ONI) due 
to ANI Failure. The idea behind the ONI method is that you are 
fooling the switch into thinking you are calling from a multi-
party line and ONI is needed to identify your DN.
   7   3                     

 	 
 Test numbers

 	 
 ------------


 	 
 Some other interesting things in the Step By Step system can 
be found by dialing test numbers. Test numbers in SxS switching 
systems are usually hidden in the XX99 area, as opposed to 99XX, 
which is common for other types of switching systems. These types 
of numbers are possibly physical limitations of a SxS switch, and 
thus a milliwatt tone or other test numbers will be placed there, 
because a normal DN can't be assigned such a number. However, 
these XX99 numbers are usually listed in COSMOS as test numbers. 
Another interesting note about XX99 numbers is that they seem (at 
least in some offices) to be on the same circuit. (That is, if 
one person calls an XX99 number and receives a test tone, and 
another person calls any other XX99 number in that same prefix, 
the second caller will receive a busy signal).


 	 
 Here we must examine the last four digits of a telephone 
number in detail.

XXXX=WXYZ             W=Thousands digit
                      X=Hundreds digit
                      Y=Tens digit
                      Z=Units digit


 	 
 Dialing your prefix followed by an XX99 may result in a busy 
signal test number, a network overflow (reorder), milliwatt 
tones, or other type of error messages encountered when dialing.


 	 
 Not every XX99 number is a test number, but many are. Try 
looking for these in a known Step by Step office.


 	 
 The numbers that return a busy signal are the ones that 
incoming callers are connected to when the Sleeve lead of the 
called Directory Number is in a voltage present state, which 
means the line is in use or off-hook. More about this in the next 
topic.


 	 
 Busy signal conferencing

 	 
 ------------------------


 	 
 Another interesting feature of the Step-By-Step system is 
the way busy tones (60 IPM) are generated. In ESS and DMS central 
offices, busy signals that are sent by the terminating switch are 
computer generated and sound very even and clear with no signal 
irregularity. In SxS, all calls to a particular DN are sent to 
the same busy signal termination number, which can be reached 
most of the time by a POTS number. These busy tones are not 
computer generated and the voice path is not cut-off.


 	 
 You can take advantage of this and possibly have a 'busy 
signal conference'. This can be achieved by having several people 
dial the same busy DN that is served by a Step office, or by 
dialing an always-busy termination number. When you are connected 
to the busy signal, you will also be able to hear anyone else who    7   3                     has dialed the same busy number. Connection quality is very poor 
however, so this is not a good way to communicate.


 	 
 As an added bonus, answering supervision is not returned on 
busy numbers, and thus the call will be toll-free for all parties 
involved. However, you must be using AT&T as your inter-LATA 
carrier if the call to the busy number is an inter-LATA call for 
you. So if your IC is US Sprint, you must first dial the AT&T 
Carrier Access Code (10ATT) before the busy number. If your IC 
doesn't detect answer supervision, and begins billing immediately 
or after a certain amount of time, then you will be billed for 
the length of the call.



 	 
 Temporarily 'freezing' a line

 	 
 -----------------------------


 	 
 A SxS switching system that operates on the direct control 
principle is controlled directly by what the subscriber dials. 
Jamming a line on SxS to prevent service is possible by simply 
flashing the switchhook a number of times. Or you may find after 
several aborted dialing attempts, the line will freeze until it 
is reset, either manually or by some time-out mechanism. Usually 
the time the line is out of action is only a few minutes. The 
line will return a busy signal to all callers, and the subscriber 
who has a 'dead' phone will not even hear sidetone. This happens 
when one of the elements in the switch train gets jammed. The 
switch train consists of the linefinder, which sends a dial tone 
to the subscriber who lifted his telephone, and places voltage on 
the S (Sleeve) lead as to mark that given DN as busy. Next in the 
switch train are the selectors. The selectors are what receive 
the digits you dial and move accordingly. The last step in the 
switch train is the connector. The connector is what connects 
calls that are intraoffice, and sends calls to a Toll office when 
necessary. Other types of devices can be used in the switch 
train, such as Digit Absorbing Selectors, where needed.


 	 
 Toll/Operator assisted dialing

 	 
 ------------------------------


 	 
 You may be able to dial 1/0+ numbers with your prefix in
cluded in some areas. You can dial any call that you could nor
mally reach by dialing 1+ or 0+. For example, to dial an operator 
assisted call to a number in Chicago, you could dial NXX + 0312 + 
555 + 1000 where NXX is your prefix, and you would receive the 
usual TSPS bong tone, and the number you dialed, 312 + 555 + 
1000, would show up on the TSPS consoles LED readout board. You 
can also use a 1 in place of the 0 in the above example to put 
the call through as a normal toll call.


 	 
 This method does not bypass any type of billing, so don't 
get your hopes up high.


 	 
 The reason this works is twofold. The first reason is that 
the thousandths digit in many SxS offices determines the type of    7   3                     call. A 0 or a 1 in place of another number (which would repre
sent a local call) is handled accordingly. The other reason is 
due to a Digit Absorbing Selector that can be installed in some 
SxS offices to 'absorb' the prefix on intraoffice calls when it 
is not needed to process the call. A DAS can absorb either two or 
three digits, depending on whether the CO needs any prefix 
digit(s) for intraoffice call completion.


 	 
 Hunting prefixes

 	 
 ----------------


 	 
 SxS switches may also translate an improperly dialed local 
call and send it to the right area over interoffice trunks. Take 
for instance, you need to make a local call to 492-1000. You 
could dial 292-1000 and reach the exact same number, provided 
that there is no 292 prefix within your local calling area. 
However, only the first digit of a prefix may be modified or the 
call will not go through correctly unless you happen to have 
dialed a valid local prefix. You also cannot use a 1 or a 0 in 
place of the first prefix digit, because the switch would inter
pret that as either dialing a toll or an operator assisted call.


 	 
 Trunks

 	 
 ------


 	 
 Step by Step switching system incoming and outgoing trunks 
are very likely to use In-band supervisory signalling. This means 
you could possibly use numbers served by a SxS CO to blue box off 
of. But, some older step areas may not use MF signaling, but DP 
signalling. DP signaling uses short bursts of 600Hz to transfer 
information as opposed to Multi-Frequency tones. In DP signaling, 
there are no KP or ST equivalents. Boxing may be accomplished 
from DP trunks by sending short bursts of 2600Hz (2 bursts would 
be the digit 2). Acceptable pulse rates are 7.5 to 12 pulses per 
second, but the normal rate is 10 pulses per second. A pulse 
consists of an 'on hook' (2600Hz) tone and an off-hook (no tone). 
So, at 10 pulses per second, a digit might be .04 seconds of tone 
and .06 seconds of silence. DP is rarely used today, but some 
direct-control Step offices still use it. Common Control Step 
offices are much more likely to use MF trunk signalling.



 	 
 As said at the start of this file, some of the things men
tioned here may have no practical use, but are being exposed to 
the public and to those who did not know about any one of the 
procedures mentioned here previously.


 	 
 References and acknowledgements

 	 
 -------------------------------


 	 
 Basic Telephone Switching Systems-By David Talley, Hayden 
publishers

 	 
 No. 1 AMARC-Bell System Technical Journal

 	 
 Mark Tabas for information about CAMA and DP, The Marauder, 
and Doom Prophet.   7   3                     

Verification By Fred Steinbeck From TAP issue # 88  10-83
------------


 	 
 There has been a great deal of controversy in the realm of 
phreakdom over a mysterious subject known under a number of 
different names, including "Verification", "Autoverification", 
"Verify", "Autoverify", "Verify Busy", and even "VFY BY". All of 
these names basically mean the same thing: the ability to listen 
to another person's telephone line from any telephone in the 
direct-dialable world.


 	 
 Needless to say, Bell System is very tight lipped about 
knowledge regarding verification. Indeed, the infamous book 
'Notes  on long distance dialing' ('68 edition) says, "Care must 
be taken to insure that the customer never gains verification 
capabilities." With a printed policy like that, you can imagine 
what their real-world policy is like! Even their own rate and 
route operators will not give verification on routing codes (at 
least in my experience), one even responding, "What?! You must be 
crazy! We don't give those out!" Before you get too far into this 
article, I will state simply: I don't know how to verify. Howev
er, I have been fooling with various things related to it, and 
collecting information on it for some time now. Therefore, while 
I can't do it (yet), I may be able to point some other bright 
TAPer on the right track, and perhaps he or she will show us all 
how. If you have knowledge not covered in this article, but don't 
want to write an article on your own, please send your ideas, 
comments, or information to Project Verify, C/O TAP.   


 	 
 Verify has also been called "Autoverify", and I have no idea 
why. This is not, to my knowledge, a Bell System term (at least 
I've never seen it in any manuals). As far as I know, there is 
verify, which means being able to listen to speech (kind of; see 
below) on a line, and there is the "Emergency Interrupt which 
allows you to take part in the conversation taking place on the 
line in question. It has been suggested that "Autoverify" is the 
same as an emergency interrupt , but I tend to disagree with this 
idea. It should be noted that the verification circuitry does not 
actually let an operator listen to a conversation without making 
a beep on the line every so often. Instead, she will hear en
crypted speech. However, I believe with the proper methods, 
verify can be converted to an emergency interrupt. 


 	 
 Verification is normally done either by your normal "0" 
(TSPS) operator, if the call is in your home NPA (HNPA), or by an 
inward operator (IO). If the call is outside your HNPA, your 
normal operator will call the IO for the NPA,and say, "Verify 
Busy" or "Emergency Interrupt" please, 555 1212."  The IO will 
perform whatever magic he or she must, and then report back. If 
the call is in your HNPA, though, the "0" operator can do the 
verification herself by using the "VFY BY" key on her keyshelf. 
However, in some areas, the operator uses a routing code to 
accomplish verification, and this is the loop hole we shall at
tack.    7   3                     


 	 
 It follows that if a IO or "0" operator can do it, so can 
we, with a blue box. Now, courtesy of Robert Allen (who brought 
it to my attention) and Susan Thunder (who apparently discovered 
it), here is what used to work for getting operators to hook you 
into conversations with other people (i.e.,let you listen to them 
till you hung up): You'd call the operator and say "Operator, 
TSPS Maintenance Engineer Calling. Ring forward to 001 + NPA + 
7d, ring back to my number, hit ring forward, no AMA, and then 
position release. 


 	 
 This creates some problems, and you must be familiar with 
the TSPS console (by dialing "0"), you are on the "back", or 
incoming part of a loop. When she places a call for you, the call 
goes out on the "forward", or outgoing part of the loop. If an 
operator wants to make a call, she punches KP FWD (keypulse 
forward), the number, and ST. Ring FWD puts a 90 volt ringing 
signal across the forward part of the line (and may dial the 
number as well).  The problem arises from the fact that I don't 
know if Ring FWD will actually dial a call, and if there is some 
other subtle difference between it and KP FWD. 


 	 
 Let us assume ringing forward makes a call from the TSPS 
console to whatever number is given. Ring back causes your phone 
to ring (it is assumed you hung up after giving her your instruc
tions; if you didn't you'd hear an annoying 90 volts across the 
earpiece.) "No AMA" means "no automatic message accounting", so 
nobody gets billed for the call, although it will show up on a 
tape somewhere. "Position Release" removes the operator from the 
circuit, and allows her to receive other calls. This leaves an 
unaccounted-for ring forward. 


 	 
 The verification circuit, as you know, likes to encrypt 
conversation, which is something we don't want. Well, the second 
Ring FWD sends another 90 volts crashing against the verify 
circuitry, which Juda Gerad thinks removes the voice encryption 
from the line, puts the operator (and you) in circuit, and puts a 
beep tone on the line every five seconds. This seems to make 
sense, and I am inclined to agree with him. 


 	 
 The bit about "..001 + NPA + 7D" causes the thought "MF 
routing code" to spring immediately to mind. Now, the above trick 
was supposed to work in the 213 NPA. I have tried both "KP + 001 
+ 213 + 7D + ST", and some other area codes. I generally get 
nothing, a reorder signal, or a tandem recording. 


 	 
 Here's some food for thought: On an official Telco sheet I 
have, labeled " 213 NPA MF Routing Codes", 001 is listed as "VFY 
BY", or verify busy for the 213 NPA. 002 is listed for the 805 
NPA. Ma Bell likes to have standardized routing codes, such 
logical, then, that 001 would be a sort of "standard" verify 
code, and other prefixes would be tacked on at 002,003, etc. 
However, I have heard from a retired operator that verification 
codes are different from area to area, and are not always nice 
numbers like 001, 002. Ah, well, a guy can hope, can't he?    7   3                     


 	 
 Some suggestions for future attacks on this dilemma: Every
one call your operators and subtly ask questions. I have found 
they tend to give information out easier if you ask for something 
that you would ordinarily have to be a company employee to know 
about, such as rate steps, operator routings, etc. 


 	 
 Casually let slip that you used to be (or still are) an 
operator, or that you work for company security. Also, you might 
want to blue box some codes like 001 followed by your NPA and the 
last 7D of a busy number. If you get a sort of "whispery noise", 
try blasting the line with a ringing signal (you might piggyback 
another line onto yours and call the piggyback to generate the 90 
volts) and see if that does anything.

.pa  %   3                     
.h1o #                                        International Dialing 

 	!
 Chapter 3


 	xx!
 International Dialing

 	xx!
 ---------------------

INTERNATIONAL DIALING by Dr Jimmy and Mr Jim
---------------------


 	@@!
 The Phun of International Calling
                ---------------------------------

 	rr!
 -or-

 	!
 How you can be an diplomat for the United States
        ------------------------------------------------


 	 
 There are several ways to complete the overseas connection.


 	 
 One is to use extenders (800 #s) with international calling 
capability, this is easy for most people since it can be done 
from fortress phones (payphones), what a mind blower, calling a 
overseas payphone from a payphone. But 800 #s can be traced.


 	 
 Another bummer is that they can not be called from the 
Lyons' Teleconferencing Network, well not directly that is. 
Another alternative is to use a PBX or PABX system which will 
dial an outside line, well the 800 extenders are also PBXs usual
ly, but PBXs which do not have an NPA of 800 are only good for 
local calls can be called in from the teleconference, but the 
connection is not that great. I know, because on a recent tele
conference we called a girl in London and the American Embassy in 
Iran, and a couple of Australian payphones. Another problem with 
bringing PBXs and extenders into the teleconference is getting 
rid of them if the phone answers busy or doesn't answer. You have 
to blast 2600Hz on the teleconference, this can trunk many people 
on line. Unfortunately at the present time, international calling 
and Lyons' teleconferencing do not go well together. This fact 
shattered this phreak's dream of a worldwide teleconference.


 	 
 Enough about that. Here are some ways to calling interna
tionally with a Blue Box or anything that generates MF tones.  
First of all, seize a tandem in the usual way and perform this 
sequence of events:

     KP + NPA + ZZZ + ST


 	 
 Where KP and ST are the standard tones you all familiar 
with, and NPA, ZZZ are the Number Planning Area and number of the 
overseas sender respectively. (They will be listed later.) Now 
you should here a slight clunk-cheep or CLUNK, depending on where 
you are. Then a continuous carrier is heard. This is what you 
want. Now do this sequence of events:

     KP + XCC + SC + LN + ST

Where X is a 1 for cable connection
             0 for satellite connection   7   3                     
CC is the two or three digit country code
SC is the City Code of the city you wish to call
LN is the Local Number, this can be from three to eight digits.


 	 
 Also since you are using a MFer you can reach inward opera
tors. I do not know if this can be done from an PBX or extender.


 	 
 The list of some the country codes and city codes are listed 
at the end of this file, or are available from the phone book 
(medium to large cities with direct international calling avail
able through 011, usually are listed in the front few pages.)


 	 
 OR you can do it as the Doctor does, make the phone company 
operators work for their money, use Rate and Route.


 	 
 To call up Rate and Route, get on your favorite trunk and 
beep this:

    KP + 800 + 141 + 1212 + ST


 	 
 Now you may note, this has a NPA of 800, but it cannot be 
directly dialed through DTMF or rotary since it is an invalid 
exchange to you the subscriber.


 	 
 When you call this up, you will be connected with a TSPS 
position and if all the positions are busy, it will give you a 
recording: 'Please hold on. All positions are busy at the moment 
and your request will be answered as soon as possible.' Wait, it 
really does answer.


 	 
 When you are hooked up to the Rate and Route operator ask 
for:

TSPS International Inward Operators Route to ....., or
TSPS International Directory Assistance Route to .....

where ..... is the city and country NAME, not code. and she/he 
will say: "Right. That's  county code CC, city code SC, and then 
the number is #####."


 	 
 And these numbers do vary. London information is:

           44 + 1 + 986 + 3611


 	 
 and Sydney, Australia is:

            61 + 2 + 0143


 	 
 I am not completely certain, but I believe when you MF into 
a non-English speaking country, Inward and D. A. Ops speak Eng
lish because I believe they know it is coming from the United 
States. At least this happened with me when I called German D. A.


 	 
 I have not called any country, other than Germany, which 
does not have English as its main language.   7   3                     

A list of the overseas senders:

      Location       NPA         Number
      --------       ---         ------
White Plains, NY     914          182
New York City        212          183
Pittsburgh, PA       412          184
Orlando, FL          305          185
Oakland, CA          415          186
Denver, CO           303          187



Overseas Boxing By King Blotto
---------------


 	 
 The miracles of a blue box can't unfold, until one takes 
full advantage of it by calling overseas. There has been much 
speculation about boxing overseas, and alot of B.S.


 	 
 First off, there is no such thing as KP2! Or 11 or 12 tones. 
This is just somebody's ramblings! There is a KP special tone, 
but more on that some other day. Anyways, the correct procedure 
to calling international via blue box is:


 	 
 KP011CCCS <- where CCC is the country code. And it
                  must be 3 digits long. If the code is
                  only 2 (e.g. England), then a '0' must
                  prefix it.


 	 
 Second sequence is :


 	 
 KP01CCXXXxxxx <- where CC is the 2 digit city code
                  with a '0' used as a prefix if less than
                  two digits. XXX-xxxx is the local number.
                  Don't forget the ST tone at the end.


 	 
 Anyways, an example call to England, to the Kelshire Hilton 
in London would go:

      KP011044ST
      KP01016035342ST


 	 
 You should already know how to seize a tandem. But, as a 
tip, you should use something that is used to being used for long 
periods of time:
.pa  0   3                     
The History Of British Phreaking by Lex Luthor
--------------------------------


 	 
 (With thanks to Peter McIvers for the list of frequencies 
mentioned later in this file.)


 	 
 NOTE: the British Post Office, is the U.S. equivalent of Ma 
Bell.


