==============================================================================
========== TAP MAGAZINE ISSUES 1-5 COURTESY OF PPS:206-783-9798 ==========
==============================================================================
EXCHANGE SCANNING (99XX)
Almost every exchange in the Bell System has test #'s and other "goodies" such
as loops with dial-ups.
These "goodies" are usually found between 9900 and 9999 in your local exchange.
If you have the time and initiative, scan your exchange and you may become
lucky!
Here are my findings in the 914-268 exchange:
9901 - Verifaction (recording of a/c and exchange)
9927 - Osc. tone (possible tone side of a loop)
9936 - Voice # to the telco central office
9937 - Voice # to the telco central office
9941 - Computer (digital voice transmission?)
9960 - Osc. tone (tone side loop -- may also be a computer in some exchanges
9961 - No response (other end of loop?)
9962 - No response (other end of loop?)
9963 - No response (other end of loop?)
9966 - Computer (see 9941)
9968 - Tone that disappears--responds to certain touch tone keys
What you find depends upon the switching equipment in the exchange and the
Telco operating company.
Since I have done the above 914-268-99XX scan, Congers (268) has installed new
switching equipment (DMS100). Some of the numbers are the same, but I have
noticed that on the DMS100, the recordings are also stored in this area.
268-9903, 9906, & 9912 are all different recordings. Also, there are 2
fortress fone recordings at 268-9911 (deposit 5 cents or else) and 268-9913
(deposit 10 cents).
In some areas (like Delaware), I have noticed that 9906-7 is ringback. If you
find anything interesting, be sure to drop TAP a line.
Have phun and remember it's only local call to see what your CO has in store
for you!
F.T.B.S.
*****BIOC
*=$=*Agent
*****003
------------------------------------------------------------------------------
HIGHWAY RADAR JAMMING
Most drivers wanting to make better time on the open road will arm
themselves with an expensive radar detector. However this device will not work
against a gun type radar unit in which the radar signal is not present until
the cop has you car in his sights and pull the trigger. Then it is too late to
slow down.
A better method is to continously jam any signal with a radar signal of your
own. I have tested this idea with the cooperation of a local cop and found that
his unit reads random numbers when your car approached him. It is suprisingly
easy to make a low power radar transmitter. A nifty little semiconductor
called a Gunn diode will generate microwaves when supplied with 5 to 10 vdc and
enclosed in the correct size cavity (resonator). An 8 to 3 terminal regulator
can be used to get this voltage from a car's system. However the correct
construction and tuning of the cavity is difficult without good microwave
measurement equipment. Police radars commonly operate on the K band at 22 ghz.
or more often on the X band at 10.525 ghz. Most microwave intruder alarms and
motion detectors (mounted over automatic doors in supermarkets, etc.) contain a
Gunn type transmitter/receiver combination that transmits about 10 milliwatts
at 10.525 ghz. These units work perfectly as jammers. If you can't get one
locally write to Microwave Associates in Burlington, Mass. and ask for info on
"Gunnplexers" for ham radio use. When you get the unit it may be mounted in a
plastic box on the dash or in a weatherproof enclosure behind the plastic
grille. Switch on the power when on the open highway. The unit will not jam
radar to the side of behind the car so don't go speeding past the radar trap.
An interesting phenomena you will notice is that drivers in front of you who
are using detectors will hit their brakes as you approach large metal signs or
bridges. Your signal is bouncing off these objects and triggering their
detectors.
Have fun... Ben Piper
Reprinted from: TAP magazine, November 1983, Issue 88
------------------------------------------------------------------------------
VENDING MACHINE KEYS
By The Pyro
This worked for a friend of mine at school (I would) never do anything like
this) it got him over $900 in one day.
Here's how to do it:
On almost all vending machines they have those damn round almost unpickable
locks on them so:
When no one is looking quickly press a piece of AIR-HARDENING clay into the
lock. (Press hard enough to get a good impression.)
Remove the clay carefully and let it dry for however long the clay has to dry
as specified on the package.
