            BASIC TELECOMMUNICATIONS COURSE 001 TEXT BOOK



PREFACE:
     In this course, I plan to cover as much material as possible 
relating to telecommunications.  The syllabus covers long distance 
services, The Network, colored boxes, telephone electronics, central 
office equipment, operators, special #'s, and much, much more.


                 CHAPTER ONE: LONG DISTANCE SERVICES

     In an attempt to offer lower prices, alternatives to Bell have 
been set up.  Services such as Sprint, Metrofone, ITT, MCI, Travel
net, and many others are all familiar to us.  These services are 
known as Specialized Common Carriers (SCC's) or Other Common Carriers 
(OCC's). [Don't confused this with Switching Control Center, also 
known as SCC]
     The basis of all these services are that they own their own 
switching equipment.  First, we will look at those services which use 
a local dial-up.  The principle of these are:
                 1) You dial the local #.
                 2) When it picks up you get a 2nd dial
                    tone, you then enter a code.
                 3) You then enter the destination # &
                    whalla, you're connected--a free
                    call!


SPRINT:
     Sprint, also known as SPC, was one of the first LD services.
     The codes for SPC are 8 digits long.  SPC is not considered 
safe.  It is common knowledge that Sprint has declared war on phone 
phreaks.  So, fight back (with care)!

 {914 dial-up--> (914) 997-1616}


METROFONE:
     Metrofone, owned by Western Union, is very popular among phone 
phreaks due to the large abundance of codes and it is considered 
fairly safe.
     Recently, Metrofone has allegedly been placing "trap codes" on 
BBS's which are being traced.  I suggest that you hack your own for 
safety purposes.
     The code is 6 digits long.  To find out the local dial-up for 
your area, just call (800) 325-1403 and ask the "nice lady" for the # 
for your area.

At tone--> code+A/C+destination #

NOTE:  A/C is an abbreviation for area code.

ITT:
     ITT is a little different in that upon hearing the dial tone 
after calling the local access #, you enter the a/c and then the #.  
You will then hear a short tone, you then immediately enter your 7 
digit access code.

{dial-ups:(212)248-0151, (914)997-8576}

             At tone, destination # + 7 digit access code.


MCI:
     MCI has dial-ups in most areas but the codes are not inter
changeable (ie, a code that works for the New York dial-up will NOT 
work for the Boston dial-up).

1.  Dial your MCI access number and authorization code (code = 14 
    digit number, however the first 10 digits are the card holders 
    NPA+PRE+SUFF).
2.  Dial 011
3.  Dial the country code
4.  Dial the city code and the PRE+SUFF that you want.

                            COUNTRY CODES

Country                      code|Country                       code
---------------------------------|----------------------------------
Algeria......................213 |New Zealand....................64
Argentina....................54  |Northern Ireland...............44
Australia....................61  |Oman...........................968
Belgium......................32  |Papua New Guinea...............675
Brazil.......................55  |Qatar..........................974
Canada............Use Area Codes |Saudi Arabia...................966
Cyprus.......................357 |Scotland.......................44
Denmark......................45  |Senegal........................221
Egypt........................20  |South Africa...................27
England......................44  |Sri Lanka......................94
German Democratic Republic       |Sweden.........................46
(East Germany)...............37  |Taiwan.........................886
Greece.......................30  |Tanzania.......................255
Jordan.......................962 |Tunisia........................216
Kenya........................254 |United Arab Emirates...........971
Kuwait.......................965 |Wales..........................44
Malawi.......................265 |
====================================================================

For local calling:

     1.  Dial 950-1022 or 1-800-624-1022
     2.  Wait for tone
     3.  Dial "0", the area code, the phone number, and the 14 digit 
authorization code.  You will hear 2 more tones that let you know you 
are connected.

MCI CREDIT CARD (MCI CC):
     This MCI service also known as MCI Execunet, is for people who 
travel a lot (ie, business pigs) & need a code that works in several 
places.  Therefore, the codes on this system are interchangeable 
throughout the dial-ups unlike the regular MCI service.

    FORMAT:  At tone, 7 digit access code + destination #.

{212 dial-up: 248-0151}

NOTE:  You can usually call up the companies customer service #, and 
       say you just moved or that you are traveling and ask for the 
       access # for your area code.  To find out the customer service 
       # call dir. asst. at (800) 555-1212.