 	 
 In Britain, phreaking goes back to the early fifties, when 
the technique of 'Toll A drop back' was discovered. Toll A was an 
exchange near St. Paul's which routed calls between London and 
nearby non-London exchanges. The trick was to dial an unallocated 
number, and then depress the receiver-rest for 1/2 second. This 
flashing initiated the 'clear forward' signal, leaving the caller 
with an open line into the Toll A exchange. He could then dial 
018, which forwarded him to the trunk exchange- at that time, the 
first long distance exchange in Britain- and follow it with the 
code for the distant exchange to which he would be connected at 
no extra charge.


 	 
 The signals needed to control the UK network today were 
published in the "Institution of Post Office Engineers Journal" 
and reprinted in the Sunday Times (15 Oct. 1972).


 	 
 The signaling system they use: signaling system No. 3 uses 
pairs of frequencies selected from 6 tones separated by 120Hz. 
With that info, the phreaks made "Bleepers" or as they are called 
here in the U.S. "Blue Box", but they do utilize different MF 
tones then the U.S., thus, your U.S. blue box that you smuggled 
into the UK will not work, unless you change the frequencies.


 	 
 In the  early seventies, a simpler system based on different 
numbers of pulses with the same frequency (2280Hz) was used. For 
more info on that, try to get ahold of: Atkinson's "Telephony and 
Systems Technology".


 	 
 The following are timing and the frequencies for boxing in 
the UK and other foreign countries. Special thanks to Peter 
McIvers for the following info:


 	 
 British "bleeper" boxes have the very same layout as U.S. 
blue boxes. The frequencies are different, though. They use two 
sets of frequencies, forward and backward. Forward signals are 
sent out by the bleeper box; the backward signals may be ignored 
(it's sort of like using full duplex). The frequencies are as 
follows:

U.S.:
UK:	     700    900    1100   1300	 1500	1700
Forward:    1380   1500    1620   1740	 1860	1980 Hz
Backward:   1140   1020    900	   780	  660	 540 Hz
.pa  5   3                     

 	 
 For example, change the 900 Hz potentiometers in your box to 
1500 Hz. All numbers 1-0 (10) are in the same order as in an 
American box. The ones after this are their codes for operator 
11, operator 12, spare 13, spare 14, and 15. 


 	 
 One of these is KP, one (probably 15) is Star; it won't be 
too hard to figure out. The signals should carry -11.5dBm +/- 1dB 
onto the line; the frequencies should be within +/- 4Hz (as is 
the British equipment). Also, the 1VF system is still in opera
tion in parts of the U.K. This would encode all signals 1 to 16 
as binary numbers; for instance, a five is 0101. There are six 
intervals per digit, each 50ms long for a total of 300ms. First 
is a start pulse of 2280 for 50ms. Then, using the example of 
five (0101), there is a 50ms pause, a 50ms pulse of 2280, a 50ms 
pause, and a 50ms pulse of 2280. Finally, there is a 50ms pause 
that signals the end of the digit. The frequency tolerance on the 
2280 Hz is +/- 0.3%; it is sent at -6 +/- 1dBm.  An idle line is 
signaled by the presence of a 3825Hz tone for more than 650ms. 
This must be within 4Hz.


 	 
 France uses the same box codes as the US, with an additional 
1900Hz acknowledgement signal, at -8.7 +/- 1dBm per frequency.


 	 
 Spain uses a 2 out of 5 mf code (same frequencies as US), 
with a 1700 Hz acknowledge signal.


 	 
 Other places using the 1VF system are:

Australia, 2280Hz +/-6Hz, 35ms/digit at -6dB.

Germany, France: same as Australia; also, some 1VF systems in the 
UK.

Switzerland: same as Australia, only it uses 3000Hz, not 2280.

Sweden: same as above, but at 2400Hz.

Spain: some parts use 1VF with 2500Hz.


 	 
 There is one other major system: the 2VF system. In this 
system, each digit is 35ms long. The number is encoded in binary 
as with the 1VF system. Using the example of five (0101), here's 
how the American 2VF system was sent:

2400 pulse, pause, 2040 pulse, pause, 2400 pulse, pause, 2040 
pulse, pause. The digits and pauses are all 35ms long, for a 
total of 280ms per digit. Other countries are still using a 
similar high/low pair with the same timings. Some parts of Italy 
use the 1VF system with 2040Hz; some use the 2VF system with 2040 
and 2400 (same as original US) Hz. The Netherlands uses a 2VF 
system with 2400 and 2500 Hz pulses. With the 2VF system, all 
frequencies should be within 2Hz.
.pa  5   3                     

 	 
 Also, here are some specs for American phone equipment:

Dial Tone: 350+440Hz, -17.5 to -14.5 dBm/tone.

Off-Hook (ROH): 1400+2060+2450+2600(!) on/off 5 times per second

Busy: 480+620Hz; slow busy: 0.5 +/- 0.05 sec = 1 period
(about twice a second), at -28.5 to -22.5 dBm/tone.

Ring: 440+480 Hz at -23.5 to -20.5 dBm/tone.
A ring is modulated at 20 +/- 3Hz, 2sec on, 4sec off.

Call waiting: 440Hz, on 1 second.

Recorder Connection: 1400Hz, beeps every 15minutes.

Multiparty line ring: same frequency and modulation as ring, but 
1sec on, 2sec off (twice as fast).


 	 
 Now, back to British Phreaking:In the early days of British 
phreaking, the Cambridge University Titan Computer was used to 
record and circulate numbers found by the exhaustive dialing of 
local networks. These numbers were used to create a chain of 
links from local exchange to local exchange across the country, 
bypassing the trunk circuits. Because the internal routing codes 
in the UK network are not the same as those dialed by the caller, 
the phreaks had to discover them by 'probe and listen' techniques 
or more commonly known in the U.S.--SCANNING. What they did was 
put in likely signals and listened to find out if they succeeded. 
The results of scanning were circulated to other phreaks. Discov
ering each other took time at first, but eventually the phreaks 
became organized. The "TAP" of Britain was called "Undercurrents" 
which enabled British phreaks to share the info on new numbers, 
equipment etc.


 	 
 To understand what the British phreaks did, think of the 
phone network in three layers of lines: Local, trunk, and inter
national. In the UK, Subscriber Trunk Dialing (STD), is the 
mechanism which takes a call from the local lines and (legiti
mately) elevates it to a trunk or international level. The UK 
phreaks figured that a call at trunk level can be routed through 
any number of exchanges, provided that the right routing codes 
were found and used correctly. They also had to discover how to 
get from local to trunk level either without being charged (which 
they did with a bleeper box) or without using (STD). Chaining has 
already been mentioned but it requires long strings of digits and 
speech gets more and more faint as the chain grows, just like it 
does when you stack trunks back and forth across the U.S. The way 
the security reps snagged the phreaks was to put a simple 'print
ermeter' or as we call it: a pen register on the suspects line, 
which shows every digit dialed from the subscribers line.
.pa  4   3                     

 	 
 The British prefer to get onto the trunks rather than chain
ing. One way was to discover where local calls use the trunks 
between neighboring exchanges, start a call and stay on the trunk 
instead of returning to the local level on reaching the distant 
switch. This again required exhaustive dialing and made more work 
for Titan; it also revealed 'fiddles', which were inserted by 
Post Office Engineers. What fiddling means is that the engineers 
rewired the exchanges for their own benefit. The equipment is 
modified to give access to a trunk with out being charged, an 
operation which is pretty easy in Step by Step (SXS) electrome
chanical exchanges, which were installed in Britain even in the 
1970s (NOTE: I know of a back door into the Canadian system on a 
4A CO., so if you are on SXS or a 4A, try scanning 3 digit ex
changes, i.e.,: dial 999,998,997 etc. and listen for the beep-
kerchink, if there are no 3 digit codes which allow direct access 
to a tandem in your local exchange and bypasses the AMA so you 
won't be billed, not have to blast 2600 every time you wish to 
box a call.


 	 
 A famous British 'fiddler' revealed in the early 1970s 
worked by dialing 173. The caller then added the trunk code of 1 
and the subscribers local number. At that time, most engineering 
test services began with 17X, so the engineers could hide their 
fiddles in the nest of service wires. When security reps started 
searching, the fiddles were concealed by tones signaling: 'number 
unobtainable' or 'equipment engaged' which switched off after a 
delay. The necessary relays are small and easily hidden.


 	 
 There was another side to phreaking In the UK in the six
ties. Before STD was widespread, many 'ordinary' people were 
driven to occasional phreaking from sheer frustration at the 
inefficient operator controlled trunk system. This came to a head 
during a strike about 1961 when operators could not be reached. 
Nothing complicated was needed. Many operators had been in the 
habit of repeating the codes as they dialed the requested numbers 
so people soon learnt the numbers they called frequently. The 
only 'trick' was to know which exchanges could be dialed through 
to pass on the trunk number. Callers also needed a pretty quiet 
place to do it, since timing relative to clicks was important. 


 	 
 The most famous trial of British phreaks was called the Old 
Baily trial. Which started on 3 Oct. 1973. What they phreaks did 
was to dial a spare number at a local call rate but involving a 
trunk to another exchange. Then they send a 'clear forward' to 
their local exchange, indicating to it that the call is finished; 
but the distant exchange doesn't realize because the caller's 
phone is still Off the hook. They now have an open line into the 
distant trunk exchange and sends to it a 'seize' signal: '1' 
which puts him onto its outgoing lines. Now, if they know the 
codes, the world is open to them. All other exchanges trust his 
local exchange to handle the billing; they just interpret the 
tones they hear. 
.PA  5   3                     

 	 
 Meanwhile, the local exchange collects only for a local 
call. The investigators discovered the phreaks holding a confer
ence somewhere in England surrounded by various phone equipment 
and bleeper boxes, also printouts listing 'secret' Post Office 
codes. (They probably got them from trashing?) The judge said: 
"some take to heroin, some take to telephones" for them phone 
phreaking was not a crime but a hobby to be shared with fellow 
enthusiasts and discussed with the Post Office openly over dinner 
and by mail. Their approach and attitude to the worlds largest 
computer, the global telephone system, was that of scientist s 
conducting experiments or programmers and engineers testing 
programs and systems. The judge appeared to agree, and even asked 
them for phreaking codes to use from his local exchange!!!

.pa  p&   3                     
.h1o #                                                    The Boxes   

 	!
 Chapter 4


 	!
 The Boxes

 	!
 ---------

The Aqua Box by Kopy Kat
------------ 
 

 	 
 For a long time, it was impossible to escape from the lock 
in trace, this box does offer an escape route with simple direc
tions to it. This box is quite a simple concept, and almost any 
phreaker with basic electronics knowledge can construct and use 
it.
 

 	 
 The Lock in Trace

 	 
 -----------------


 	 
 A lock in trace is a device used by the F.B.I. to lock into 
the phone users location so that he can not hang up while a trace 
is in progress. For those of you who are not familiar with the 
concept of `Locking In', then here's a brief explanation.


 	 
 The F.B.I. can tap into a conversation, sort of like a 
three-way call phone line. All the phone connections are held 
open by a certain voltage of electricity, that is why you some
times get static and a faint connection when you are calling far 
away, because the electricity has trouble keeping the line up. 
What the lock in trace does is cut into the line and generate 
that same voltage straight into the lines. That way, when you try 
to hang up, voltage is retained. Your phone will ring like some
one was calling you even after you hang up. (If you have call-
waiting, you should understand better about that.)


 	 
 So, in order to eliminate the tracer, you must lower the 
voltage on your phone line.  You should know that every time 
someone else picks up the phone line, then the voltage decreases 
a little. In the first steps of planning this out, K.K. suggested 
getting about hundred phones all hooked into the same line that 
could all be taken off the hook at the same time. That would 
greatly decrease the voltage level. That is also why most three-
way connections that are using Bell service three way calling 
become quite faint after a while.


 	 
 By now, you should understand the basic idea. You have to 
drain all of the power out of the line so the voltage can not be 
kept up.  A rather sudden draining of power would quickly defeat 
the F.B.I's voltage machine, because it was only built to sustain 
the exact voltage necessary to keep the line open.


 	 
 For now, imagine this: One of the normal Radio Shack genera
tors that you can go pick up one end of the cord that hooks into 
the central box has a phone jack on it and the other has an 
electrical plug. This way, you can "Flash" voltage through the 
line, but cannot drain it. So, some modifications have to be 
done.    7   3                     

 	 
 The Aqua Box 

 	 
 ------------


 	 
 Materials Needed- 

 	 
 ----------------
.lm .5"
.pm .25"


 	
 A BEOS (Basic Electrical Output Socket), like a small lamp 

 	
 type connection, where you just have a simple plug and wire 

 	
 that would plug into a light bulb. 


 	
 One of the cords mentioned above, if you can't find one then 

 	
 construct your own...  Same voltage connection, but the 

 	
 restrainer must be built in. (I.E. the Central Box).


 	
 Two phone jacks (one for the modem, one for if you are being 

 	
 traced, to plug the aqua box into). 


 	
 Some creativity and easy work. 
.pm 0"
.lm 0"


 	 
 NOTICE:  No phones have to be destroyed/modified to make 
this box, so don't go out and buy a new phone for it! 


 	 
 All right, this is a very simple procedure. If you have the 
BEOS, it could drain into anything, a radio, or whatever.
.pm .25"
.lm .5"


 	
 1) Take the connection cord. Examine the plug at the end. It 

 	
 should have only two prongs, if it has three, still, do not 

 	
 fear. Make sure the electrical appliance is turned off 

 	
 unless you want to get fried the quick way while making this 

 	
 thing. Most plugs will have a hard plastic design on the top 

 	
 of them to prevent you from getting in at the electrical 

 	
 wires inside. Well, get a nice sharp blade and remove it. If 

 	
 you want to keep the plug, ( I don't see why..) then just 

 	
 cut the top off. When you look inside, low and behold, you 

 	
 will see that at the base of the prongs there are a few 

 	
 wires connecting in. Those wires conduct the power into the 

 	
 appliance. So, you carefully unwrap those from the sides and 

 	
 pull them out until they are about an inch ahead of the 

 	
 prongs. If you don't want to keep the jack, then just rip 

 	
 the prongs out. If you are, cover the prongs with insulation 

 	
 tape so they will not connect with the wires when the power 

 	
 is being drained from the line. 


 	
 2) Do the same thing with the prongs on the other plug, so you 

 	
 have the wires evenly connected. Now wrap the end of the 

 	
 wires around each other. If you happen to have the other end 

 	
 of the voltage cord hooked into the phone, stop reading now, 

 	
 you're too stupid to continue. After you've wrapped the 

 	
 wires around each other, then cover the whole thing with the 

 	
 plugs with insulating tape. Then, if you build your own 

 	
 control Box or if you bought one, then cram all the wires 

 	
 into that and reclose it. That box is your ticket out of 

 	
 this. 
.pa  6   3                     

 	
 3) Re-Check everything to make sure it's all in place. This is 

 	
 a pretty flimsy connection, but on later models when you get 

 	
 more experienced at it then you can solder away at it and 

 	
 form the whole device into one big box, with some kind of 

 	
 cheap MATTEL hand-held game inside to be the power connect

 	
 er. 
.pm 0"
.lm 0"


 	 
 In order to use this, just keep this box handy. Plug it into 
the jack if you want, but it will slightly lower the voltage so 
it isn't connected. When you plug it in, if you see sparks, 
unplug it and restart the whole thing. But if it just seems fine, 
just leave it. 


 	 
 Using it!!

 	 
 ----------


 	 
 Now, so you have the whole thing plugged in and all. Do not 
use this unless the situation is desperate! When the trace has 
gone on, don't panic, unplug your phone, and turn on the appli
ance that it was hooked to. It will need energy to turn itself 
on, and here's a great source. Just plug it into the phone jack 
and your troubles are over! The voltage to keep a phone line open 
is pretty small and a simple light bulb should drain it all and 
you will no longer need to worry about the system attempting to 
invade upon your privacy.



Introducing the Beige Box by The Exterminator & The Terminal Man
-------------------------    (5/17/85)
                             

 	 
 INTRODUCTION

 	 
 ------------


 	 
 Have you ever wanted a lineman's handset? Surely every 
phreak has at least once considered the phun that he could have 
with one. After searching unlocked phone company trucks for one 
for months, we had an idea. We could build one. We did, and named 
it the "Beige Box, " simply because that is the color of ours. In 
the following file we will give complete instructions for the 
construction and use of a Beige Box.


 	 
 CONSTRUCTION

 	 
 ------------


 	 
 The construction is very simple. First, you must understand 
the concept of the device. In a modular jack, there are four 
wires. These are red, green, yellow, and black. For a single line 
telephone, however, only two matter: the red (ring) and green 
(tip). The yellow and black are not necessary for this project. A 
lineman's handset only has two clips on it: the ring and the tip.
.pa  4   3                     

 	 
 You will need a phone (we recommend a touch-tone) with a 
modular plug, a modular jack, and two large alligator clips 
(preferably red and green, respectively). Take the modular jack 
and look at the bottom of its casing. There should be a gray jack 
with four wires (red, green, yellow, and black) leading out of 
it. To the end of the red wire attach a red alligator clip. To 
the end of the green wire attach a green alligator clip. The 
yellow and black wires can be removed, although I would only set 
them aside so that you can use the modular jack in future 
projects. Now insert your telephone's modular plug into the 
modular jack. That's it.


 	 
 This particular model is nice because it can be easily made, 
is inexpensive, uses common parts that are readily available, is 
small, is lightweight, and does not require the destruction of a 
phone.


 	 
 BEIGE BOX USES

 	 
 --------------


 	 
 There are many uses for the Beige Box. However, before you 
can use it, you must know how to attach it to its output device. 
This device can be any of several Bell switching apparatus that 
include terminal sets (i.e., remote switching centers, bridging 
heads, cans, etc.). To open most Bell Telephone switching appara
tus, you must have a 7/16 inch hex driver. This piece of equip
ment can be picked up at your local hardware store. With your 
7/16 hex driver, turn the security bolt(s) approximately 1/8 of 
an inch counter-clockwise and open. If your output device is 
locked, then you must have some knowledge of destroying and/or 
picking locks. However, we have never encountered a locked output 
device. Once you have opened your output device, you should see a 
mass of wires connected to terminals. On most of your output 
devices, the terminals should be labeled "T" (Tip - if not la
beled, it is usually on the left) and "R" (Ring - if not labeled, 
it is usually on the right). Remember: Ring - red -  right. The 
"Three R's" -- a simple way to remember which is which.