You now have a key to fit that lock, (this Type of 'key' can be easily crushed
if you're seen. But if you're smart you won't though)
Have Phun!!
Reprinted from: TAP magazine, December 1983, Issue 89
------------------------------------------------------------------------------
Department Store Fun reprinted from TAP Magazine. By Agent 81.
Many of the department stores in my area use a large plastic device stapled
to the clothing as a security precaution. Several years ago, an adventurous
friend of mine got ahold of one of thes somehow, and we took it apart. Inside
was a heavy paper strip laminated to aluminum foil (?). As I recall, this
paper strip was about half an inch wide and 3-1/2 inces long. When this device
got close to a pillar or column at the exits of a store, an alarm would sound.
My friend put this paper in his wallet, and we had a lot of fun wandering
in and out of various stores at a local shopping center. We would enter when
a group of people would enter, or exit with several other shoppers all
together.. When we entered a local Sears in the shopping center in the main
corrider of the indoor mall, a loud bell rang. A family with kids was just
leaving. The nearest clerk ran out the entrance to look at everyone standing
around. A plain clothes security guy appeared out of nowhere. Everyone had
a good time. The next store we went in was also packed with people and the
manager (?) got paranoid when the alarm went off. If you move about discreetly
and don't wear a jacket or coat, you can liven up the busiest of stores. But
don't go into an empty store with one of these in your wallet. That's a no-no.
Could pleas secure a quantity of these paper strips and send them out with
your next issue? Or offer them for sale? They can be great fun, especially in
a Xmax shopping mob. The one we had came unlaminated and wouldn't work any
more. This might be a great money maker for TAP. You may even want to devote
an entire issue to this neat gadget. These strips could be left inside candy
wrappers and in the bottem of a coke cup and placed near these detector columns
or pillars. Put one in a plant near a pillar. The uses and fun could be end-
less. A good senior class project would be to freak out every alarm in every
store so equiped, at 2 PM some Saturday afternoon when the mall is really
packed.
Please have your security committee go to work on getting a couple million
of these things so that everyone can have several. It's more fun than going to
the movies.
------------------------------------------------------------------------------
Verification
By Fred Steinbeck
From TAP issue # 88 10-83
There has been a great deal of controversy in the realm of phreakdom over a
mysterious subject known under a number of different names, including
"Verification", "Autoverification", "Verify", "Autoverify", "Verify Busy", and
even "VFY BY". All of these names basically mean the same thing: the ability
to listen to another person's telephone line from any telephone in the direct-
dialable world.
Needless to say, Bell System is very tight lipped about knowledge regarding
verification. Indeed, the infamous book 'Notes on long distance dialing' ('68
edition) says, "Care must be taken to insure that the customer never gains
verification capabilities." With a printed policy like that, you can imagine
what their real-world policy is like! Even their own rate and route operators
will not give verification on routing codes (at least in my experience), one
even responding, "What?! You must be crazy! We don't give those out!"
Before you get too far into this article, I will state simply: I don't know
how to verify. However, I have been fooling with various things related to it,
and collecting information on it for some time now. Therefore, while I can't
do it (yet), I may be able to point some other bright TAPer on the right track,
and perhaps he or she will show us all how. If you have knowledge not covered
in this article, but don't want to write an article on your own, please send
your ideas, comments, or information to Project Verify, C/O TAP
Verify has also been called "Autoverify", and I have no idea why. This is
not, to my knowledge, a Bell System term (at least I've never seen it in any
manuals) As far as I know, there is verify, which means being able to listen
to speech (kind of; see below) on a line, and there is the "Emergency Interrupt
which allows you to take part in the conversation taking place on the line in
question. It has been suggested that "Autoverify" is the same as an emergency
interrupt , but I tend to disagree with this idea. It should be noted that
the verification circuitry does not actually let anoperator listen to a conver-
sation without making a beep on the line every so often. Instead, she will
hear encrypted sheech. However, I believe with the proper methods, verify can
be converted to an emergency interupt.