                            950 Exchange
                            ------------

     The 950 exchange is a nationwide access exchange, in most areas, 
that includes several SCC's.  All services on this exchange are con
sidered dangerous due to the fact that they have the ability to 
trace.  The currently working numbers in many metropolitan areas in 
the US are:
     950-1000  SPC (Sprint)
        -1022  MCI Execunet
        -1033  US Telephone
        -1044  AllNet
        -1066  Lexitel
        -1088  Skyline

     This exchange will probably be phased out when customers choose 
their LD carrier as a result of "equal access."

SKYLINE:

     SBS Skyline is a new service owned by IBM, Comsat and AEtna.  It 
has the same local access # across the country: 950-1088.  It is 
supposed to have 6 (possibly 8) digit codes and is alleged to be very 
dangerous.
     Most of the services in 950 have crystal clear connections.

Calling Cards

     Calling cards are Bell's version of Sprint, MCI, etc.  Calling 
cards are used primarily from pay fones.  The format is:

                          NPA-NXX-XXXX-CCCC

     NPA is usually the a/c of the billed # that the call is to be 
billed to. This may be replaced by a 3 digit RAO (Revenue Accounting 
Office) code in some NPA's or a special billing number.
     NXX-XXXX is the number that the call is to billed to.
     CCCC is a checkcode (or PIN--Personal Identification Number) 
that adds the security to Calling Cards.  The codes used to be pre
dictable until 1983.  Now CCCC appears to be sequentially generated 
so the codes cannot be calculated from a formula!
     The easiest way to find these codes are in a busy airport or 
college where they are used alot.  Just get close and copy down some
one's code (if you are that unscrupulous!)  Don't rip off poor 
people; go for the rich business pigs!
     You usually call the operator to make a CC Call but on many 
fortress fones, you can dial 0+the number you want to call and you 
will get a recording & tone where you enter your calling card #.  By 
pressing the # sign (octothorpe) after each call instead of hanging 
up, you can make many calls at once without having to retype the CC # 
each time.  This is good for busy numbers. Also, if you want to call 
the # of the card, ie the billed #, you just have to enter the last 4 
digits of the CC # at the tone.
     Now, suppose you do get a real operator.  Since mostly business 
people use calling cards, it is suggested that you act a little like 
a business person, ie, rushed, older, businesslike, and SLIGHTLY 
pissed at the operator (keyword: SLIGHTLY).  All you have to tell her 
is the CC #.  If she asks for the # you are calling from, tell her, 
but change the last digit or 2.  If she asks you more questions, she 
is probably suspicious.  Hang up.  You should make up some answers to 
certain questions to satisfy the operator that you are legit, though.  
The most important thing you should know when making a CC call is the 
area code and the city of the card.
     Finally, in case the operator is listening, always talk busi
nesslike for the first few seconds until the operator clicks off 
[they have been known to listen in on calls (understatement)].  Also, 
always use CC's from pay fones or Charge-A-Call fones only!
     CAUTION:  All the CC codes are now rapidly checked due to CCIS 
(Common Channel Inter-office Signaling) and ESS (Electronic Switching 
System) If you try to hack CC codes you can be fairly sure that Bell 
Security (affectionately known as the Gestapo in the phreaking world) 
will get a message from the CO (Central Office, ie, exchange)!
There is also an international code that is in the format of:

                         1A  NPA NXX XXXX 9

Where:  1A is a digit followed by a letter (check characters)

NPA NXX XXXX is the # that the call is to billed to (same as above)

9 is an check digit

     The international code is used only when calling from a foreign 
country.
     AT&T has just recently released real plastic calling cards with 
the domestic & international codes printed on the front along with 
the persons name.  These cards also have a magnetic strip on the back 
that can be read by their new Calling Card fones that contain a built 
in CRT & will accept AT&T cards as well as American Express.  These 
fones should be popping up in airports & other places where large 
numbers of business pigs hang out.


                            800 Services
                            ------------

     You are probably all familiar with WATS. WATS #'s (Wide Area 
Telephone Service, otherwise known as 800 #'s) are very popular due 
to the fact that they are toll-free.  They often contain WATS exten
ders. Extenders were originally used by salesmen in the field who 
called up their company's 800 # (INWATS #) and then used the com
pany's low-priced OUTWATS line to make the call.  This is cheaper to 
the company than using the Bell calling card which has a surcharge.
     On the original extenders there were no codes!  Companies soon 
realized that their #'s were being used and added the present day 
security codes.  The salesman would then dial the 800 number and 
enter the code (usually 4 digits), he would then receive a second 
dial tone from the companies PBX (Private Branch eXchange - their own 
switching equipment).  He would then access the OUTWATS line by 
dialing 8 or 9 and then the #.  These codes were originally hand-
hacked, but a pioneer phreak added an interface to his Apple ][ com
puter, which was capable of generating DTMF tones (Dual-Tone-Multi-
Frequency - generic term for Touch-Tone (TM)) and trying all the 
codes.  The only problem was that Ma Bell got suspicious when they 
saw that someone called a company's 800 # in California 4,568 times 
at 2 AM and each call lasted for only 1 second!