 	 
 Now you must attach the red alligator clip (ring) to the "R" 
(ring) terminal. Attach the green alligator clip (tip) to the "T" 
(tip) terminal. NOTE: If instead of a dial tone you hear nothing, 
re-adjust the alligator clips so that they are not touching each 
other or other terminals. Also make sure that they are firmly 
attached. By this time you should hear a dial tone. Dial ANI and 
find out the number that you are using (you wouldn't want to use 
your own).
.pa  p/   3                     
   Here are some practical applications:
.pm .25"
.lm .5"


 	
 o  Eavesdropping

 	
 o  Long distance, static-free phone calls to friends

 	
 o  Dialing direct to Alliance Conferencing (also static-free)

 	
 o  Phucking people over

 	
 o  Bothering the operator at little risk to yourself

 	
 o  Blue Boxing with a greatly reduced chance of getting caught

 	
 o  Anything at all that you want, since you are an extension 

 	
 on that line
.lm 0"
.pm 0"


 	 
 Eavesdropping:

 	 
 -------------


 	 
 To be most effective, first attach the Beige Box and then 
your phone. This eliminates static caused by connecting the box, 
therefore reducing the potential suspicion of your victim. When 
eavesdropping, it is always best to be neither seen nor heard. If 
you hear someone dialing out, do not panic; but rather hang up, 
wait, and pick up the receiver again. The person will either have 
hung up or tried to complete their call again. If the latter is 
true, then listen in, and perhaps you will find information 
worthy of blackmail! If you would like to know who you are lis
tening to, after dialing ANI, pull a CN/A on the number.


 	 
 Dialing Long Distance:

 	 
 ---------------------


 	 
 This section is self-explanatory, but don't forget to dial a 
"1" before the NPA.



 	 
 Dialing Direct to Alliance Conferencing:

 	 
 ---------------------------------------


 	 
 Simply dial 0-700-456-1000 and you will get instructions 
from there. I prefer this method over PBXs, since PBXs often have 
poor reception and are more difficult to come by.


 	 
 Phucking People Over:

 	 
 --------------------


 	 
 This is a very large topic for discussion. Just by using the 
other functions described, you can create a large phone bill for 
the person (they will not have to pay it, but it is a hassle for 
them). In addition, since you are an extension of the person's 
line, leave your phone off hook, and they will not be able to 
make or receive calls. This can be extremely nasty because no one 
would suspect the cause of the problem.
.pa  2   3                     

 	 
 Bothering the Operator:

 	 
 ----------------------


 	 
 This is also self-explanatory and can provide hours of 
entertainment. Simply ask or say things to her that are offensive 
and you would not like traced to your line. This also corresponds 
with the previous described section, Phucking People Over. After 
all, guess who's line it gets traced to?


 	 
 Blue Boxing:

 	 
 -----------


 	 
 See a file on Blue Boxing for more details. This is an 
especially nice feature if you live in an ESS-equipped prefix, 
since the calls are, once again, not traced to your line.


 	 
 POTENTIAL RISKS OF BEIGE BOXING

 	 
 -------------------------------


 	 
 Overuse of the Beige Box may cause suspicions within the 
Gestapo, and result in legal problems. Therefore, I would recom
mend that you:
.pm .25"
.lm .5"


 	
 o  Use more than one output device

 	
 o  Choose a secluded spot to do your Beige Boxing

 	
 o  Keep a low profile (i.e., do not post under your real name 

 	
 on a public BBS concerning your accomplishments)

 	
 o  In order to make sure that the enemy has not been inside 

 	
 your output device, I recommend that you place a piece of            

 	
 transparent tape over the opening of your output device. 

 	
 Therefore, if it is opened in your absence, the tape will be 

 	
 displaced and you will be aware of the fact that someone has 

 	
 been intruding upon your territory.
.lm 0"
.pm 0"

Beige Boxing By Cardiac Arrest [09/26/89]
------------


 	 
 Introduction

 	 
 ------------


 	 
 Well, I KNOW that nearly everybody and their brother knows 
how to beige box, but what magazine is complete without a file as 
basic as that. Anyways, if you know how to beige box, and consid
er yourself master beiger, skip this and go on to the next file.  
Otherwise, I'll try to help beginners and maybe give some experi
enced boxers food for thought.
.pa  p/   3                     

 	 
 What IS Beige Boxing

 	 
 --------------------


 	 
 If you've ever paid any attention to the phone company, 
you've definitely seen a guy in funny Ma Bell overalls running 
around with a funny-looking telephone with alligator clips coming 
out the bottom. That's the Ma Bell version of the "beige box", 
called a Lineman's Handset. There are literally TONS of uses for 
a beige boxes, and they are simple to make, so it's usually a 
good introduction to the phreaking world.


 	 
 The Purpose Of This File

 	 
 ------------------------


 	 
 If even one person reads this file and learns something, 
I've accomplished what I set out to do (how cliche, right?). But 
seriously, I'm going to attempt to provide several easy methods 
of beige boxing. Some experienced beigers will definitely see 
some familiar designs, but they might also see a new twist or 
two. I'll also include (hopefully) easy but complete directions 
of some of the possibilities for use.


 	 
 Back To Reality

 	 
 ---------------


 	 
 Ok, on with the file. There are about as many beige box 
designs as there are uses, and with both, new ideas are always 
popping up. The designs in this file are by no means the best 
designs. I HOPE that they're some of the easiest, but who am I to 
say.


 	 
 Method #1 (Generic, Phone Destroying, Design)

 	 
 ---------------------------------------------
.pm .5"
.lm .75"


 	
 Required Materials


 	
 1  Telephone that you wont miss (it'll be a permanent beige 

 	FF
 box)

 	
 2  Alligator clips

 	
 1  Telephone cord

 	
 1  Screwdriver

 	
 1  Pair of wire cutters

 	
 1  Soldering iron

 	
    Solder


 	
 Construction


 	
 1.  Open up the telephone with the screwdriver. I can't give 

 	FF
 exact directions, because different models vary, but if 

 	FF
 you can't find the screws, try checking under the plastic 

 	FF
 plate that holds the phone number of the location.


 	
 2.  Look at the modular jack (the thing the phone cord plugs 

 	FF
 into). Find the red and green wires. These are the ones 

 	FF
 you want. Trace these wires with your finger to the screw    7   3                     
 	FF
 that holds them down. Connect your phone cord to these 

 	FF
 screws, either by soldering them, or by wrapping them 

 	FF
 around the screw and tightening it down.


 	
 3.  Run the telephone cord out the modular jack's hole. If 

 	FF
 you can't squeeze it through the jack, take the wire 

 	FF
 cutters the cut the wires leading to  it, and yank it 

 	FF
 out. That should leave plenty of room.


 	
 4.  Re-assemble your phone.


 	
 5.  At the end of the telephone cord hanging out of the 

 	FF
 phone, connect the alligator clips to the same wires 

 	FF
 hooked up to the screws inside the housing of the phone.  

 	FF
 You can connect them either by soldering, or by splicing 

 	FF
 the wire to them (twisting them around the hole and 

 	FF
 praying that it holds).


 	
 Method #2 (A spin-off of #1, but less permanent)

 	
 ------------------------------------------------


 	
 Required Materials


 	
 1  Telephone (Don't worry, you wont wreck this one)

 	
 1  Telephone cord (You can use one of the springy ones that 

 	FF
 you always tangle up when you're on the phone)

 	
 2  Alligator clips

 	
 1  Pair of wire cutters

 	
 1  Soldering iron

 	
    Solder


 	
 Construction


 	
 1.  Cut the modular plug (the thing that plugs into the wall 

 	FF
 or telephone set) off ONE end of the telephone cord.


 	
 2.  Find the red and green wires and connect the alligator 

 	FF
 clips to these by soldering or splicing them.


 	
 3.  Connect the other end (the that still has a plug) to a 

 	FF
 telephone.



 	
 Method #3 (Similar to #2, but using a wall jack vice a cord)

 	
 ------------------------------------------------------------


 	
 Required Materials


 	
 1  Telephone (This wont get wrecked, either)

 	
 1  Modular telephone wall jack (This WILL get wrecked)

 	
 2  Alligator clips

 	
 1  Pair of wire cutters

 	
 1  Soldering iron

 	
    Solder
   7   3                     

 	
 Construction


 	
 1.  Look on the back of the wall jack. You should see the 

 	FF
 typical red and green wires going into the back of the 

 	FF
 jack. Leave the end going into the jack alone, but trace 

 	FF
 them to where the go into the plate holding the jack. Cut 

 	FF
 them here (being sure, as I said, to leave the jack end 

 	FF
 alone).


 	
 2.  Hook the alligator clips up to the red/green wires.


 	
 3.  Plug the phone into the wall jack.
.pm 0"
.lm .0"



 	 
 Testing Your Box

 	 
 ----------------


 	 
 Ok, now that you've got one of the boxes described above (or 
a different one), you're ready to go. Go outside, and on the side 
of your house, you should be able to find a small, approximately 
3" X 3", puke-green box, with a bolt in the middle of it. Take a 
wrench (I'm not sure what the size is, but a 10mm wrench works 
for me, and that's all I really care about. But be careful, since 
it's not exact, you might strip it) and take off the bolt. You'll 
probably have to clear out some cobwebs, since it hasn't been 
used in a while. Inside the box, you should see four screws (one 
on each corner) with the typical red/green wires connected to 
them.  (If you have two phone lines, the bottom screws will have 
black/yellow wires, if you have one phone line, the bottom won't 
have any). You can probably guess what happens from here--Hook 
the alligator clips up to the screws. You should get a dial tone. 
If you didn't, make sure the connection is clean, that you're 
hooked up to the right terminals (screws), etc. If you still 
don't get one, you're screwed. That means there's something wrong 
with your box. If you do get a dial tone, you're probably guess
ing what you can do from here.


 	 
 Where Can You Use The Beige Box

 	 
 -------------------------------


 	 
 You can use the beige box on several pieces of equipment. 
You can go to you're best friend's house and use it like I de
scribed. You can open up one of those ugly green boxes about 3' 
high in the back yard of every couple houses. Inside you'll see 
pretty much the same thing as at individual houses, only there's 
several houses running through the box, not just yours. I have 
heard that you can use a beige inside a Ma Bell manhole, but I 
crawled down one (not fun) and there was a huge plastic tube. You 
can see the telephone wires inside, but I have no idea how to get 
to them. There are definitely more uses, but these are the ones 
I've been exposed to.
.pa  4   3                     

 	 
 The Box Of Many Uses

 	 
 --------------------


 	 
 As I've mentioned, there are TONS of uses for beige boxes, 
and the ones I explain are merely the ones I've had some fun 
with. It's all basically the same, but there are some interesting 
twists.


 	 
 Conferences

 	 
 -----------


 	 
 Definitely one of the funniest. It's easier to do than ex
plain, but I'll give it a shot. First, call up a conference 
service (I'll list them in a second). From here, you'll pretty 
much get instructions (at least on the ones I've used). Basical
ly, you call up your buddies, tell them what's going on, and hit 
a key (usually *) and they get put into the conference. From 
there, you and all your friends can all talk to each other, trade 
codes, etc. Get the idea?  (You can even call foreign numbers. On 
our conference, we voiced a user from Italy and called a hotel in 
Madrid for someone to practice Spanish).

     Conference Services :

          0-700-456-1000     0-700-456-1001     0-700-456-1002
          0-700-456-1003     0-700-456-1004     0-700-456-2000
          0-700-456-2001     0-700-456-2002     0-700-456-2003
          0-700-456-2004



 	 
 Tapping

 	 
 -------


 	 
 If you hook up your beige box, and hear voices, the rightful 
owner of the line is obviously using it.  Well, that's about all 
there is to phone tapping.  Just shut up and listen.


 	 
 L/D Calling

 	 
 -----------


 	 
 Hey, it's not YOUR bill, so go ahead and call your pal in 
France.  Maybe voice verify some users on your BBS.


 	 
 Conclusion

 	 
 ----------


 	 
 That's about it. I won't pretend to be an expert on beige 
boxes, so I won't say that these are the limits, or that these 
are the best methods. I'm just trying to provide a non-technical 
introduction to phreaking. 

.pa  4   3                     
Introduction To Beige Boxing By Shooting Shark [1/13/85]
----------------------------
 

 	 
 Beige Boxes are amazingly simple to make. They are just test 
sets, which are used by telephone linemen for connecting to any 
phone line. And test sets are just ordinary telephones. They are 
called beige boxes because they are a combination of a brown box, 
a device for listening into phone lines, and a white box, which 
is a portable touch-tone generator, sold by Radio Shack and AT&T. 
(AT&T actually colors theirs white, which I find hilarious.) 
Beige Boxing is easy, fun, and offers dialing options often 
unavailable through LDC ports or extenders - you are physically 
using an unsuspecting person's phone line for making calls any
where - even to the 0-700 and 900 SACs (Special Area Codes) and 
976- numbers. The only reason I am writing this file is to make 
this enjoyable hobby aware to phreaks who want something differ
ent to try. 


 	 
 Building The Beige Box 

 	 
 ----------------------


 	 
 Take any phone (a touch-tone phone is preferred) and strip 
off the modular plug down to four wires. Connect heavy-duty 
alligator clamps to the red and green wires (these are the only 
wires you really need to make phone calls). 


 	 
 Using The Box 

 	 
 -------------


 	 
 Drive to a downtown location. Go behind a business, and look 
for any metal boxes on the wall that say General Electric, AT&T, 
the name of your BOC etc. Open the box. You may find wires of 
four colors leading to bolts. Just find any two places where a 
red and green wire terminate and connect the alligator clips of 
your Beige Box to these wires. If you don't get a dial tone, try 
another combination of whatever red and green wire endings you 
find (If the box has non-standard wire coloring, you are in for a 
bit more work). Once you have a hookup where you have a dial 
tone, you're ready to go. Note - if you get a connection where 
you hear talking, HANG UP and note the connection as a good one.  
That line is just being used now. If you are daring, speak into 
the mouthpiece, and tell them that you are a telephone repairman, 
and that they should not use the phone for an hour. This gives 
you time to call Dial-A-Muppet, set up your conference, etc!    


 	 
 Another good source of phone wiring is an apartment complex 
- all the connections for the various apartments will be in one 
box, giving you many choices! This can be a little more danger
ous. If it is in a quiet area, you may find yourself being stared 
at from a second-story window by an old woman in curlers who 
simply wondered why there was a conversation going on by her 
trash can. One possible remedy to this is to get a hat that has 
the emblem of your local BOC - If anybody asks you what you're 
doing, cheerfully say "Telephone maintenance!". A fellow phreak 
named David Letterman successfully ran a tap from the box of his    7   3                     own apartment building through his window and to his telephone. 
He knew the family who's phone bill he was adding to, and swore 
that he knew nothing about it when their bill with $50 worth of 
"unplaced calls" came. Pacific Bell reimbursed them, and he 
removed the tap soon after. If you want to do this, you may even 
consider connecting the guts of a cordless phone to the phone box 
and keeping the handset in your home. That way, if someone goes 
nosing around the tampered-with phone box, the source of the tap 
will be untraceable. 


 	 
 One good thing to do is to call your local ANI # and the 
number of the line you are borrowing will be read off to you. If 
the robot voice seems to have trouble reciting the number, you 
have a spare line, and you're only ripping off the phone company!  
If not, you can then call that # from another location to find 
out who it is, or perhaps to tell them that you are the phone 
company and that they should not use their phone for a few hours.  
In fact, if you are talking with someone on a line and the owner 
of the line picks up his/her phone to make a call, tell them that 
you are the telco, etc. etc, we're doing some testing, please 
don't use your phone, etc. Works all the time!


BLACK BOX PLANS by Uncle Joe
---------------
.pm .25"
.lm .5"


 	
 Parts:

 	
 -----


 	
 SPST toggle switch

 	
 10K Ohm 1/2 Watt 10% resistor


 	
 Procedure:

 	
 ---------


 	
 Cut two 6 inch lengths of wire


 	
 Attach these to the switch terminals


 	
 Open phone


 	
 Locate F and RR terminals in the phone


 	
 Wrap the resistor between these 2 terminals making sure it 

 	
 only touches 2 terminals


 	
 Connect 1 wire from the switch to the RR terminal


 	
 Disconnect the green wire from its terminal


 	
 Attach this green wire to the remaining switch wire


 	
 Bring the switch out of the phone and close it up
.pa  6   3                     

 	
 Switch to a position where you get a normal dial tone and mark 

 	
 this NORMAL. Mark the other position FREE.


 	
 Instructions for use:

 	
 --------------------


 	
 When the phone rings, lift and drop the receiver as quickly as 

 	
 possible


 	
 Make absolutely sure the phone has stopped ringing


 	
 Flip the switch to FREE


 	
 Pick up the phone and talk normally


 	
 Schematic:


 	
 
 	 
 blue wire ---|

 	
 
 	 
              |--- F

 	
 
 	 
 white wire --|    |

 	
 
 	 
                resistor

 	
 
 	 
                   |

 	
 
 	 
                  R R --- switch ---

 	
 
 	 
                                   |

 	
 
 	 
 green wire ------------------------
.lm 0"
.pm 0"


How to build a BLACK BOX From Sherwood Forest
------------------------

  To all who dare --


 	 
 What is a BLACK BOX? A BLACK BOX is a device that is hooked 
up to your phone that fixes your phone so that when you get a 
call, the caller doesn't get charged for the call. This is good 
for calls up to 1/2 hour, after 1/2  hour the Phone Co. gets 
suspicious, and then you can guess what happens.


 	 
 The way it works:

 	 
 ----------------


 	 
 What this little beauty does is keep the line voltage from 
dropping to 10v when you answer your phone. The line is instead 
kept at 36v and it will make the phone think that it is still 
ringing while your talking. The reason for the 1/2 hour time 
limit is that the Phone CO. thinks that something is wrong after 
1/2 an hour of ringing.


