Friday, April 20, 2012

Hacking TRW by the Jolly Roger

Hacking TRW                                      by the Jolly Roger

    When you call TRW, the dial up will identify itself with the message "TRW".
It will then wait for you to type the appropiate answer back (such as CTRL-G)
 Once This has been done, the system will say "CIRCUIT BUILDING IN PROGRESS"
Along with a few numbers. After this, it clears the screen
(CTRL  L) followed by a CTRL-Q. After the system sends the CTRL-Q, It is
ready for the request. You first type the 4 character identifyer for the
geographical area of the account..

(For Example) TCA1 - for certain Calif. & Vicinity subscribers.
TCA2 - A second CALF. TRW System.
TNJ1 - Their NJ Database.
TGA1 - Their Georgia Database.

The user then types A <CR> and then on the next line, he must type
his 3 char. Option. Most Requests use the RTS option.
OPX, RTX, and a few others exist. (NOTE) TRW will accept an A, C,
or S as the 'X' in the options above.) Then finally, the user types his 7
digit subscriber code. He appends his 3-4 character password after it.  It
seems that if you manage to get hold of a TRW Printout (Trashing at Sears,
Saks, ETC. or from getting your credit printout from them) Their subscriber
code will be on it leaving only a 3-4 character p/w up to you.

For Example,
(Call the DialUp)
TRW  System Types, ST) CTRL-G
(You type,YT) Circuit building in progress 1234
(ST) CTRL-L CRTL-Q (TCA1 CYT) BTS 3000000AAA
<CR><CRTL-S> (YT]
Note: This sytem is in Half Duplex, Even Parity, 7 Bits per word and
2 Stop Bits.

CAUTION: It is a very stressed rumor that after typing in the TRW
password Three (3) times.. It sets an Automatic Number Identification on your
ass, so be careful. And  forget who told you how to do this..

                                     -= Exodus =-


Canadian WATS Phonebook courtesy of the Jolly Roger

Canadian WATS Phonebook                courtesy of the Jolly Roger

800-227-4004 ROLM Collagen Corp.
800-227-8933 ROLM Collagen Corp.
800-268-4500 Voice Mail
800-268-4501 ROLM Texaco
800-268-4505 Voice Mail
800-268-6364 National Data Credit
800-268-7800 Voice Mail
800-268-7808 Voice Mail
800-328-9632 Voice Mail
800-387-2097 Voice Mail
800-387-2098 Voice Mail
800-387-8803 ROLM Canadian Tire
800-387-8861 ROLM Canadian Tire
800-387-8862 ROLM Canadian Tire
800-387-8863 ROLM Canadian Tire
800-387-8864 ROLM Canadian Tire
800-387-8870 ROLM Halifax Life
800-387-8871 ROLM Halifax Life
800-387-9115 ASPEN Sunsweep
800-387-9116 ASPEN Sunsweep
800-387-9175 PBX [Hold Music=CHUM FM]
800-387-9218 Voice Messenger
800-387-9644 Carrier
800-426-2638 Carrier
800-524-2133 Aspen
800-663-5000 PBX/Voice Mail [Hold Music=CFMI FM]
800-663-5996 Voice Mail (5 rings)
800-847-6181 Voice Mail

NOTES:  Each and every one of these numbers is available to the 604
(British Columbia) Area Code.  Most are available Canada Wide and some
are located in the United States.  Numbers designated ROLM have been
identified as being connected to a ROLM Phonemail system.
Numbers designated ASPEN are connected to an ASPEN voice message system.
Numbers designated VOICE MAIL have not been identified as to equipment
in use on that line.  Numbers designated carrier are answered by a modem
or data set. 
Most Voice Message systems, and ALL Rolms, sound like an answering machine.
Press 0 during the recording when in a rolm, * or # or other DTMF in other
systems, and be propelled into another world...

Brought to you in the Cookbook IV by Exodus!!!!!!!!!!!!!!!!