TRAVELNET:
     Travelnet is a service, owned by GM, that uses WATS as well as 
local access #'s.

The 800 # is (800) 521-8400.

     After the tone, enter the 8 digit code, if the code was right 
you'll get a second tone, then enter the area code and number.
     Travelnet is also unique in that it accepts voice recognition 
for those times when touch-tone is not available (How convenient!). 
If you don't do anything after the tone, you will hear a voice that 
says, "authorization #, please."  You then say each digit SLOWLY.  It 
will beep after you say each digit.  After each group of digits, it 
will repeat what you have said.  Say yes if it is right, otherwise, 
say no.  If the authorization code is correct, it will say thank you 
and it'll then ask for the destination #.  Follow the same procedure 
as above.  The voice system is very user friendly and you should have 
no problems with it.

TEL-TEC:
     TEL-TEC is at (800) 323-3026. In my experiences, you usually get 
a very shitty connection.  This I use for last resorts.

    FORMAT:  6 digit code + dest. #

Tel-Tex (for TX only):  (800) 432-2071

CAUTION:  Like the 950 exchange, 800 numbers can be easily traced.
          This doesn't mean that they trace everything, though.


Others:
     There are many other 800 services and PBX's (such as the Dimen
sion 2000 at 800-848-9000).  There is just not enough room to discuss 
them all.  As you have probably noticed, I have posted no codes.  
Check the phreak section of various BBS's to find the latest codes or 
hack them yourself.  I suggest that you don't use codes found on 
BBS's, though, since they may be traps!  Hand-hack good possibilities 
or use a "smart" modem with a hacking program (contact your local 
pirate).  

                  HOW MA BELL CATCHES PHONE HACKERS
                  ---------------------------------

     Besides suspicion and random checks, Ma Bell sets up "trap num
bers".  Trap numbers were set up on certain dial-ups such as Sprint, 
MCI, etc.  Whenever the dial-up is called a "trouble card" is dropped 
at the central office.  This means that a record of the called #, the 
callers #, and time are printed out.  These cards (or printouts in an 
ESS CO) are usually ignored unless SPC or somebody detects fraud, ie, 
unauthorized use of a customers acct., then they call Bell and find 
out the name and number and instantly nail the phreak who made the 
call.  They will then either demand that you pay some enormous fee 
and they'll forget the whole matter; give them info on other phreaks, 
boards, etc.; or prosecute you on the federal rap of Theft of Commu
nications service, which carries fines of up to 10 years in jail 
and/or $10,000.  They usually don't go for legal action first, 
though.  If you don't actually use any codes, they can still nail you 
for harassing fone calls.  
     "Trap & Trace" is another favorite.  With this method you cannot 
hang up until the trace is completed!  Why does Bell help their com
petition?  Well, people were using Sprint to break into Bell's ESS 
computers.  Bell could only trace the call back to Sprint.  So, 
Sprint helps Bell catch the people it wants and visa-versa.  
     By the way, trap numbers are also how Bell catches people who 
make harassing phone calls to private residences.
     Also, certain Telco exchanges running ESS  generate reports 
called the "800 Exceptional Calling Report" which list people who 
have made extensive or long calls to 800 #'s.  Since many people use 
legit 800's alot, they also wind up on the list.  If Bell does have a 
certain problem with an 800 #, though, they just have to check their 
records.
     If Bell has sufficient reason to suspect you of illegal activi
ties, they may put a pen register on your line to record EVERY single 
digit you dial along with other pertinent information.
     Finally, do not forget that these services have a copy of the 
number that you called.  So, if a customer says he didn't call a 
certain #, they will usually call up that # and try to find out who 
did call at that time.  So, to be safer on SPC, MCI, and others, 
follow the following suggestions:
     1) Use a fortress fone (pay fone) whenever possible.  Although, 
they have been know to stake out pay fones.  Just don't use the same 
fone over and over again.  In other words, move around.
     2) Only call institutional switchboards, business that have no 
record of your call, and friends who are instant amnesiacs.
     3) Try to keep all calls under 15 minutes when possible.