 	 
 All parts are available Radio Shack. Using the least possi
ble parts and arrangement, the cost is $0.98! And that is parts 
for two of them! Talk about a deal! If you want to splurge then 
you can get a small PC board, and a switch. There are two sche
matics for this box, one is for most normal phones. The second 
one is for phones that don't work with the first. It was made for 
use with a Bell Trimline touch tone phone.   7   3                     
.pm 1"


 	

   **  Schematic 1 for most phones  **

 	

   **         LED ON: BOX ON        **


 	

 FROM >--------------------GREEN->  TO

 	

 LINE >--|   1.8k  LED  |---RED--> PHONE

 	

         |--/</</<--|>--|

 	

         |              |

 	

         ------>/<-------

 	

               SPST


 	

 Parts:  1 1.8k 1/2 watt resistor

 	

         1 1.5v LED

 	

         1 SPST switch
.pm 0"


 	 
 You  may just have two wires which  you connect together for 
the switch.
.pm 1"


 	

   **  Schematic 2 for all phones  **

 	

   **        LED ON: BOX OFF       **


 	

 FROM >---------------GREEN->  TO

 	

 LINE >-------      ---RED--> PHONE

 	

             |  LED |

 	

          -->/<--|>--

 	

          |         |

 	

          ---/</</---

 	

              1.8k


 	

 Parts:  1 1.8k 1/2 watt resistor

 	

         1 1.5v LED

 	

         1 DPST switch
.pm 0"


 	 
 Here is the PC board layout that I recommend using. It is 
neat and is very easy to hook up.
.pm 1"


 	

    Schematic #1        Schematic #2


 	

   **************     ****************

 	

   *            *     *  -------     *

 	

   * --<LED>--- *     *  |     |     *

 	

   * |        | *     *  | <SWITCH>  *

 	

   * RESISTOR | *     *  | |      |  *

 	

   *        | | *     *  | |      /R *

 	

   * -------- | *     *  | |      \E *

 	

   * |        | *     *  | <LED>| /S *

 	

   * --SWITCH-- *     *  |      | \I *

 	

   *  |      |  *     *  |      | /S *

 	

 L *  |      |  * F L *  |      | |  * F

 	

 I>RED-      -RED>O I>RED-      ---RED>O

 	

 N>-----GREEN---->N N>-----GREEN------>N

 	

 E *            * E E *              * E

 	

   **************     ****************
.pm 0"
.pa  6   3                     

 	 
 Once you have hooked up all the parts, you must figure out 
what set of wires go to the line and which go to the phone. This 
is because of the fact that LED's must be put in, in a certain 
direction. Depending on which way you put the LED is what con
trols what wires are for the line & phone.


 	 
 How to find out:

 	 
 ---------------


 	 
 Hook up the box in one direction using one set of wires for 
line and the other for phone.


 	 
 *NOTE*  For Model I switch should be OFF.

 	 
 *NOTE*  For Model 2 switch should be set to side connecting 
the LED.


 	 
 Once you have hooked it up, then pick up the phone and see 
if the LED is on. If it is, the LED will be lit. If is doesn't 
light then switch the wires and try again. Once you know which 
are which then label them.


 	 
 *NOTE*  - If neither directions worked then your switch was 
in the wrong position. Now label the switch in its current posi
tion as BOX ON.


 	 
 How to use it:

 	 
 -------------


 	 
 When the box is *ON* then you may only receive calls. Your 
phone will ring like normal and the LED on the box will flash. If 
you answer the phone now, then the LED will light and the caller 
will not be charged


 	 
 Hang up the phone after you are done talking like normal. 
You will not be able to get a dial-tone or call when the box is 
on, so turn the box *OFF* for normal calls. I don't recommend 
that you leave it on all the time, as you don't want it to answer 
when Ma Bell calls!


Building Your Own Blue Box By Jester Sluggo [11/27/86]
--------------------------


 	 
 This Blue Box is based on the Exar 2207 Voltage Controlled 
Oscillator. There are other ways to build Blue Boxes, some being 
better and some not as good, but I chose to do it this way. My 
reason for doing so: because at the time I started this project, 
about the only schematic available on BBS's was the one written 
by Mr. America and Nickie Halflinger. Those plans soon (in about 
90 seconds) became very vague in their context with a couple in-
consistencies, but I decided to "rough it out" using those plans 
(based on the Exar 2207 VCO) and build the Blue Box using that as 
my guide. During the construction of the Blue Box, I decided to 
type-up a "more complete and clear" set of Blue Box schematics 
than the file that I based mine on, in order to help others who    7   3                     may be trying/thinking of building a Blue Box. I hope these help.


 	 
 Note:  You should get a copy of the Mr. America/Nickie 
Halflinger Blue Box plans. Those plans may be of help to anyone 
who may have difficulty understanding these plans. Also, these 
plans currently do not support CCITT.


 	 
 Why should I build a Blue Box?

 	 
 ------------------------------


 	 
 Many of you may have that question, and here's my answer. 
Blue Boxing was the origin of phreaking (excluding whistling). 
Without the advent of Blue Boxes, I feel that some of the ad
vances in the telecommunications industry would've taken longer 
to develop (The need to stop the phone phreaks forced AT+T Bell 
Laboratories to "step up" their development to stop those 
thieves!).


 	 
 There is no harm in building a Blue Box (except the knowl
edge you will gain in the field of electronics). Although there 
are software programs (Soft Blue Boxes) available for many mi
cro's that will produce the Blue Box Multi-Frequency (MF) tones, 
they are not as portable as an actual Blue Box (you can't carry 
your computer to a telephone, so you must use it from home which 
could possibly lead to danger).


 	 
 Many phreaks are announcing the end of the Blue Box Era, but 
due to discoveries I have made (even on ESS 1A and possibly ESS 
5), I do not believe this to be true. Although many people con
sider Blue Boxing "a pain in the ass", I consider Blue Boxing to 
be "phreaking in its' purest form". There is much to learn on the 
current phone network that has not been written about, and Blue 
Boxes are necessary for some of these discoveries. The gift of 
free phone calls tends to be a bonus.


 	 
 Note: Blue Boxes also make great Christmas gifts!


 	 
 Items needed to construct a Blue Box.

 	 
 -------------------------------------


 	 
 Here is the list of items you will need and where you can 
get them. It may be a good idea to gather some of the key parts 
(the chips, and especially the potentiometers, they took about 6 
months to back order through Digi-key. Also, basic electronics 
tools will be necessary, and you might want to test the circuit 
on a bread board, then wire-wrap the final project. Also, you 
will need a box of some sort to put it in (like the blue plastic 
kind at Radio Shack that cost around $5.00).

     Note: An oscilloscope should be used when tuning in the
           potentiometers because the Bell system allows
           only a 7-10% tolerance in the precision of the
           frequencies.
.pa  6   3                     
Qty.  Item                 Part No.    Place
-------------------------------------------------
 1  | 4 x 4 Keypad       |           | Digi-Key
 6  | Inverter Chip      | 74C04     |
 32 | Potentiometer      |           |
 1  | 4-16 Converter Chip| 74LS154   |
 1  | 16 Key Decoder     | 74C922    |
 2  | 2207 VCO           | XR2207CP  | Exar Corp.
 3  | .01 uf Capacitor   | 272-1051  | Radio Shack
 5  | .1 uf Capacitor    | 272-135   | Radio Shack
 2  | 1.5K Ohm Resistor  |           | Radio Shack
 2  | 1.0K Ohm Resistor  |           | Radio Shack
 1  | Speaker            |           | From an old Autovon phone
 1  | 9 Volt Battery     |           | Anywhere
.lm .5"
.pm .25"


 	
 The resistors should be a +/- 5% tolerance.


 	
 The speaker can be from a regular telephone (mine just hap

 	
 pened to be from an old Autovon phone). But make sure that 

 	
 you remove the diode.


 	
 The Potentiometers should have a 100K Ohm range (but you may 

 	
 want to make the calculations yourself to double check).


 	
 The 9-volt battery can be obtained for free if you use your 

 	
 Radio Shack Free Battery Club card.


 	
 The Exar 2207 VCO can be found if you call the Exar Corp. 

 	
 located in Sunnyvale, CA. Call them, and tell them the state 

 	
 you live in, and they'll give the name and phone number to 

 	
 the distributor that is located closest to you. The 2207 

 	
 will vary from about $3.00 for the silicon-grade (which is 

 	
 the one you'll want to use) to about $12.00 for the high-

 	
 grade Military chip.


 	
 Note:  When you call Exar, you may want to ask them to send 

 	
 you the spec-sheets that gives greater detail as to the 

 	
 operation and construction of the chip.
.pm 0"
.lm 0"
.pa  '   3                     

 	 
 Schematic Diagram

 	 
 -----------------

           +--------------+            +-------------+
           |  1  2  3  A  |            |  Figure #1  |
           |  4  5  6  B  |            +-------------+
           |  7  8  9  C  |            | Logic Side  |
           |  *  0  #  D  |            +-------------+
           ++-+-+-+-+-+-+-+
            1 | 3 | 5 | 7 |           (VCC)
            | 2 | 4 | 6 | 8           (+5 Volts)    +----+
            | | | < u | | |             [+]         |   _|_
            | | | | | | | |              |          |   \_/GND
         +--+-+-+-+-+-+-+-+----+      +--+----------+---+
         |  2 | 11| 10| 7 |    |      |  14         7   |
 (.01C)  |  | 3 | 4 | 8 | 1  12+------+1                |
 +--||---+5                  13+------+2   (*74C04*)    |
_|_      |                     |      |                 |
\_/GND   |     (*74C922*)      |      +-----------------+
   +--||-+6                    |
   |(.1C)|                     |
  _|_    |                    |
  \_/GND |   9  17 16 15 14  18|
         +--+--+--+--+--+---+--+                          +---+
            |  |  |  |  |   |                             |   |
           _|_ A  B  C  D   |                            _|_  |
        GND\_/ |  |  |  |  [+] (VCC)      [+] (VCC)      \_/  |
               |  |  |  |      (+5 volts)  |  (+5 volts) GND  |
               |  |  |  |                  |                  |
        -------+--+--+--+------------------+----------------- |
        |      23 22 21 20                 24             18+-+
  +-----+12                                                 | |
  |     |                 (*74LS154*)                     19+-+
 _|_    |                                                   |  
 \_/GND |  1  2  3  4  5  6  7  8  9 10 11 13 14 15 16 17   |  
        +--+--+--+--+--+--+--+--+--+-+--+--+--+--+--+--+----+
           1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16
           |  |  |  |  |  |  |  |  | |  |  |  |  |  |  |
                                                       |
                       +-------------------------------+
                       |       +--+       +------->
                       |       |  |       |(Connects to Fig. 2)
                    +--+-------+--+-------+---+
                    |  3--|>o--4  5--|>o--6   |
                    |   (Invtr.)   (Invtr.)   |
    +---------------+7                        |
   _|_              |        (*74C04*)        |
GND\_/   (VCC) [+]--+14                       |
       (+5 volts)   |                         |
                    +-------------------------+


.pa  5   3                     
    +-------------+                                _
    |  Figure #2  |                               / |
+---+-------------+----+        +----------------+  |
| Tone Generation Side |       _|_               |  | SPKR
+----------------------+    GND\_/    +---+--+---+  |
                                      |   |       \_|
                                      |   |
                                      |   |  +---------------+
         +-------+                    |   |  |               |
         |      _|_                   |   +--+14             |
         |      \_/GND                |      |  (Repeat of)  |
         |                            |      |    (First)    |
       ----- (.1C)                    |      |   (Circuit)   |
       -----                          |      |               |
         |                            |      | (*XR2207CP*)  |
         |       +-----------------+  |   +--+6              |
         |       |                 |  |   |  |               |
 [+]-----+-------+1              14+--+   |  +---------------+
(VCC)            |                 |      +--------------------+
(+9 Volts)  +----+2                |                           |
            |    |               12+---------------------+     |
   (.01C) -----  |                 |                    _|_    |
          -----  |  (*XR2207CP*)   |                    \_/GND |
            |    |                 |       1.5K Ohms           |
            +----+3              11+---+---\/\Rx/\/---+--+     |
                 |                 |   |              | _|_    |
                 |                 |   +---\/\Rx/\/---+ \_/GND |
                 |                 |       1.0K Ohms           |
                 |               10+----+                      |
   +-------------+6               9+----+---+                  |
   |             |                8+----+   |                  |
   |             |                 |      ----- (.1C)          |
   |             +-----------------+      -----                |
   +---------+                             _|_      +----------+
   |         | Pot.                     GND\_/ Pot. |          |
   |        \/\/\/\/--+-----------------------\/\/\/\/         |
   |         1400 Hz. |                        1600 Hz.        |
   +---------+        |                             +----------+
   |         | Pot.   |                        Pot. |          |
   |        \/\/\/\/--+----------------+------\/\/\/\/         |
   |         1500 Hz. |                |       900 Hz.         |
   |                  |                |                       |
   |     14 more      |                |       14 More         |
   |   Potentiometers |                |     Potentiometers    |
   |     in this      |                |       in this         |
   |   area left out  |                |     area left out     |
   |   for simplicity |                |     for simplicity    |
   |                  |                |                       |
   |                  |                |                       |
                      |
          (Connects)  |
        <-------------+
          (Figure 1)

.pa   7   3                     

 	 
 Multiplex Keypad System

 	 
 -----------------------


 	 
 First, the multiplex pattern used in the 4x4 keypad layout. 
I suggest that keys 0-9 be used as the Blue Box's 0-9 keys, and 
then you can assign A-D, *, # keys to your comfort (i.e., * = Kp, 
# = St, D = 2600, and A-C as Kp1, Kp2 or however you want).

     Note: On your 2600 Hz. key (The D key in example above)
           it may be a good idea to tune in a second
           potentiometer to 3700 Hz. (Pink Noise).

    Keypad      Key Assignments   Multiplex Pattern
  +---------+   +-------------+    +------------+
  | 1 2 3 A |   | 1  2  3  4  |    | 1  2  3  A |----Y1=8   X1=3
  | 4 5 6 B |   | 5  6  7  8  |    | 4  5  6  B |----Y2=1   X2=5
  | 7 8 9 C |   | 9  10 11 12 |    | 7  8  9  C |----Y3=2   X3=6
  | * 0 # D |   | 13 14 15 16 |    | *  0  #  D |----Y4=4   X4=7
  +---------+   +-------------+    +------------+
                                     |  |  |  |
                                     X1 X2 X3 X4


 	 
 Schematic Help

 	 
 --------------


 	 
 This is the Key to the diagrams in the schematic. I hope 
that they help more then they might hurt.

    _|_
    \_/GND   is the Ground symbol

     | |
  ---| |--   is the Capacitor symbol
     | |     (.1C)  stands for a .1 uf Capacitor
             (.01C) stands for a .01 uf Capacitor
     |
   -----
   -----     is another Capacitor symbol
     |

--\/\Rx/\/-- is the Resistor symbol (The 1.5K Ohm and 1.0K Ohm
                                     Resistors are at +/- 5% )
---+
   |
  \/\/\/\/-- is the Potentiometer symbol (The frequencies I 
               supplied above are just examples.)

 --|>o--     is the Inverter symbol

.pa  2   3                     

 	 
 Blue Box Frequencies

 	 
 --------------------


 	 
 This section is taken directly from Mark Tabas's "Better 
Homes and Blue Boxing" file Part 1.

Frequencies (Hz)  Domestic  Int'l
----------------------------------
 700+900            1        1
 700+1100           2        2
 900+1100           3        3
 700+1300           4        4
 900+1300           5        5
1100+1300           6        6
 700+1500           7        7
 900+1500           8        8
1100+1500           9        9
1300+1500           0        0

 700+1700          ST3p     Code 11
 900+1700          STp      Code 12
1100+1700          KP       KP1
1300+1700          ST2p     KP2
1500+1700          ST       ST
2600+3700      *Trunking Frequency*


 	 
 Note: For any further information about the uses or duration 
of the frequencies, read the Mark Tabas files.



 	 
 Now that you have built your blue box here's the correct way 
to use it. Call any long distance information # through 1 or more 
extenders. Enter a 2600 Hz tone just before information answers. 
This will disconnect them and will place you in outward operator 
mode. Enter a KP tone or KP2 if you're placing an international 
call. This enables the dialing sequence. Enter the # you're 
dialing using Multi Freq. tones. Use the format XXX-XXX-XXXX.


 	 
 Enter an ST tone. This stops the dialing sequence and places 
the call.


 	 
 Before you do any of this it is important to realize that 
AT&T doesn't look favorably upon people who use blue boxes. It's 
a federal crime to use one and it is very easy to get caught if 
you're not careful. Only you can decide whether or not you're 
willing to risk putting yourself into very deep trouble.


 	 
 As to use, the first thing you need to understand is that 
there are two(2) types of toll completing trunks: INWARD and 
OUTWARD. The names are reference to the office that is switching 
the call (the toll center that serves the watts line you called) 
and each type of trunk has a different class of service. From an 
INWARD toll completing trunk, you  can reach the different serv
ice operators, the toll test board, and the inward operator. Some 
offices also allow remote testing and it is in these offices that    7   3                     you can access the outward toll completing trunks. The outward 
trunks allow you to make verification (emergency) calls, do serv
ice monitoring(tapping), stack trunks(busy out all trunks between 
LA and NYC), enable and disable TSPS positions, and in some 
cases(on some 4A's) issue temporary rerouting instructions(send 
all calls from LA to NYC via Miami, Boston, or any other class 5 
office or offices). Both type of trunks allow you to place a 
'standard' call with a box.


 	 
 In some offices, mostly the small ones with a toll test 
board that is unattended at night and on weekends, you can get an 
outward toll completing trunk as well as performing other test 
and routing functions. You do this by using three digit codes 
that are invalid exchanges(not of the pattern nnx;see note 1=). 
During the Sixties, the codes used were fairly standard and 
consistent; however, when the boxes became popular and the 
phreaks started doing things like routing all calls from Dallas 
to Ft. Worth via Washington D.C., Mother started changing the 
test codes on a random(as far as I know ) basis. What I would 
suggest is that everybody interested in doing this sort of thing 
pick out a nice quiet little office somewhere and work on discov
ering the codes acceptable to that office.


 	 
 Each numbering plan area (NPA, also known as area code) has 
an office designated as its master office. This office controls 
all of the other toll offices in the area as well as serving as a 
concentration point for most out of area calls. To access the 
services of a non-master office you need it's 'city  code', this 
is a three(3) digit code that is of the form 0xx, and is sent 
after the area code;see note 2 =. As an example, the 'city code' 
for Canton, Ohio is 042; thus to reach the inward operator in 
Canton, you would send 'KP-216 -042-121-ST' where as if you 
wanted the inward operator in Cleveland, you would send 'KP-216-
121- ST'. The reason this is necessary is that the operator in 
Cleveland can't verify a number in Canton, so if you want to 
verify someone in Canton you need the city code. Also, most area 
master offices have  dedicated data trunks to the network control 
center and thus don't accept test and rerouting commands over the 
switched network.