Verification is normally done either by your normal "0" (TSPS) operator, if
the call is in your home NPA (HNPA), or by an inward operator (IO). If the
call is outside your HNPA, your normal operator will call the IO for the NPA,
and say, "Verify Busy" or "Emergency Interrupt" please, 555 1212." The IO will
perform whatever magic he or she must, and then reprot back. If the call is in
your HNPA, though, the "0" operator can do the verification himself by using
the "VFY BY" key on her keyshelf. However, in some areas, the operator uses a
routing code to accomplish verification, and this the loop hole we shall
attack.
It follows that if a IO or "0" operator can do it, so can we, with a blue box
Now, courtesy of Robert Allen (who brought it to my attention) and Susan
Thunder (who apparently discovered it), here is what used to work for getting
operators to hook you into conversations with other perople (i.e.,let you lis-
ten to them till you hung up): You'd call the operator and say "Operator, TSPS
Maintenance Engineer Calling. Ring forward to 001 + NPA + 7d, ring back to my
number, hit ring forward, no AMA, and then position release.
This creates some problems, and you must be familiar with the TSPS console
(by dialing "0"), you are on the "back", or incoming part of a loop. When she
places a call for you, the call goes out on the "forward", or outgoing part of
the loop. If an operator wants to make a call, she punches KP FWD (keypulse
forward), the number, and ST. Ring FWD puts a 90 volt ringing signal across
the forward part of the line (and may dial the number as well). The problem
arises from the fact that I don't know if Ring FWD will actually dial a call,
and if there is some other subtle difference between it an KP FWD.
Let us assume ringing forwad makes a call from the TSPS console to whatever
number is given. Ring back causes your phone to ring (it is assumed you hung
up after giving her your instructions; if you didn't you'd hear an annoying
90 volts across the earpiece...) "No AMA" means "no automatic message account-
ing", so nobody gets billed for the call, although it will show up on a tape
somewhere. "Position Release" removes the operator from the ciruit, and allows
her to receive other calls. This leaves an unaccounted-for ring forward.
The verification ciruit, as you know, likes to encrypt coversation, whic is
something we don't want. Well, the second Ring FWD sends another 90 volts
crashing against the verify ciruitry, which Juda Gerad thinks removes the voice
encryption from the line, puts the operator (and you) in circuit, and puts a
beep tone on the line every five seconds. This seems to make sense, and I am
inclined to agree with him.
The bit about "....001 + NPA + 7D" causes the thought "MF routing code" to
spring immediately to mind. Now, the above trick was supposed to work in the
213 NPA. I have tried both "KP+001+213+7D+ST", and some other area codes. I
generally get nothing, a reorder signal, or a tandem recording.
Here's some food for thought: On an official Telcoo sheet I have, labeled "
213 NPA MF Routing Codes", 001 is listed as "VFY BY", or verify busy for the
213 NPA. 002 is listed for the 805 NPA. Ma Bell likes to have standardized
routing codes, such logical, then, that 001 would be a sort of "standard"
verify code, and other prefixes would be tacked on at 002,003, etc. However, I
have heard from a retired operator that verification codes ar different from
area to area, and are not always nice numbers like 001, 002. Ah, well, a guy
can hope, can't he?
Some suggestions for future attacks on this dilemma: Everyone call your
operators and subtley ask questions. I have found the tend to give information
out easier if you ask for something that you would ordinarily have to be a
company employee to know about, such as rate steps, operator routings, etc.
Casually let slip that you used to be (or still are) an operator, or that you
work for company security. Also, you might want to blue box some codes like
001 followed by your NPA and the last 7D of a busy number. If you get a sort
of "whispery noise", try blasting the line with a ringing signal (you might
piggyback another line onto yours and call the piggyback to generate the 90
volts) and see if that does anything. Don't forget tos send in any scraps of
info, no matter how mundane to
Project Verify
c/o TAP
Room 603, 147 west 42 St.
New York City,
10036
|