Bell Trashing by the Jolly Roger

Bell Trashing                                   by the Jolly Roger

     The Phone Co. will go to extreams on occasions. In fact, unless
you really know what to expect from them, they will suprise the heck
out of you with their "unpublished tarriffs". Recently, a situation
was brought to my attention that up till then I had been totaly
unaware of, least to mention, had any concern about. It involved gar-
bage! The phone co. will go as far as to prosecute anyone who rumages
through their garbage and helps himself to some
     Of course, they have their reasons for this, and no doubt benefit
from such action. But, why should they be so picky about garbage? The
answer soon became clear to me: those huge metal bins are filled up
with more than waste old food and refuse... Although it is Pacific
Tele. policy to recycle paper waste products, sometimes employees do
overlook this sacred operation when sorting the garbage.  Thus
top-secret confidential Phone Co. records go to the garbage bins
instead of the paper shredders. Since it is constantly being updated
with "company memorandums, and supplied with extensive reference
material, the Phone co. must continualy dispose of the outdated
materials. Some phone companies are supplied each year with the
complete "System Practices" guide. This publication is an over 40
foot long library of reference material about everything to do with
telephones. As the new edition arrives each year, the old version of
"System Practices" must also be thrown out.
    I very quickly figured out where some local phone phreaks were
getting their material. They crawl into the garbage bins and remove
selected items that are of particular interest to them and their
fellow phreaks. One phone phreak in the Los Angeles area has salvaged
the complete 1972 edition of "Bell System Practices". It is so large
and was out of order (the binders had been removed) that it took him
over a year to sort it out and create enough shelving for it in his
garage.
     Much of this "Top Secret" information is so secret that most phone
companies have no idea what is in their files. They have their hands
full simply replacing everything each time a change in wording
requires a new revision. It seems they waste more paper than they can
read!
     It took quite a while for Hollywood Cal traffic manager to figure
out how all of the local phone phreaks constantly discovered the
switchroom test numbers
     Whenever someone wanted to use the testboard, they found the local
phone phreaks on the lines talking to all points all over the world.
It got to the point where the local garbage buffs knew more about the
office operations than the employees themselves. One phreak went so
far as to call in and tell a switchman what his next daily assignment
would be. This, however, proved to be too much. The switchman
traced the call and one phone phreak was denied the tool of his trade.
     In another rather humorous incident, a fellow phreak was rumaging
through the trash bin when he heard somone apraoching. He pressed up
against the side of the bin and silently waited for the goodies to
come. You can imagine his surprise when the garbage from the lunchroom
landed on his head. Most people find evenings best for checking out
their local telco trash piles. The only thing necessary is a
flashlight and, in the case mentioned above, possibly a rain coat. A
word of warning though, before you rush out and dive into the trash
heap. It is probably illegal, but no matter where you live, you
certainly won't get the local policeman to hold your flashlight for
you.
                              -= Exodus =-


Silver Box Plans by the Jolly Roger

Silver Box Plans                                 by the Jolly Roger

Introduction:
------------
     First a bit of Phone Trivia. A standard telephone keypad has 12 buttons.
These buttons, when pushed, produce a combination of two tones. These tones
represent the row and column of the button you are pushing.
            1   1   1
            2   3   4
            0   3   7
            9   6   7
     697   (1) (2) (3)
     770   (4) (5) (6)
     851   (7) (8) (9)
     941   (*) (0) (#)
So (1) produces a tone of 697+1209, (2) produces a tone of 697+1336, etc.

Function:
--------
     What the Silver Box does is just creates another column of buttons,
with the new tone of 1633. These buttons are called A, B, C, and D.

Usefulness:
----------
     Anyone who knows anything about phreaking should know that in the
old days of phreaking, phreaks used hardware to have fun instead of other
people's Sprint and MCI codes. The most famous (and useful) was the good
ol' Blue Box. However, Ma Bell decided to fight back and now most phone systems
have protections against tone-emitting boxes. This makes boxing just
about futile in most areas of the United States (ie those areas with Crossbar
or Step-By-Step). If you live in or near a good-sized city, then your phone
system is probably up-to-date (ESS) and this box (and most others)
will be useless. However, if you live in the middle of nowhere (no offense
intended), you may find a use for this and other boxes.

Materials:
---------
     1  Foot of Blue Wire
     1  Foot of Grey Wire
     1  Foot of Brown Wire
     1  Small SPDT Switch (*)
     1  Standard Ma Bell Phone
(*) SPDT = Single Pole/Double Throw

Tools:
-----
     1  Soldering Iron
     1  Flat-Tip Screwdriver

Procedure:
---------
(1) Loosen the two screws on the bottom of the phone and take the casinf off.
(2) Loosen the screws on the side of the keypad and remove the keypad from
the mounting bracket.
(3) Remove the plastic cover from the keypad.
(4) Turn the keypad so that *0# is facing you. Turn the keypad over. You'll see
a bunch of wires, contacts, two Black Coils, etc.
(5) Look at the Coil on the left. It will have five (5) Solder Contacts
facing you. Solder the Grey Wire to the fourth Contact Pole from the left.
(6) Solder the other end of the Grey Wire to the Left Pole of the SPDT Switch.
(7) Find the Three (3) Gold-Plated Contacts on the bottom edge of the keypad.
On the Left Contact, gently seperate the two touching Connectors (they're
soldered together) and spread them apart.
(8) Solder the Brown Wire to the Contact farthest from you, and solder the
other end to the Right Pole of the SPDT Switch.
(9) Solder the Blue Wire to the Closest Contact, and the other end to the
Center Pole of the SPDT Switch.››(10) Put the phone back together.