 	 
 Note 1:  the normal format for telephone numbers is as 
follows: nyn/nnx-xxxx.  where n=any digit except 1 and 0; y=0 or 
1, and x= any digit. Yes, I know that in some area codes the nnx 
format has changed to nxx. This is a new occurrence and only 
occur where there has been an outrageous population increase in 
the last few years and all of the funny exchanges are connected 
directly to master offices and thus don't conflict with the 'city 
code' format.
.pa  1   3                     

 	 
 Now, if you're wondering about what to call from an operator 
trunk, here are some goodies to help you out:

0-700-456-1000 Teleconference Line (free, because you
               are the operator!)
xxx+101    - toll  switching
xxx+121    - local operator
xxx+131    - information
xxx+141    - rate & route
xxx+181    - coin refund operator
xxx+11501  - mobile operator
xxx+11521  - mobile operator
xxx+11511  - conference operator (800-544-6363)


 	 
 Here are some examples of what you may find if you dialed KP 
+ 213 + PXX + ST:

 PXX      Effect
---------------------------
 101      LA 2 Toll switching
 117      Disconnect
 121      213 Inward Op.
 131      Local Information
 162      DA (555-1212)
 163      Information
 167      818 DA
 181      Dial Assistance
182-188   Satellite Senders
          (kp+Country+city+#+St)
 025      Spanish Translator!


 	 
 Conclusion

 	 
 ----------


 	 
 This is just one way to build a Blue Box. If you choose this 
way, then I hope this file is adequate enough to aid you in the 
construction. Although these are not the best plans, they do 
work. This file does not tell you how to use it or what to do 
once it's built. For that information I suggest that you read the 
Mark Tabas's "Better Homes and Blue Boxing" files.


Brown Box Plans
---------------


 	 
 Introduction

 	 
 ------------


 	 
 This is a fairly simple modification that can be made to any 
phone. All it does is allow you to take any 2 lines in your house 
and create a party line. So far I have not heard of Any problems 
with it from my friends that have set one up and I have not had 
any either. There is one thing that you will notice when you are 
one of the two people who is called by a person with this box. 
The other person0will sound a little bit faint. I could overcome    7   3                     this with some amplifiers but then there wouldn't be very many of 
these boxes made.


 	 
 I think that the convenience of having two people on line at 
any one time will make up for the minor volume loss.


 	 
 Phone Modification Instructions

 	 
 -------------------------------


 	 
 Here is the diagram:

       *    =    -    +    KEY:                     
       *    =    -    +    ___________________________
       *    =    -    +    | PART           | SYMBOL |
       *    =    -    +    ---------------------------
       *    =    -    +    |BLACK WIRE      |   *    |
       *    ==_/_-    +    |YELLOW WIRE     |   =    |
       *******_/_++++++    |RED WIRE        |   +    |
       |              |    |GREEN WIRE      |   -    |
       |              |    |SPDT SWITCH     |  _/_   |
       |              |    |                |  _/_   |
       |_____PHONE____|    |VERTICAL WIRE   |   |    |
                           |HORIZONTAL WIRE |   _    |
                           ---------------------------


 	 
 In some houses the black and yellow are already wired, in 
others you will have to go out to your box and rewire it. A good 
way to figure out which line is which is to take the phone you 
are looking for off the hook. Then you only need to take the red 
and green wires entering your phone and hook them to the differ
ent pairs of red and green going into the house. You can't hurt 
anything in the phone or telephone by probing. When you find the 
pair that you want take the black from your line and attach it to 
the red of the other line then take the yellow and attach it to 
the green line. Now you are all set to go. For people with rotary 
phones you can have one person call you then place the second 
call out to the other person. Though not a phreakers tool, the 
brown box can be phun.


MAKING YOUR PHONE INTO A CHEESEBOX By SIR KNIGHT
----------------------------------


 	 
 A Cheesebox (named for the type of box the first one was 
found in) is a type of box which will, in effect, make your 
telephone a pay-phone. This is a simple, modernized, and easy way 
of doing it.


 	 
 Inside info: these were first used by bookies many years ago 
as a way of making calls to people without being called by the 
cops or having their numbers traced and/or tapped.
.pa  4   3                     


 	 
 How to Make a Modern Cheese Box

 	 
 -------------------------------


 	 
 Ingredients:

 	 
 ------------


 	 
 1 Call Forwarding Service on the line

 	 
 1 Set of Red Box Tones

 	 
   The number to your prefix's Intercept Operator (do some 
         scanning for this)


 	 
 How to Use:

 	 
 ----------


 	 
 After you find the number to the Intercept Operator in your 
prefix, use your call-forwarding and forward all calls to her. 
This will make your phone stay off the hook (actually, now it 
waits for a quarter to be dropped in). You now have a Cheese Box. 
In order to call out on this line: you must use your red box 
tones and generate the quarter dropping in, then you can make 
phone calls to people. As far as I know, this is fairly safe, and 
they do not check much, although I am not sure, I think you can 
even make credit-card calls from a Cheese Box phone and not get 
traced.


The Clear Box By The Bit of The Postmen.(c) 1984 by 2600 Magazine
-------------


 	 
 The clear box is a new device which has just been invented 
that can be used throughout Canada and rural United States. The 
clear box works on "PostPay" payphones (fortress phones). Those 
are the payphones that don't require payment until after the 
connection is established. You pick up the phone, get a dial 
tone, dial your number, and then insert your money after the 
person answers. If you don't deposit the money, then you can not 
speak to the person on the other end, because your mouth piece is 
cut off, but not the ear piece (obviously these phones are nice 
for free calls to weather or time or other such recordings). 


 	 
 All you must do is to go to your nearby Radio Shack, or 
electronics store, and get a four-transistor amplifier and a 
telephone suction cup induction pick-up. The induction pick-up 
would be hooked up as it normally would to record a conversation, 
except that it would be plugged into the output of the amplifier 
and a microphone would be hooked to the input. So when the party 
that is being called answers, the caller could speak through the 
little microphone instead. His voice then goes through the ampli
fier and out the induction coil, and into the back of the receiv
er where it would then be broadcast through the phone lines and 
the other party would be able to hear the caller. 


 	 
 The Clear Box thus 'clears up' the problem of not being 
heard. Luckily, the line will not be cut-off after a certain    7   3                     amount of time because it will wait forever for the coins to be 
put in. The biggest advantage for all of us about this new clear 
box is the fact that this type of payphone will most likely 
become very common. Due to a few things: 


 	 
 1st, it is a cheap way of getting the DTF, dial-tone-first 
service, 


 	 
 2nd, it doesn't require any special equipment (for the phone 
company). This payphone will work on any phone line. Usually a 
payphone line is different, but this is a regular phone line and 
it is set up so the phone does all the charging, not the company.


GOLD BOX PLANS By DR. REVENGE  
--------------


 	 
 What It Does:

 	 
 -------------


 	 
 When you put a Gold Box on two phone lines, it lets anyone 
who calls one of the lines call out on the other. So when MCI or 
Sprint traces the line it will tell them that you're calling from 
the line you hooked the Gold Box up to.



 	 
 This is great for hooking up to pay phones. Just think, 
phreaking without the heart attacks when you hear a click and the 
phun you can have with a Red Box and AT&T calling cards. Just 
don't use a Blue Box, call the President and say you want to kill  
him, government computers, or anything that they trace by detect
ing a tone in the line. But you can still call the operator and 
ask for her bra size or if she knows what a trunk tone is! 


 	 
 How to build it:

 	 
 ----------------


 	 
 You will need the following:


 	 
 two   10k ohm resistors 

 	 
 three 1.4k ohm resistors 

 	 
 two   2N3904 transistors 

 	 
 two   photo-cells,

 	 
 two   red LED's (the more light produced the better), 

 	 
       a box that won't let light in 

 	 
       red and green wire.


 	 
 Light from the #1 LED must shine directly on the photocell 
#1. The Gold Box I made needed the top of the LED's to touch the 
photocell for it to work. The same applies to the #2 photocell & 
LED.
.pa  4   3                     
            #1
       :-Photocell--:
       :            :
       :            :Base
       :          -----
       :          Transistor
       :   #1     -----
       :  +LED-    : :
       :  -I(--    : :Collector
   RED1--<     >:--: :-------:-----GREEN2
          -I(-- :            ----------:
           #2   :                      :
          LED   :-/\/\/-/\/\/-/\/\/-/\/\/
                  10K    10K   1.4K 1.4K
                    Resistors

           #2
       -Photocell-----------------
       :                         :
       :Base                     :
     -----                       :
     Transistor                  :
     ------                      :
      : :Emitter                 :
GREEN1- --------------------------RED2
     :   :
     /\/\/
      1.4K Resistor


 	 
 The 1.4k resistor is variable and if the second part of the 
Gold Box is skipped, it will still work, but when someone picks 
the phone up they hear a faint dial tone in the background and 
might report it to the Gestapo, er, AT&T. 1.4k will give you  
good reception with little risk of a Gestapo agent at your door.


 	 
 Now that you have built it, take 2 green wires of the same 
length. Strip the ends, twist 2 ends together and connect them to 
Green1 and place a piece of tape on it with line #1 writing on  
it. Continue the process with red1, only use red wire. Repeat 
with Red2 and Green2, but change to line #2.


 	 
 How to Install:

 	 
 ---------------


 	 
 You will need to find two phone lines that are close togeth
er. Label one of the phones lines line #1. Cut the phone lines 
and take the outer coating off it. There should be 4 wires. Cut 
the yellow and black wires off & strip the red and green wires 
for both lines.


 	 
 Line #1 should be in two pieces. Take the green wire off one 
end and connect it to one of the green wires on the Gold Box. 
Take the other half of line #1 and hook the free green wire to 
the green wire on the phone line. Repeat the process with Red1 & 
the other line.   7   3                     


 	 
 All you need to do now is to write down the phone numbers of 
the place you hooked it up at and go home & call it. You should 
get a dial tone! If not, try changing the emitter with  collec
tor. 


THE GREEN BOX By BIOC Agent 006
-------------
               

 	 
 Paying the initial rate in order to use a red box (on cer
tain fortresses) left a sour taste in many red boxer's mouths 
thus the GREEN BOX was invented. The green box generates useful 
tones such as COIN COLLECT, COIN RETURN, and RINGBACK. These are 
the tones that ACTS or the TSPS operator would send to the CO 
when appropriate. Unfortunately, the green box cannot be used at 
a fortress station but it must be used by the CALLED party. Here 
are the tones:

     COIN COLLECT	700 + 1100 Hz
     COIN RETURN       1100 + 1700 Hz
     RINGBACK		700 + 1700 Hz


 	 
 Before the called party sends any of these tones, an opera
tor released signal should be sent to alert the MF detectors at 
the CO. This can be accomplished by sending 900 + 1500 Hz or a 
single 2600 Hz wink (90 ms) followed by a 60 ms gap and then the 
appropriate signal for at least 900 ms.  Also, do not forget that 
the initial rate is collected shortly before the 3 minute period 
is up.


 	 
 Incidentally, once the above MF tones for collecting and 
returning coins reach the CO, they are converted into an appro
priate DC pulse (-130 volts for return & +130 volts for collect). 
This pulse is then sent down the tip to the fortress. This causes 
the coin relay to either return or collect the coins.


 	 
 The alleged "T-Network" takes advantage of this information. 
When a pulse for COIN COLLECT (+130 VDC) is sent down the line, 
it must be grounded somewhere. This is usually either the yellow 
or black wire. Thus, if the wires are exposed, these wires can be 
cut to prevent the pulse from being grounded. When the three 
minute initial period is almost up, make sure that the black & 
yellow wires are severed; then hang up, wait about 15 seconds in 
case of a second pulse, reconnect the wires, pick up the phone, 
hang up again, and if all goes well it should be "JACKPOT" time.


How to Build Your Own Mauve Box by Captain Generic With Help from 
-------------------------------    The Genetic Mishap. [11/24/86]


 	 
 Please bear with me, as the construction of this box will 
seem rather silly. This box was found in a construction site. Or 
rather, it found us at a construction site. We were using a $5 
Radio Shack phone out of a semi-completed office building. One    7   3                     afternoon during a holiday, and immediately following a storm, we 
found our bus in shambles. To our surprise, we also found that 
one of the phone connections we were tapping had been draped 
through a murky puddle. The fact that surprised us even more was 
that this line still worked and now possessed some great capabil
ities.


 	 
 Materials:

 	 
 ----------


 	 
 2 Tupperware or similar 8oz containers

 	 
 1 small bag earth (dirt) (12oz)

 	 
 1 pint water

 	 
 2 lantern batteries

 	 
 1 nine volt battery

 	 
 1 battery clip

 	 
 2 SPST switches

 	 
 4 ounces of iron shavings

 	 
 2 polar magnets

 	 
 5 feet wire

 	 
 1 set soldering equipment


 	 
 This is the part you won't believe. Take the Tupperware 
containers, and fill them with a mixture of the earth and the 
iron shavings. Make sure that the mixture is well done. 


 	 
 (*NOTE* for best results, use the sand in fine ash trays.)  


 	 
 Cut the red and green wires and splice the switches into 
them. From the switches, solder wire to the magnets. Connect the 
red to the + (positive) side of one magnet, and the green to the 
- (negative) side of the second magnet. From the other poles of 
the magnet, solder wires the battery & clip. Make sure the + 
(positive) and - (negative) are correct. Set the nine-volt bat
tery between the two Tupperware containers and place the battery 
end of the two magnets into the Tupperware. Now connect wire to 
the two poles of the lantern battery, and place them in the same 
containers as the poles of the magnets/9-volt battery. You are 
almost done. Finally, add just enough water to the two pots, and 
let them sit in the sun and bake like bricks. At this point, you 
have a MAUVE BOX.


 	 
 Explaining and Using What You Have:

 	 
 -----------------------------------


 	 
 The red and green wires have been placed into a magnetic 
field which is being charged continually by a lantern battery.  
(It is necessary to change this battery every one to one and a 
half months.) This will literally pull in the nearest phone 
conversation. (Don't try this in a big apartment or dorm.) When 
the 9-volt battery is connected, this will now create enough 
current for the poles of the magnets to reverse themselves 
(perhaps you're seen Mr. Wizard do this. It's just like with the 
soap). At this point, you have a phone transmitting to one (if 
not more) of the nearest phones. (Again, if you're in a dorm,    7   3                     don't try this.) I suppose this just accomplishes what a tap 
would do, but with a MAUVE BOX, your fingerprints never will show 
on a terminal or on someones telephone lines.


 	 
 Notes and Addendum:

 	 
 -------------------


 	 
 This will only work with a touch-tone phone connected to a 
phone line. When the switches are pulled, it's off your line and 
into the air. This is named a MAUVE BOX, because this is the most 
disgusting box, and I find mauve to be the single most disgusting 
color I know of. Also, this file is for information purposes 
only. This is not to be used in an illegal manner.


Olive Box Plans By Arnold
---------------


 	 
 This is a relatively new box, and all it basically does is 
serve as a phone ringer. You have two choices for ringers, a 
piezoelectric transducer (ringer), or a standard 8 ohm speaker. 
The speaker has a more pleasant tone to it, but either will do 
fine. This circuit can also be used in conjunction with a rust 
box to control an external something or other when the phone 
rings. Just connect the 8 ohm speaker output to the inputs on the 
rust box, and control the pot to tune it to light the light 
(which can be replaced by a relay for external controlling) when 
the phone rings.

             ______________
            |              |        ^
       NC --|-- 5      4 --|-----/\/\/------->G
            |              |      / R2
G<----)|----|-- 6      3 --|-- NC
    | C3    |      U1      |
     -------|-- 7      2 --|---------- --- -- - > TO RINGER
            |              |
        ----|-- 8      1 --|--
       |    |______________|  |
       |                       ---/\/\/----|(----- L1
       |                           R1      C1
        ------------------------------------------ L2

                  a. Main ringer TTL circuit


                                   _
FROM PIN 2 < - -- --- ----------| |_| |------------->G
                                    P1

                  b. Piezoelectric transducer

.pa                                                      __  /|  5   3                     
FROM PIN 2 < - -- --- ---------|(---------.  .-------|  |/ |
                                          >||<       |S1|  |
                                          >||<     --|  |  |
                                          >||<    |  |__|\ |
                              G<---------.>||<.---        \|
                                           T1
                c. Electro magnetic transducer

Parts List
----------

U1 - Texas Instruments TCM1506
T1 - 4000:8 ohm audio transformer
S1 - 8 ohm speaker
R1 - 2.2k resistor
R2 - External variable resistor; adjusts timing frequency
C1 - .47uF capacitor
C2 - .1uF capacitor
C3 - 10uF capacitor
L1 - Tip
L2 - Ring
     L1 and L2 are the phone line.


Shift Rate:
-----------

  This is the formula for determining the shift rate:

                   1                   1
    SR = --------------------- = ------------ = 6.25 Hz
         (DSR(1/f1)+DSR(1/f2))    128     128
                                 ----  + ----
                                 1714    1500

              DSR = Shift Divider Rate ratio = 128
               f1 = High Output Frequency    = 1714
               f2 = Low Output Frequency     = 1500


How to make a Pearl Box By Dr. D-Code
-----------------------


 	 
 The Pearl Box:Definition

 	 
 ------------------------


 	 
 This is a box that may substitute for many boxes which 
produce tones in hertz. The Pearl Box when operated correctly can 
produce tones from 1-9999hz. As you can see, 2600, 1633, 1336 and 
other crucial tones are obviously in its sound spectrum.
.pa  3   3                     

 	 
 Materials:

 	 
 ----------


 	 
 C1, C2 .5mf or .5uf ceramic disk capacitors

 	 
 Q1     NPN transistor (2N2222 works best)

 	 
 S1     Normally open momentary SPST switch

 	 
 S2     SPST toggle switch

 	 
 B1     Standard 9-Volt battery

 	 
 R1     Single turn, 50k potentiometer

 	 
 R2       "     "    100k potentiometer

 	 
 R3       "     "    500k potentiometer

 	 
 R4       "     "    1meg potentiometer

 	 
 SPKR   Standard 8-ohm speaker

 	 
 T1     Mini transformer (8-ohm works best)

 	 
 Misc.  Wire, solder, soldering iron, PC board or perfboard,
             box to contain the completed unit, battery clip


 	 
 Instructions for building The Pearl Box:

 	 
 ----------------------------------------


 	 
 Since the instruction are EXTREMELY difficult to explain in 
words, you will be given a schematic instead. It will be quite 
difficult to follow but try it any way.

        (Schematic for The Pearl Box)

                +-------------+-------+---------+
                |             |        \        +--S1----
                C1            C2        \           SPKR
                |             |          +      +--------
                +             |      ----+T1    |
                |\            +----------+------+
                |  b  c-------|          |  
                |   Q1                   |
                |     e-----S2---+       |
                |                |       |
                |               B1       |
                |                |       |
                |                +-------+
                |R1   R2   R3  R4|
                /\/\ /\/\ /\/\/\/\
                  +--+ +--+ +--+


 	 
 Now that you are probably thoroughly confused, let me ex
plain a few minor details. The potentiometer area is rigged so 
that the left pole is connected to the center pole of the poten
tiometer next to it. The middle terminal of T1 is connected to 
the piece of wire that runs down to the end of the battery.


 	 
 Correct operation of The Pearl Box:

 	 
 -----------------------------------


 	 
 You may want to get some dry-transfer decals at Radio Shack 
to make this job a lot easier. Also, some knobs for the tops of 
the potentiometers may be useful too. Use the decals to calibrate    7   3                     the knobs. R1 is the knob for the ones place, R2 is for the tens 
place, R3 if for the hundreds place and R4 is for the thousands 
place. S1 is for producing the all the tones and S2 is for 
power.
.lm .5"
.pm .25"


 	
 Step 1: Turn on the power and adjust the knobs for the desired 

 	
 tone. (Example: For 2600hz- R1 = 0: R2 = 0: R3 = 6: R 4 = 2)


 	
 Step 2: Hit the pushbutton switch and you have the tone. If 

 	
 you don't have a tone, then recheck all connections and 

 	
 schematic.
.pm 0"
.lm 0"


PEARL BOX Schematic by Dispater [7/1/89]
-------------------


 	 
 Introduction:

 	 
 -------------


 	 
 After reading the earlier renditions of schematics for the 
Pearl Box, I decided that there was an easier and cheaper way of 
doing the same thing with an IC and parts you probably have just 
laying around the house.



 	 
 What Is A Pearl Box and Why Do I Want One?

 	 
 ------------------------------------------

     A Pearl Box is a tone generating device that is used to make 
a wide range of single tones. Therefore, it would be very easy to 
modify this basic design to make a Blue Box by making 2 Pearl 
Boxes and joining them together in some fashion.


 	 
 A Pearl Box can be used to create any tone you wish that 
other boxes may not. It also has a tone sweep option that can be 
used for numerous things like detecting different types of phone 
tapping devices.



 	 
 Parts List:

 	 
 -----------


 	 
 CD4049 RCA integrated circuit

 	 
 .1 uF disk capacitor

 	 
 1 uF 16V electrolytic capacitor

 	 
 1K resistor

 	 
 10M resistor

 	 
 1meg pot

 	 
 1N914 diode

 	 
 Some SPST momentary push-button switches

 	 
 1 SPDT toggle switch

 	 
 9 Volt battery & clip
.pa  5   3                     

State-of-the-Art-Text Schematic:

                               + 16V  1uF -
      _____________________________||_____
     |        |     |              ||     |           _
     |   _______________________          |__________| |/| 8ohms
 ____|__|_____:__|__:__|_       |          __________| | |
| 9 10 11 12 13 14 15 16 |      |         |          |_|\|
|        CD4049UBE       |      |         |
|_1__2__3__4__5__6__7__8_|      |         |          _
  |  |  |__|  |__|  |  |__________________|_________[-]
  |  |  |           |                               [b]
  |  |__________________________|                   [a]
  |     |           |           |                   [t]
  |     |    1N914  |           |                   [t]
  |___________|/|___________________________________[+]
        |     |\|   |           |
        |           |           |
        |    10M    |           |
        |___/\/\/\__|           |
        |           |           |
        |_____||____|           |  <-- These 2 wires to 
              ||    |           |      the center pole of
         .1uF   50V |           |      the switch)
____________________|           |___________________________
|                  __[Toggle Switch]________                |
|                  |                        |          ___  |
|                  |                        |          o o  |
|                  |                        | /\/\/\___| |__+
|_/\/\/\____/\/\/\ |                        |    ^          |
    1K         ^   |                        +____|     ___  |
               |___|                        |          o o  |
                                            | /\/\/\___| |__|
      (pot side)              (push-button  |  ^
                                     side)  |__|


 	 
 Explanation:

 	 
 ------------


 	 
 The 2 wires that lead from the main part of the circuit 
should be connected to the center poles on the toggle switch.  
Put the 2 wires to the pot on one side and the 2 wires going to 
the push-buttons to the other side. That way you can switch 
between tone sweep and the favorite tones you like (the push-
button side).


 	 
 To keep tones that you want to use frequently like 1850 Hz 
then all you have to do is put in a variable resistor and adjust 
it to where you have the correct tone, then just put a push-
button switch on the line. You can link them together in a chain, 
etc. There are many other good modifications to make to the box 
so have fun and be smart.

    7   3                     
How To Build A Pink Box By Baba O'Riley 
-----------------------


 	 
 The function of a "Pink Box" is to add a hold button that 
allows music or any thing else to be played into the telephone 
while the person is on hold. This Modification can either be done 
right in the telephone as a separate box.


 	 
 Materials Needed

 	 
 ----------------


 	 
 Some Bell wire or Phone wire

 	 
 SPST momentary switch         RS # 275-1547

 	 
 470 ohm resistor              RS # 271-019   

 	 
 1 LED (Approx 5V)             RS # 276-041

 	 
 SCR, 2N5061  (Transistor)

 	 
 Audio Transformer (Ratio 10K:600)

 	 
 RCA phono Jack                RS # 274-346

 	 
 Screw drivers, Soldering Irons, Ser, Etc.


 	 
 Construction

 	 
 ------------
.pm .25"
.lm .5"


 	
 1. Open the wall box and locate the RED and GREEN wires.


 	
 2. Take a piece of RED wire and strip the end and attach it to 

 	
 the red lead on the wall box. Do the same for the Green.


 	
 3. Connect the GREEN wire to the ANODE of the LED.


 	
 4. Connect the CATHODE side of the LED to the UPPER pin of the 

 	
 primary side of the transformer.  See diagram below.
                         ______
 To one pole of phono ---!Top !--- To CATHODE of LED
                        -!View!-        Primary side
 To other phono pole  ---!____!--- To pole of trans. & one pole

 	
                                                      of switch
   

 	
 5. Connect the pin directly across from the transformer to one 

 	
 pole of the phono jack.


 	
 6. Connect the RED wire to one side of the resistor and to the 

 	
 "C pole" of the transistor.


 	
 7. Connect the open pin of the switch the other side of the 

 	
 resistor and to the "G pole" of the transistor.
.lm .0"
.pm 0"
.pa  p/   3                     

 	 
 Wiring Diagram

 	 
 --------------

          RCA Jack    X-former    LED
                      _____      C   A 
  Pole or Jack --/---| Top |---/--(*)--\------GREEN wire
                    -|View |- Primary   --|---RED wire 
  Pole of Jack --/---|_____|---/-+       (O)
                                 |        |
                                 |     [--+-----Pole of Switch        
                                 |      
                                 |--------/-----Pole of Switch


 	 
 Key to Symbols

 	 
 --------------

|, --, /   Connection or wire


 _/    C pole of transistor    --(*)--  LED

[_)--  G pole of transistor     
                               |
 I     A pole of transistor   (O)  Resis
                               |
     _____
 ---| Top |---
   -| View|- Primary    Transformer
 ---|_____|---



 	 
 Use of the Pink Box

 	 
 -------------------


 	 
 Hook the RED and GREEN wires up to the appropriate terminals 
and hook the RCA jack to the output on your stereo. Turn on your 
stereo at a good volume. Now call a friend. To test the Box, Hold 
down the switch and hang up the phone. The LED should light up 
and your friend should hear music, If not then start over. The 
hold is shut off if you pick up a phone on that line or your end 
hangs up.



Red Boxes Revived By Pink Panther
-----------------


 	 
 Probably most of the information I am about to tell you, you 
probably already know or have it stored somewhere. But I have 
seen quite a lot of questions on the subject lately, and thought 
to explain a couple of things.


 	 
 Blue boxing has been dead for quite some time since every
thing went to ESS, and the same with black boxing. The latest 
form of boxing is red and green boxing. They both deal with    7   3                     fortress phones and can only be used with a fortress phone.


 	 
 With a red box, you dial a number at a fortress, insert a 
nickel, which is the ground check, and play the tape. It will 
emulate coins being dropped into the fortress. Since there is 
also questions on what are and how to get these tones, I've 
created a simple step process:
.pm .25"
.lm .5"


 	
 1)  Obtain a recorder that you can directly hook into a phone 

 	
 line. If you use a regular recorder, you will need some 

 	
 modification on it. If you have an answering machine, then 

 	
 you have it made.


 	
 2)  Find a fortress, and follow the metal pipe (usually metal) 

 	
 from the fortress to where ever it ends up. At some point on 

 	
 the pipe, there will be a small box which is held together 

 	
 by two screws. Unscrew the box.


 	
 3)  You now should find two bolts with wires connected to 

 	
 them. The wires are 22 gauge (which is fairly thin wire).  

 	
 If you see thicker wires, such as 12 gauge wires, these are 

 	
 220 volt AC lines, usually connected to the light in the 

 	
 phone booth. Do not touch the AC lines, unless you are 

 	
 stupid. Connect the tape recorder to the proper bolts, which 

 	
 means the 22 gauge wire.


 	
 4)  Now dial a long distance phone number, and you will get a 

 	
 recording to insert some money. Insert about $6.00 in quar

 	
 ters, then hang up and your money will be returned. The 

 	
 tones should have been recorded with a normal tape with no 

 	
 dolby.


 	
 5)  Obtain a recorder with a built in speaker, or rip apart a 

 	
 phone set and obtain the earpiece. If there is a diode 

 	
 across the earpiece, remove it. Connect the earpiece to the 

 	
 output of the recorder. (I recommend using an earpiece 

 	
 rather than a built in speaker).


 	
 6)  To test your tones, dial 0-959-1230 from a fortress, and 

 	
 you should get 'Coin Test . Please Deposit .' Play back the 

 	
 tones you recorded and if everything goes well, you should 

 	
 hear 'Quarter' everytime a tone is played. Remember you only 

 	
 recorded quarter tones. You can record any tones you want by 

 	
 inserting different coins at the recording stage. If you are 

 	
 having problems, try adjusting the volume.


 	
 7)  To use, dial a non-local number, insert a real nickel, and 

 	
 play the tones. Make sure you have enough tones on the 

 	
 recorder to complete the call.
.pm 0"
.lm 0"


 	 
 Now I will explain a little about what exactly happens when 
you deposit coins. When you deposit a coin, it goes through a 
series of tests, determining what type of coin it is. It will be 
deposited in various coin slots within the fortress itself if 
everything goes right. But before it is deposited in the right    7   3                     slot it will cause a wheel to be turned. A nickel will turn the 
wheel once, a dime twice, and quarter five times. This will cause 
a frequency to be generated which is sent to a operator or com
puter. A capacitor is placed across the speech circuit while 
these tones are generated so that the customer does not here 
them. Here are the tones and PPS (pules per second):

                 Nickel:  1 beep   5-8.5 PPS
                          (1700hz + 2200hz for 66ms)
                   Dime:  2 beeps  5-8.5 PPS
                          (1700hz + 2200hz for 66ms on, 66ms off,
                           then 66ms on)
                Quarter:  5 beeps  12-17 PPS
                          (1700hz + 2200hz for 33ms on and
                           33ms off, repeated a total of 5 times)


SILVER BOX PLANS By Silent Screen, Telcom 7, Floppy Disk, and
----------------     Anonymous


 	 
 Well, now that I have you here, I may as well bore you with 
a little history of silver boxes. One day, some engineer over at 
Bell Labs got the bright idea to sing to his computer, and found 
that the computer responded by dialing a phone number. Well, sort 
of. Anyway, the 10 digits (old style, with the # and * blocked 
out) touch tone pad was born. Lo and behold, though, 2 sets of 
people decided that 10 buttons just wasn't enough. They needed 
more. The two people of whom I am speaking are of course Ma Bell 
and Pa Autovon (the military phone network). So, Ma decided to 
add an extra column to her phones, this one merging the standard 
row tones with a 1633 Hz tone (to provide the mystical DTMF). 
Bell named these buttons A,B,C and D. Aren't you glad we have 
such imaginative people at the Bell System? The army named them 
Flash, Flash Overide, Priority, and Priority Interrupt, or is it 
Flash Interrupt and Priority Overide? Anyway, these are used as 
varying degrees of priority during wartime and wargame activities 
so generals can call their secretaries very quickly. Bell's use 
of A,B,C and D is not so clear. However, the last button D has an 
interesting property.


 	 
 On about 50% of the information lines in the country it will 
give you a pulsing dial tone. You can then enter commands to what 
appears to be a test system for 4A boxes.


 	 
 Anyway, the mod. WARNING: Read these instructions several 
times before you actually try them. Make sure you know how to 
solder. This could permanently damage your phone!


 	 
 Unscrew the 2 large screws on the base of your phone. Take 
the cover off and place it and the screws in a safe place. Now, 
loosen but don't remove the screws on the sides of the touch tone 
keypad. These are on the sides and attach it to its mounting 
brackets. Now carefully remove the pad from its brackets without 
ripping any wires. You will notice a plastic cover on the pad. 
Separate the 2 halves and get them out of your way. Don't destroy    7   3                     them, they'll be needed. Just move them down the wire harness 
that goes thru them.


 	 
 Now look at the top of the pad so the 1-2-3 row is facing 
away and the *-0-# row is toward you. Turn over the pad. You 
should see a mass of wires, gold plated contacts, discrete compo
nents and 2 large donut shaped black things. These are coils that 
generate the frequencies. Ma Bell was always one for standards so 
the coils she manufactures are capable of generating all 4 pri
mary tones. She only gives you connections to 3 of them, though. 
You're about to make your own connections to the 4th and make the 
3rd column of keys "bank switched" between normal and 4th row. 
Cut 3 lengths of wire of different colors about 2 ft. long. 
(Better overkill than underkill.) I used blue, gray and brown, 
but these colors are arbitrary. But I will be referring to these 
colors in this message. Look at the coil on the left with the 5 
solder contacts facing you rather than perpendicular to you. 
Count over 4 contacts from the left or 2 from the right and 
solder a wire to the 4th post from the left. This is the 1633 Hz 
output. Solder the other end of this wire to the left pole of the 
smallest PDT switch you can find. This is the point of no return 
now. Take a look at the bottom edge of the keypad. You should see 
a row of 3 gold plated contacts to the right of 2 very large 
capacitors. Look at the one on the left. This one controls the 
rightmost bank of keys on the phone.


 	 
 Gently separate the 2 touching connectors; They are soldered 
together. Spread them apart. Solder the brown wire to the top 
contact (the one furthest from you) and solder it to the right 
pole of the SPDT. Now, take the blue wire and solder it to the 
bottom closest contact. Solder the other end of this wire to the 
center pole of the SPDT. You have now completed your mods.


 	 
 When the switch is in one position you will get normal 
tones. In the other you'll get 1633 tones. Some finesse can be 
added by passing the 3 wires thru the plastic cover and in thru 
the gap in the case of your phone under the place where you hang 
it up. Then solder the wires to the switch in the proper places 
and you can glue the switch to the wall on the inside of that 
small alcove in the slack wire back into the phone. This was just 
to make sure you read the whole thing before trying it.


 	 
 Now call out-of-state directory assistance (XXX-555-1212) 
using normal tones. Switch quickly to 1633 and press down on the 
# key (now the D key). If you are on an old 4A switchbox you will 
get a pulsing dial tone. You can then switch back to normal and 
try dialing different #'s. Two of the most interesting are 6 and 
7. These often form a loop-around type connection and 2 people 
can call in, one using 6 and the other 7, and talk in this man
ner.


 	 
 NOTE: You will not receive a pulsing tone until the operator 
actually picks up on the line. If you hear ringing keep pressing. 
The tone must be on at the same time the operator gives her 
"beep." If you hear her cursing at stupid people with stuck    7   3                     buttons chances are this one doesn't work. Try out of the way 
states like Montana or Wyoming.



Combined Silver Box and White Box By Explorer & Cat 033
---------------------------------


 	 
 These are the instructions on how to build a combined Silver 
Box and White box. Most of the parts required can be found at 
your nearest Radio Shack. The only real important part required 
not sold at Radio Shack is the keypad. This can be picked up at 
any electronic store. These instructions are for a 12 button 
keypad. A toggle switch is added for the Silver Box application. 
if you have a 16 button keypad, then the toggle switch isn't 
needed.


 	 
 The tones made by a touch tone telephone are not single 
tones. They are a combination of two tones, making "DTMF" (Dual 
Tone Multi-Frequency). The normal telephone dials 12 different 
signals but is capable of dialing 16 different signals.


 	 
 The power required by a keypad is about 25 volts, but they 
will work with as little as 15, thereby allowing the use of two 9 
volt batteries. This design allows you to use a standard 8ohm 
speaker instead of a telephone speaker. To accomplish this we use 
a matching transformer.
.pm .25"
.lm .5"
 

 	
 Parts Required:

 	
 ---------------


 	
 1)  5089 dtmf tone encoder (rs 276-1301)

 	
 2)  audio transformer (rs 273-1380)

 	
 3)  tv colorburst crystal 3.579545 mhz (rs 272-1310)

 	
 4)  9v battery straps x2 (rs 270-325)

 	
 5)  9v battery x2 (rs 23-464)

 	
 6)  wire wrap socket (rs 276-1994)

 	
 7)  switch dpdt (rs 275-663)

 	
 8)  keypad (cardinal electronics)

 	
 9)  speaker 8ohm (rs 40-245)

 	
 10) circuit board (optional)

 	
 11) connecting wire or wire wrap

 	
 12) box (optional)


 	
 How to Construct it:

 	
 --------------------


 	
 A few construction notes. I suggest that you solder and tape 

 	
 all connections.
 

 	
 [1]  Connect the red wire of the transformer to either termi

 	
 nal on the speaker.


 	
 [2]  Connect the white wire from the transformer to the other 

 	
 terminal on the speaker.   7   3                     


 	
 [3]  Connect the red (positive) wire of one battery clip to 

 	
 the black wire of the other battery clip.


 	
 [4]  Connect the remaining red wire on the battery clip to pin 

 	
 #1 on the IC.


 	
 [5]  Connect the crystal to pin #7 and pin #8 on the IC.


 	
 [6]  Connect the blue wire from the transformer to pin #16 on 

 	
 the IC.


 	
 [7]  Connect the green wire from the transformer and the other 

 	
 black wire from the battery clip to pin #6.


 	
 [8]  Connect one side of the switch to pin #9. Connect the 

 	
 other side of the switch to pin #5 (only for 12 button 

 	
 pads).


 	
 [9]  Since keypads may differ, try to get a pinout of the pad 

 	
 you are using. The pad I have has 8 pinouts. One is a ground 

 	
 (this goes to pin #6 on the IC). 1,4,7,* keys connect to pin 

 	
 #3. 2,5,8,0 keys connect to pin #4. 3,6,9,# keys connect to 

 	
 the center of the switch. 1,2,3 keys connect to pin #14. 

 	
 4,5,6 keys connect to pin #13. 7,8,9 keys connect to pin 

 	
 #12. *,0,# keys connect to pin #11.


 	
 [10] Check all connections to make sure none are touching each 

 	
 other.


 	
 [11] Connect the two nine volt batteries and your keypad is 

 	
 complete.
.lm .0"
.pm 0"
 

 	 
 Note: the remaining pins on the IC are not used. The black 
wire on the transformer is also not used. When none of the but
tons are pressed, this unit uses no power, thereby eliminating 
the need for a power switch.
.pa   &   3                     
   CRYSTAL (3.579545 MHZ)
 +-#-+
 | +-+         +--------------------------- +18V --+
 | |           |                                   |
 | | +---------|----------+--- <- XFMR (GREEN)    ---
+----------------+        |                        -
|8 7 6 5 4 3 2 1 |       ---                   
|                /        -                 
|               | NOTCH                     
|  1 1 1 1 1 1 1 \         \   XFMR (RED)   
|9 0 1 2 3 4 5 6 |  SPKR-> |]============   
+----------------+         /   XFMR (WHITE)   
               |                          
               +----------- <- XFMR (BLUE)
  IC   IC                                  
  #3   #4    +--------------------------+       
   |    |    |                          |
  [1]  [2]  [3] -> IC #14    IC #5 <-+  |  +-> IC #9
  [4]  [5]  [6] -> IC #13            +--+--+
  [7]  [8]  [9] -> IC #12              / DPDT SWITCH
  [*]  [0]  [#] -> IC #11
 
      KEYPAD
 
KEY      FREQ. #1    FREQ. #2
---      --------    --------
1          697        1209
2          697        1336
3          697        1477
A          697        1633
 
4          770        1209
5          770        1336
6          770        1477
B          770        1633
 
7          852        1209
8          852        1336
9          852        1477
C          852        1633
 
*          941        1209
0          941        1336
#          941        1477
D          941        1633
 
All frequencies are measured in Hertz.
.pa   0   3                     

 	 
 Usage of a Silver Box

 	 
 ---------------------
 

 	 
 First off, a Silver Box adds the four extra tones to your 
phone that Ma Bell never told you about. They go like this:
 
               1  2  3  A
               4  5  6  B
               7  8  9  C
               *  0  #  D
 

 	 
 There used to be many places where you could use Silver Box 
tones, but now you can only use it in places where Ma Bell hasn't 
gotten around to replacing her old switchboxes, (4a), or on 
AUTOVON. AUTOVON is a special military phone line, like a mass of 
private lines hooked together. To see if a specific area has the 
old 4a switchboxes try this test:


 	 
 Call up the directory assistance by using xxx-555-1212, 
(where xxx is the area code you are checking out. Now hold down 
the "D" key as soon as you finish dialing. (If you are using the 
toggle switch type then flip the switch and hold down the "#" 
key.) The phone should start ringing and the operator will an
swer.


 	 
 If the operator screams at you to stop pressing your keypad, 
then hang up and try a different areacode (this one does not 
work.)


 	 
 If you get a pulsing tone then you got a good line! Now try 
out different numbers. 6 and 7 usually form a loop line and two 
people with Silver Boxes can talk. Some of these are watched, so 
don't say anything you wouldn't want your mother to hear!



SWITCHBOX PLANS by Autopsy Saw
---------------


 	 
 This tutorial is notable in that it is totally and absolute
ly within legal bounds. It's only object is to guide you in 
building a device with which you can control, on many different 
levels, your home phone lines. It is designed primarily for two 
phone numbers, although I suspect that provisions for more than 
two can be easily added. With it, you can put one or both phone 
lines on hold with visible indicators of each lines status; 
conference call with two people; change a phone from line #1 to 
line #2; and lastly, make one phone line physically dead to 
outside world. This is good, for instance, if you don't want to 
receive any calls, or if you want to stop someone from talking on 
that line really quickly.


 	 
 The circuit is relatively simple to build and I believe it 
is much more economical than buying something like Radio Shack's 
line controller. It will require some knowledge of electronics    7   3                     and the phone line in general, but I don't think that should be a 
problem. I have personally found many uses for the controller, 
and have put in into a pleasant "project box" so it is not an 
eyesore.


 	 
 Parts List

 	 
 ----------
 

 	 
 Two pushbutton (on-off) switches for hold

 	 
 Two LED's for line status indication

 	 
 One DPDT switch for conferencing

 	 
 One SPST switch for line shut off

 	 
 Another DPDT switch for phone line switching

 	 
 Wire

 	 
 2 modular phone plugs with at least 10 feet of wire each

 	 
 Two 1.7K ohm resistors

 	 
 *OPTIONAL* - Project Box


 	 
 Construction

 	 
 ------------
 

 	 
 We will take the construction of the switchbox-controller in 
parts. First, the hold switches and status indicators. The fol
lowing is a diagram of the essential circuit:
 
               Pushbutton #1    LED
--------------------------|x|-----0---
Phone Line #1     1.7K Resistor      |
-----------------/\/\/\/\/------------
 

 	 
 Some word of explanation is in order. First of all, the 
second phone line hold is constructed the same as the first. 
Basically, there are two wires that come out of your phone line, 
the red and the green. You have to experiment to find out which 
one is connected to the pushbutton switch and which one to the 
Resistor. To do this, just connect it in any way and then turn 
the switch on. If the LED lights up, you connected it right, 
otherwise reverse the connections. Got it? Good, now do the same 
for line #2, following exactly the same procedure.
 

 	 
 Now, let's do an easy one. This will be the line blackout 
switch. First, decide which line you wish to black out. Actually, 
you can do it to both lines if you wish, just get an extra SPST 
switch. Now, connect the switch across the line as follows:
 
--------------------------------|-------|
         x                      | Hold  |
        |x| <---Switch          |Circuit|
         x                      |       |
--------------------------------|-------|
 

 	 
 Don't worry that your line can't handle both circuits, it 
can. To test out, pick up a phone on the line you have connected 
the switch to and flip it on. There should be dead silence. Now, 
turn it off. You should hear a dial tone. You have to be an    7   3                     absolute idiot if this doesn't work.
 

 	 
 OK, let's see what we have so far. If everything is working 
you should now have two hold circuits and a blackout switch 
connected. Now it really gets tough!
 

 	 
 Next on the agenda is the conference switch. I have a few 
precautions for you on this one. First, you have to know what 
you're doing, and second, it doesn't work that well. The reason 
it doesn't is because I am naturally very lazy and didn't feel 
like adding the needed phone transformer. But, it is still good 
for many uses, limited only by your imagination (to use a 
cliche').


 	 
 First, take the double pole double throw switch into your 
hand. It should look like this on the back:
 
                    ---------
                    - 1   2 -
                    - 3   4 -
                    - 5   6 -
                    ---------

          * Note - Numbers correspond to actual pins.


 	 
 Now connect two wires to pins 3 & 4 and two wires to pins 1 
& 2. The wires going to pins one and two are connected across the 
first phone line and the wires from three and four go across the 
second phone line. Test it out: Pick up your phone (either line) 
and wait for dial tone. Then throw on the conference switch. You 
should get a second dial tone. Now dial 555-1212. You should now 
have two D.A.'s on the line, asking each other "What City?". If 
not, then reverse the connections to phone line #1 or #2, it 
doesn't matter. Now it should work. If not, then recheck EVERY
THING! You messed up!
 

 	 
 Now for the last section - the phone line switcher. With 
this, you can connect a phone directly to the switchbox and have 
it operate from line #1 or line #2, depending on the position of 
the last DPDT switch. Let me emphasize that this is optional. 
Actually, all the circuits are - they are independent of each 
other and each can be built separately or together.


 	 
 Now, referring to the diagram of the DPDT switch above: 
Connect two wires to pins 1 & 2. Then connect these to phone line 
#1. Now connect two wires to 5 & 6 and connect these to phone 
line # 2. Lastly, connect two wires to 3 & 4 and connect the ends 
of these to a phone. That's it! Now, pick up the phone and you 
should hear a dial tone. Throw the switch and you should hear 
another dial tone. In some areas you may dial '958' to hear 
exactly what number you are currently connected to, but that 
should be a problem. If you really can't figure it out, then 
either trace the circuit back or call one of the numbers and see 
if you get a busy signal or if it rings.
    7   3                     

 	 
 Finally - Put the whole mess inside a project case, unless 
you like the site of wires all over the place. This also should
n't be a problem if you know even the basics of hardware con
struction.



The Tan Box by Samurai Cat and Tarkin Darklighter
-----------


 	 
 Introduction

 	 
 ------------


 	 
 The Tan box allows you to make recordings from a phone line, 
and it will only record once the victim's phone is picked up.


 	 
 Basically, this is a modified linesman's handset, or "Beige 
Box." A Beige Box consists of a speaker and two wires, a red 
(ring) and a green (tip). The Tan Box also works on this princi
ple.


 	 
 Parts:

 	 
 ------
.pm .25"
.lm .5"


 	
 A small cassette recorder, preferably a micro cassette 

 	
 recorder. (It MUST have both a microphone jack and a remote 

 	
 jack)

 	
 A single line recording control. (Radio Shack part number 43-

 	
 228)

 	
 2 alligator clips (Radio Shack number 270-374)

 	
 A plastic box to contain the above parts (also available at 

 	
 Radio Shack)

 	
 Tan or Black spray paint

 	
 7/16 inch hex driver


 	
    Construction:

 	
    -------------


 	
 1.  Take the recording control and cut the modular plug off.  

 	
 Make sure you leave enough wire!


 	
 2.  Strip the red and green wires. (The yellow and black wires 

 	
 are not necessary, and can be removed.)


 	
 3.  Drill a hole on the end of the plastic box (enough for two 

 	
 wires to go through).


 	
 4.  Put the recording control in the box and run the red and 

 	
 green wires through the hole. Attach one alligator clip to 

 	
 each of the wires.


 	
 5.  Put the micro cassette recorder in the box and plug the 

 	
 remote and microphone wires from the recording control into 

 	
 it.
   7   3                     

 	
 6.  Close the box.


 	
 7.  Spray paint the box and wires to make it look like it is 

 	
 supposed to be where it is. (BE SURE YOU LABEL THE WIRES 

 	
 BEFORE YOU PAINT THEM!)
.pm 0"
.lm 0"


 	 
 Installation

 	 
 ------------


 	 
 You can either hook it up to the box on the side of their 
house or a bridging head. Use the 7/16" hex driver to open either 
of these. (On older houses, you may not have to use a hex driv
er.) Attach the red wire to the right terminal and the green to 
the left. (Remember: Red-Ring-Right) If you attached the box to a 
bridging head, there may be room to leave it inside. If you 
attached it to the side of a house, run the wires out of their 
box and close it. Attach the Tan Box to the side of their house.


 	 
 Make sure you come back and get the box pretty soon, or you 
may find it gone! Micro cassette recorders are not cheap!


 	 
 Be careful, wiretapping is a felony (2-20 years, a $10,000 
fine, or both), and various other laws may be broken (i.e., 
recording without the other party knowing it, etc.)


 	 
 Ways to avoid being Beige/Tan Boxed

 	 
 -----------------------------------


 	 
 A tap detector may be purchased at Radio Shack (of course). 
If you do detect a tap, find the box, and you will have just 
gotten a new tape recorder!


Urine Box Plans By Wolfgang von Albatros [3/2/86]
---------------


 	 
 Now at last, Underground_Elite brings you these ultrasophis
ticated box plans for, well, uh, I guess we just kind of bring 
them for you. After many months of keeping this puppy secret, we 
here at Underground_Elite have finally come to the consensus that 
the public oughtn't be kept in the dark from the wrath of Ma 
Bell, that great telephone company in the sky.


 	 
 The Urine Box (tm) basically creates a capacitative disturb
ance between the ring and tip wires in another's telephone head
set. I have utilized this to the distinct advantage of the opera
tor of the Urine box and to the disadvantage of the other party 
involved, hopefully you won't get caught.


 	 
 Without further a doo, wire this schematic together. Copper 
wire (or gold) will work best due to its lessened resistance. It 
might be a good idea to keep the wiring cooled, to further reduce 
current loss.
.pa             6   3                     
            47k ohms  ---------------         .01 uF
|\    |----/\/\/------| SPST switch |---|------)|-------|
| \   |               ---------------   |               |
|  |--|                                 |               | +
|  |--------<-|-----|---/\/\/-----------|           ----------
| /       PVP diode |   470k ohms                   | 12 VDC |
|/                  |        _                      ----------
                    |       /         .005 uF           | -
SPKR 20W            |--/\/\/\/\/--------)|----<-|-------|
                    |    _/ VR1 (see note1)   PVP diode |
                    |                                   |
                to RING                              to TIP
               (your phone)                         (your phone)
.pm .25"
.lm .5"


 	
 Note1 - VR1 is a three position variable resistor, enabling 

 	
 settings equivalent to 100k ohms, 210k ohms, and 320k ohms 

 	
 (all 110k apart).


 	
 Note2 - The diodes are silicon-germanium based bipolar RF 

 	
 reducers to limit current polarity reversal. If these are 

 	
 placed backwards the box will not work as intended.


 	
 Note3 - The speaker will emit low tones when the SPST is 

 	
 closed (ie the box is "ON") and when the settings of VR1 are 

 	
 moved to higher resistance the tone level will increase.


 	
 Note4 - Place setting evaluation symbols to represent the 

 	
 lowest resistance setting for VR1 to be "STEAM", the second 

 	
 (210) to be "MELT", the third (320) to be "VAPORIZE". 
.lm 0"
.pm 0"


 	 
 Usage of box.

 	 
 -------------


 	 
 Use in place of your normal telephone receiver. Do not 
attempt usage as a regular phone. Call victim by sending tones 
through speaker with tape recorded noise. Use touch tone sounds 
as pulse requires electric disruption of line, not just audio. 
After answer (listen in on SPKR 1) set VR1 to desired strength 
and let her go. Victim will feel unpleasant sensations in his/her 
head and will undergo a series of high intensity seizures, not 
unlike epilepsy, and jointly proportional to VR-1 setting and 
time induced.


 	 
 Settings. (The Fun Part)

 	 
 ------------------------
.pm .25"
.lm .5"


 	
 STEAM. A short -poof- of water vapor condenses within the 

 	
 victim's earpiece, rendering the telephone short circuited 

 	
 and the victim quite dazed.

 	
 MELT.  Causes structural phase change of receiver (usually 

 	
 reinforced urea formaldehyde plastic material - high tech). 

 	
 This has the unpleasant bonus of removing the victim's hand.

 	
 VAPORIZE. If the victim is particularly nasty, this setting 

 	
 will remove his upper anatomy (if box is enabled properly, 

 	
 that is!). Continued usage of this setting is generally not    7   3                     
 	
 recommended, as death or other serious injury will result.
.lm 0"
.pm 0"


White Box Plans by Uncle Joe & Blacksmith
---------------


 	 
 This article will tell you how to change a normal touch tone 
keypad and convert it to a portable unit. In addition, we give 
the touch-tone frequencies. First of all, the tones made by a 
touch tone telephone are not single tones, they are a combination 
of two tones, making "DTMF" (dual tone multi-frequency). The 
normal tone telephone dials 12 different signals, but is capable 
of dialing 16 different signals.


 	 
 The power required by a keypad is about 25 volts, but they 
will work with as little as 15, thereby allowing the use of two 
9-volt radio batteries. As you may have guessed, they are also 
designed to operate with a telephone type speaker (and phone 
line), and not the standard 8-ohm speaker which needs to be used 
for adequate volume. To accomplish this, we use a matching trans
former, this is one of those miniature ones available at Radio 
Shack. Enough of the theory, now for the circuit.


 	 
 Material Required:

 	 
 ------------------


 	 
 A touch tone keypad

 	 
 A miniature 1000 to 8 ohm transformer (R.S. # 273-1380)

 	 
 A standard 8-ohm speaker

 	 
 Two 9-volt radio batteries

 	 
 Two 9-volt battery clips

 	 
 A case to put it all in (optional)


 	 
 A few construction notes, I suggest that you solder and tape 
all connections. It is also important to read this entire bulle
tin before attempting to construct this.


 	 
 First, connect the RED wire of the transformer to either 
terminal on the speaker. Now connect the WHITE wire from the 
transformer to the other terminal on the speaker. Next, connect 
the RED (positive) wire of one battery clip to the black wire of 
the other battery clip.  Now connect the remaining RED wire on 
the second battery clip to the GREEN wire from the touch tone 
pad. Connect the BLUE wire from the touch tone pad to the ORANGE-
and-BLACK striped wire from the touch tone pad. To these two 
wires, now connect the remaining black lead from first battery 
clip. You have now finished the power connection to the keypad. 
Connect the BLACK wire from the keypad to the BLUE wire on the 
transformer. Next connect the RED-and-GREEN striped wire from the 
keypad to the GREEN wire on the transformer. The BLACK wire on 
the transformer should not be connected to anything, along with 
quite a few wires from the keypad.  The connection of the keypad 
is now complete.


 	 
 Next, all you have to do is connect two nine volt batteries    7   3                     to the battery clips, and you'll be ready to go. You may want to 
mount it in a case for easy portability.


 	 
 Note that the silver box modification CAN be made to this 
unit, allowing complete remote phreaking. When none of the but
tons are pressed, this unit uses NO power, thereby eliminating 
the need for a power switch, and extending the life of the bat
teries.


 	 
 The following are the frequency combinations generated by 
each button on the keypad:

KEY  FREQ. #1  FREQ. #2
---  --------  --------
 1      697      1209
 2      697      1336
 3      697      1477
 A      697      1633
 4      770      1209
 5      770      1336
 6      770      1477
 B      770      1633
 7      852      1209
 8      852      1336
 9      852      1477
 C      852      1633
 *      941      1209
 0      941      1336
 #      941      1477
 D      941      1633


 	 
 All frequencies are measured in Hertz.  Note that A,B,C and 
D are not normally present (except for silver boxes).


.pa  $   3                     
.h1o #                                                   Appendix A

 	VV!
 Appendix A

Miscellaneous Boxing Notes From Near and Far
--------------------------------------------

Boxes that do not work on ESS systems:
    Black
    Blue (will work off of 800's and various numbers)

-----------------------------------------------------------------


 	 
 Red boxing is perfectly possible in an ESS switching system. 
In fact, it's actually a little easier, due to the fact that most 
fortress phones in the ESS system are DTF (dial-tone first). In 
other words, you can pick up a fortress phone, and there will be 
a dial-tone 'before' you insert any money at all. From there you 
simply blow your red box tones into the mouthpiece and you're all 
set.


 	 
 In Step by Step systems, and most versions of Crossbar, you 
are required to insert money before you get a dialtone (you need 
the dialtone, to send your red box tones, as the mouthpiece is 
actually 'disconnected' until money is inserted (earpiece also). 
So here's where the 'Green Box' tones came in, after inserting 
your initial dime to initiate dialtone, thus enabling the red box 
tones to be accepted, after you finished the call, one would have 
the 'called' party blow the Green Box, 'Coin Return' tones, and 
have the original dime refunded. Note-> It -HAS- to be the called 
phone that sends the coin return tone. You can't send them your
self (from the fortress).


 	 
 In a CCITT (out band) system, all switching signal are sent 
on a separate line other than the voice line, thus 'disabling' 
boxing.

-----------------------------------------------------------------
               Multi-Frequency Tones

   A    697Hz + 1633Hz     B    770Hz + 1633Hz
   C    852Hz + 1633Hz     D    941Hz + 1633Hz
   1    700Hz +  900Hz     2    700Hz + 1100Hz
   3    900Hz + 1100Hz     4    700Hz + 1300Hz
   5    900Hz + 1300Hz     6   1100Hz + 1300Hz
   7    700Hz + 1500Hz     8    900Hz + 1500Hz
   9   1100Hz + 1500Hz     0   1300Hz + 1500Hz
   KP  1100Hz + 1700Hz     ST  1500Hz + 1700Hz
  *11   700Hz + 1700Hz    *12   900Hz + 1700Hz
  *KP2 1300Hz + 1700Hz     SF  2600Hz

  * = Used on CCITT System 5, for special international calling.

            Green Box Tones

   Coin Collect 700Hz + 1100Hz
   Coin Return 1100Hz + 1700Hz   7   3                     
   Ringback     700Hz + 1700Hz

             Money Tones

   Nickels  1 time  1700Hz + 2200Hz for 66msec.
   Dimes    2 times 1700Hz + 2200Hz for 66msec each
   Quarters 5 times 1700Hz + 2200Hz for 33msec each

----------------------------------------------------------------


 	 
 To do a verification of a number using a blue box, do the 
following:
.pm .25"
.lm .5"


 	
 1. Seize a trunk, wait for beep-chunk


 	
 2. Dial (MF) KP+Your NPA


 	
 3. Dial a two digit area identifier. These are one of the 

 	
 following: 00, 11, 22, 33, 44, 55, 66, 77, 88, 99. Which one 

 	
 you use depends on the NPA you give it. You'll have to find 

 	
 one that works.


 	
 4. Then dial NPA+###+####+ST where this is the number you wish 

 	
 to verify. You'll hear the trunks clicking a bit, then a 

 	
 beep and you'll be on the line. The voices will be scram

 	
 bled, though. The verify lasts about 20-40 seconds.
.pm 0"
.lm 0"

------------------------------------------------------------------


 	 
 To box an overseas call:


 	 
 1. Seize a trunk with 2600Hz


 	 
 2. Dial KP+NPA+SENDER+ST

 	 
 
 	 
 Where SENDER is an overseas routing station, such as :

 	 
 
 	 
 182 - White Plains, NY

 	 
 
 	 
 184 - New York, NY

 	 
 
 	 
 185 - Pittsburgh, PA

 	 
 
 	 
 186 - Orlando, FL


 	 
 3. Dial KP+X+CC+CI.C+LN+ST

 	 
 
 	 
 Where CC = Country Code

 	 
 
 	 
 CI.C     = City Code

 	 
 
 	 
 LN       = Local Number


 	 
 X is a number sometimes required to be entered for some 
stations. 0 gives a satellite, and 1 links via cable (better 
connection).

    Try KP+914+182+ST
   then KP+34+1+254+5400+ST
        (Hotel in Spain)

 KP+000+0000+ST will tell you what switching station you are
routed through.   7   3                     

-----------------------------------------------------------------

           Table of Proposed Standard Audible Tones in North
America (From CCITT Document AP III-84)

Use       Frequency in Hz   Power at CO   Timing
          350 440 480 620
===============================================
Dial Tone  X   X             -13 DB     continuous

Busy Tone          X   X     -24 DB     .5 sec on/off

Reorder            X   X     -24 DB     .2 sec on .3 sec off

Audible        X   X         -16 DB     2 sec on/4 sec off
Ringing

High Tone          X         -16 DB     varies with use

Pre-exemption  X       X     -18 DB     single 200/500 msec
Tone

Call Waiting   X             -13 DB     single 500 msec
Tone
=============================================================


 	 
 High Tone is used in many ways. For example:


 	 
 1. Spurts of tone to indicate specific orders to operators 
in the manual service (order tones).  


 	 
 2. To inform operators of lines that are temporarily out of 
service.  


 	 
 3. To alert customers that their services are in a permanent 
off-hook condition.


 	 
 Pre-exemption Tones are used in certain private switched 
networks which may interconnect with national networks.


 	 
 Frequency limits are +/- 0.5 % of nominal.

  
----------------------------------------------------------------

           TASI Locking Frequency


 	 
 TASI (time assignment speech interpolation) is used on 
satellite trunks, and basically allows more than one person to 
use a trunk by putting them on while the other person isn't 
talking. Of course, you'd never hear the other person talking on 
your trunk. When you start to talk, however, the TASI controller 
has to find an open trunk for you. Because of this, some of your 
speech is lost (because of the delay in finding a trunk). This is    7   3                     called clipping. Not much of a problem for speech, but can really 
mess up data transmissions. A TASI locking frequency (1850 Hz) 
sent before transmission will keep the TASI from putting anyone 
else on your trunk, or you on anyone elses.

.pa  .   3                     
.h1o #                                                   Appendix B

 	VV!
 Appendix B

LINE SIGNALS IN CCITT SYSTEMS Courtesy of Sherwood Forest II
-----------------------------


 	 
 You will be given an entry followed by 4 pieces of informa
tion on that entry. The titles for those 4 pieces of information 
are: Direction, CCITT #3 (1VF), CCITT #4 (2VF), and CCITT #5 
(2VF). The individual pieces of information will be, for the most 
part, abbreviated to the use of symbols, the symbols table will 
follow the entries at the end of this section.

SEIZE TERMINAL:  -->,X,PX,X
SEIZE TRANSIT:  -->,N/A,PY,N/A
START PULSING-TERMINAL:  <--,X,X,Y
START PULSING-TRANSIT:  <--,N/A,Y,N/A
END OF PULSING (ST)*:-->,250MS,xSxSxSx,1500+1700HZ
BUSY:  <--,XX,PX,Y
ACKNOWLEDGE:  -->,N/A,N/A,X
ANSWER:  <--,XSX,PY,X
CLEAR BACK (ON HOOK):  <--,XX,PX,Y
RING FORWARD:  -->,XSX,PYY,Y(850+OR-200MS)
CLEAR FORWARD (DISCONNECT):  -->,XXSXX,PXX,X+Y
DISCONNECT ACKNOWLEDGE:  <--,XXSXX,PYY,X+Y

SYMBOL TABLE

X = 2280+OR-6HZ,120+OR-30MS
XX = 2280+OR-6HZ,600+OR-120MS
S=100+OR-20MS SILENCE
<-- OR --> = DIRECTION

Those were for CCITT #3 (1VF) (Second item after each signal)

X = 2040+OR-6HZ,100+OR-20MS
Y = 2400+OR-6HZ,100+OR-20MS
XX = 350+OR-70MS
YY = 350+OR-70MS
S = 35+OR-7MS;x:2040HZ,35MS
P = (2040HZ,2400HZ),150+30MS

Those were for CCITT #4 (2VF)

X = 2400+OR-6HZ
Y = 2600+OR-6HZ

Those were for CCITT #5 (2VF)

N/A = Not Applicable
* = Combination #15 of Address Code

.pa  4   3                     
.h1o #                                                   Appendix C

 	VV!
 Appendix C

  Tone Frequencies of Various Boxes:

                 Dual Tone Multi-Frequency (Touch-Tone)
Key    Freq. #1   Freq. #2     ^    Key    Freq. #1   Freq. #2
---    --------   --------     |    ---    --------   --------
 1      697        1209        |     7      852        1209
 2      697        1336        |     8      852        1336
 3      697        1477        |     9      852        1477
 A      697        1633        |     C      852        1663
 4      770        1209        |     *      941        1203
 5      770        1336        |     0      941        1336
 6      770        1477        |     #      941        1477
 B      770        1633        v     D      941        1633

          Multi-Frequency (Blue box/operator tones)

Key    Freq. #1   Freq. #2     ^    Key    Freq. #1   Freq. #2
---    --------   --------     |    ---    --------   --------
 1       700        900        |     9      1100       1500
 2       700       1100        |    10      1300       1500
 3       900       1100        |    11       700       1700
 4       700       1300        |    12       900       1700
 5       900       1300        |    KP      1100       1700
 6      1100       1300        |    KP2     1300       1700
 7       700       1500        |    ST      1500       1700
 8       900       1500        |  Disconnect      2600

Red Box tones:  pay phone change tones
$.05    1700Hz+2200Hz for 66 ms
$.10    1700Hz+2200Hz for 66ms on, 66ms off, 66ms on
$.25    1700Hz+2200Hz for 33ms on, 33ms off (repeated 5 times)

Green Box tones:  return change put in pay phone
40ms 2600Hz, 60ms silence, 900ms 700+1100 (BB 2)
90ms 2600Hz, 160ms silence, [BB 2 90 on, 90 off repeated 4 times]

KP + 011 + country + national # + ST  = international calling
KP + NPA + 121 + ST              = Inward Operator
KP + NPA + 131 + ST              = Directory Assistance
KP + NPA + 101 + ST              = Toll Switching
KP + NPA + 141 + ST              = Rate & Route
KP + NPA + 181 + ST              = Coin Refund Operator
KP + NPA + 11501 + ST            = Mobile Operator
KP + NPA + 11521 + ST            = Mobile Operator
KP + NPA + 11511 + ST            = Conference Operator
KP + NPA + PFX + SUFX + ST       = Free call

TASI Locking Frequency:

(Time Assignment Speech Interpolation, used on satellites for 
data transmission):  1850Hz before transmission
.pa  6   3                     
.h1o #                                                   Appendix D

 	VV!
 Appendix D

Trunking Off of 911 by The Conflict
-------------------    Modified by Maxwell Smart
 

 	 
 We are not sure how useful this will be anyone, since the 
majority of these users do not possess blue boxes. Oh well, c'est 
la vie, and on with the fun. Essentially, the blue box generates 
tones which are important to telephone companies. The most impor
tant tone being the 2600 Hz. This is used for seizing and giving 
up trunks. Well, an interesting concept came up one day when a 
few of the guys were screwing around at a local fortress phone.  
We decided to call 911 and blow a 2600. The results were very 
bizarre. The effects of trunking a 911 can be tremendously damag
ing! See, the 2600 blew 911 off its assigned trunk position. 
Although we could not seize this for outdial, we could play 
operator. We played with the inwards for a time, then we hung up 
and called back 911. A recording came up saying that 911 was not 
available in this area and to call the police/ambulance/firehouse 
(like the one Richmond residents get). That was very funny since 
only minutes ago, the 911 was functioning fine. Well, we cruised 
from this local and hit another phone.


 	 
 We DTMF'd 911 and got the same recording. It seems that the 
area's 911 was disabled for nearly 3 days. They reassigned the 
trunk position I guess 2 days after, then they had to resetup the 
equipment.
.pa  @   3                     
.h1o #                                                   Appendix E

 	VV!
 Appendix E

International Dialing Codes (Country + Routing)
-----------------------------------------------
   
   To dial international calls:
   
        International Access Code + Country code + Routing code
   
        Example :
   
        To call Frankfurt, Germany, you would do the following:
   
        011 + 49 + 611 + (# wanted) + # sign(octothrope)
   
        The # sign at the end is to tell Bell that you are done
        entering in all the needed info.

        Here is the list of Country Codes, listed next to the
     country, and the routing codes listed next to the city.

Algeria-213          American Samoa- 684    Andorra- 33          
-------              --------------         -------              
                                            all points- 078      

Argentina- 54        Australia- 61          Austria- 43        
---------            ---------              -------         
Buenos Aires- 1      Melbourne- 3           Innsbruck- 5222 
                     Sydney- 2              Vienna- 222     

Bahrain- 973         Belgium- 32            Belize- 501                 
-------              -------                ------           
no routing needed    Antwerp- 31            no routing needed
                     Brussels- 2            
        
Bolivia- 591         Brazil- 591/(55)       Brunei- 673              
-------              ------                 ------
La Paz- 2            Brasilia-61          
                     Rio de Janeiro- 21  
                     Sao Paulo- 11       
            
Cameron- 237         Chile- 56/(506)        China- 86    
--------             -----                  -----        
                     Santiago- 2            Tainan- 62   
                     Valparaiso- 31         Taipei- 2    
        
Colombia- 56/(57)    Costa Rica- 506        Cyprus- 357    
--------             ----- ----             ------         
none needed          no routing needed      Nicosia- 21    
        
Czechoslovakia- 42   Denmark- 45            Ecuador- 593           
--------------       -------                -------        
                     Aalborg- 8             Cuenca- 4      
                     Copenhagen 1 or 2      Quito- 2       
   7   3                     
Egypt- 20            El Salvador- 503       Ethiopia- 251   
-----                ----------             --------
                     no routing needed  
        
Fiji- 679            Finland- 358           France- 33     
----                 -------                ------         
none needed                                 Bordeaux- 56   
                                            Marseille- 91  
                                            Nice- 93       
                                            Paris- 1       

French Antilles- 596 French Polynesia- 689  Gabon- 241
---------------      ----------------       -----

Germany- 49          German. Rep- 37        Gibraltar- 350   
-------              ------- ---            ---------
Berlin- 30
Bonn- 228
Frankfurt- 661
Munich- 89
        
Greece- 30           Guam- 671              Guantanamo Bay        
------               ----                   (US Navy Base)- 53
Athens- 1            no routing needed      --------------
Rhodes- 241

Guatemala- 502       Guyana- 592            Haiti- 509       
---------            ------                 -----            
Guatemala City- 2    Georgetown- 02         Port Au Prince- 1
        
Honduras- 504        Hong Kong- 852         Hungary- 36
--------             ---- ----              -------
no routing needed    Hong Kong- 5
                     Kowloon- 3

Iceland- 354         India- 91              Indonesia- 62 
-------              -----                  ---------        
                                            Jakarta- 21      

Iran- 98             Iraq- 964              Ireland- 353    
----                 ----                   -------         
Teheran- 21          Baghdad- 1             Dublin- 1       
                                            Galway- 91      
        
Israel- 978          Italy- 39              Ivory Coast- 225   
------               -----                  ----- -----        
Haifa- 4             Florence- 55           no routing needed  
Jerusalem- 2         Naples- 81
Tel Aviv- 3          Rome- 6
                     Venice- 41
        
Japan- 81            Jordan- 962            Kenya- 254    
-----                ------                 -----         
Hiroshima- 822                              Nairobi- 2    
Tokyo- 3   7   3                     
Yokohama- 45

Korea- 82            Kuwait- 965            Liberia- 231  
-----                ------                 -------       
Pusan- 51            no routing needed      none needed   
Seoul- 2
        
Lesotho- 266         Libya- 218             Liechtenstein- 41          
-------              -----                  -------------      
                     Tripoli- 21            All points- 75     
        
Luxembourg- 352      Malawi- 265            Malaysia- 60
----------           ------                 --------
no routing needed                           Kuala Lumpur- 3
        
Monaco- 33           Morocco- 212           Nambia- 264
------               -------                ------
All points- 93

Netherlands- 31      Netherlands Antilles- 599
-----------          ----------- --------
Amsterdam- 20
Rotterdam- 10
The Hague- 70

New Caledonia- 687   New Zealand- 64        Nicaragua- 505                    
--- ---------        --- -------            ---------   
no routing needed    Auckland- 9            Managua- 2       
                     Wellinton- 4

Nigeria- 234         Norway- 47             Oman- 968   
-------              ------                 ----
Lagos- 1             Bergen- 5    
                     Oslo- 2      

Pakistan- 92         Panama- 507            Papua New Guinea-675
--------             ------                 ----- --- ------    
                     none needed            no routing needed   
        
Paraguay- 595        Peru- 51               Philippines- 63  
--------             ----                   ------------      
Asuncion- 21         Arequipa- 542          Manila- 2         
                     Lima- 14                               
        
Poland- 48           Portugal- 351          Qatar- 974   
------               --------               -----
                     Lisbon- 19      
        
Rumania- 40          St. Pierre & Miquelon- 508
-------              --- ------ - --------
Bucuresti- 0

Saipan- 670          San Marino- 39         Saudi Arabia- 966  
------               --- ------             ----- ------       
                     All points- 541        Riyadh- 1             7   3                     
.pa        
Senegal- 221         Singapore- 65          South Africa- 27
-------              ---------              ----- ------
no routing needed                           Cape Town- 21
                                            Pretoria- 12
        
Spain- 34            Sri Lanka- 94          Suriname- 597     
-----                --- -----              --------          
Barcelona- 3         Colombo- 1             no routing needed 
Canary Is.- 28
Madrid- 1
Seville- 54
        
Swaziland- 268       Sweden- 46             Switzerland- 41  
---------            ------                 -----------      
                     Goteborg- 31           Berne- 31        
                     Stockholm- 8           Geneva- 22 
                                            Lucerne- 41      
                                            Zurich- 1        
           
Tahiti- 689          Taiwan- 886            Tanzania- 255
------               ------                 --------
none needed
        
Thailand- 66         Tunisia- 216           Turkey- 90    
--------             -------                ------        
Bangkok- 2           Tunis- 1               Istanbul- 11  
        
Uganda- 256          United Arab            United Kingdom- 44 
------               Emirates- 971          ------ -------     
                     --------               Belfast- 232       
                     Abu Dhabi- 2           Cardiff- 222       
                     Ajman- 6               Edinburgh- 31      
                     Al Ain- 3              Glasgow- 41         
                     Aweir- 49              Liverpool- 51       
                     Dubai- 4               London- 1           
                     Fujairah- 91            
                     Jebel Dhana- 5          
                     Sharjah- 6              
                     Umm-Al-Quwain- 6        
                             
Uruguay- 598         USSR- 7                Vatican City- 39
-------              ----                   ------- ----    
                     Kiev- 044              All points- 6   
                     Leningrad- 812
                     Minsk- 017
                     Moscow- 095
                     Tallinn- 0142
        
Venezuela- 58        Yemen Arab Rep.- 967   Yugoslavia- 38 
---------            ----- ---- ----        ----------     
Caracas- 2                                  Belgrade- 11   
Maracaibo- 61                               Zagreb- 41     
        
Zambia- 260          Zimbabwe- 263
------               --------