Using The Silver Box:
--------------------
     What you have just done was installed a switch that will change
the 369# column into an ABCD column. For example, to dial a 'B', switch
to Silver Box Tones and hit '6'.
     Noone is sure of the A, B, and C uses. However, in an area with an
old phone system, the 'D' button has an interesting effect. Dial Directory
Assistance and hold down 'D'. The phone will ring, and you
should get a pulsing tone. If you get a pissed-off operator, you have a
newer phone system with defenses against Silver Boxes.
At the pulsing tone, dial a 6 or 7. These are loop ends.

                                        -= Exodus =-


Scarlet Box Plans by the Jolly Roger

Scarlet Box Plans                               by the Jolly Roger

   The purpose of a Scarlet box is to create a very bad conection,
it can be used to crash a BBS or just make life miserable for those you
seek to avenge.
Materials: 2 alligator clips, 3 inch wire, or a resister
(plain wire will create greatest amount of static)
(Resister will decrease the amount of static in porportion to
the resister you are using)

Step (1): Find the phone box at your victims house, and pop the cover off.
Step (2): Find the two prongs that the phone line you wish to box are
connected to.
Step (3): Hook your alligator clips to your (wire/resister).
Step (4): Find the lower middle prong and take off all wires connected to
it, i think this disables the ground and call waiting and shit like that.
Step (5): Now take one of the alligator clips and attach it to the upper
most prong, and take the other and attach it to the lower middle prong.
Step (6): Now put the cover back on the box and take off!!

   **       ######## **
   **       # #### #      **
            ########       /
            # #### #      /
            ########     /
                        /
                       /
                      /
                     /
                    /
                   /
                  /
               **/
               **
               **
               **
               **
               **

(**)= prongs
 **
(/) = (wire/resister)
(##)= some phone bullshit

                                 -= Exodus =-


[__RemObS_________________________] by the Jolly Roger

[__RemObS_________________________]             by the Jolly Roger

Some of you may have heard of devices called Remobs which stands
for Remote Observation System. These Devices allow supposedly
authorized telephone employees to dial into them from anywhere, and
then using an ordinary touch tone fone, tap into a customer's line
in a special receive only mode. [The mouthpiece circuit is
deactivated, allowing totally silent observation from any
fone in the world (Wire tapping without a court order is against
the law)]

[__How Remobs Work______________]
Dial the number of a Remob unit.  Bell is rumored to put them in the
555 information exchanges, or on special access trunks
[Unreachable except via blue box].  A tone will then be heard
for approximately 2 seconds and then silence.  You must key in
(In DTMF) a 2 to 5 digit access code while holding each digit down
at least 1 second.  If the code is not entered within 5 or 6 seconds,
the Remob will release and must be dialed again.  If the code is
supposedly another tone will be heard.  A seven digit subscriber
fone number can then be entered [The Remob can only handle certain
'exchanges' which are prewired, so usually one machine cannot
monitor an entire NPA].  The Remob will then connect to the
subscribers line.  The listener will hear the low level idle tone
as long as the monitored party is on hook.  As the monitored party
dials [rotary or DTMF], the listener would hear [And Record]
the number being dialed.  Then the ENTIRE conversation, datalink,
whatever is taking place,  all without detection.  There is no
current box which can detect Remob observation, since it is being done
with the telephone equipment that makes the connection.  When the
listener is finished monitoring of that particular customer,  he keys
the last digit of the access code to disconnects him from the
monitored line and return to the tone so that he can key in another
7 digit fone #.  When the listener is totally finished with the Remob,
he keys a single 'disconnect digit' which disconnects him from the
Remob so that the device can reset and be ready for another caller.

[_History of Remobs_______________]
     Bell has kept the existance of Remobs very low key.  Only in
1974, Bell acknowledged that Remobs existed.  The device was
first made public during hearings on "Telephone Monitoring Practices
by Federal Agencies" before a subcommittee on government
operations.  House of Representatives, Ninety-Third Congress, June
1974.
It has since been stated by Bell that the Remob devices
are used exclusively for monitoring Bell employees such as operators,
information operators, etc., to keep tabs on their performance.
[Suuureee, were stupid]

[__Possible Uses for Remobs__]
     The possible uses of Remobs are almost as endless as the uses
of self created fone line.  Imagine the ability to monitor bank lines
etc, just off the top of my head I can think of these applications:

     Data Monitoring of:
TRW
National Credit Bureau
AT&T Cosmos
Bank Institutions
Compuserve and other Networks.
     Voice Monitoring of:
Bank Institutions
Mail Order buisnesses.
Bell Telephone themselves.
Any place handling sensitive or important information.
Anyone that you may not like.

     With just one Remob, someone could get hundreds of credit cards,
find out who was on vacation, get compuserve passwords by the dozens,
disconnect peoples fones, do credit checks, find out about anything
that they may want to find out about.  Im sure you brilliant
can see the value of a telephone hobbiest and a telecommunications
enthusist getting his hands on a few choice Remobs. <Grin>

[_Caution________________________]
   If any reader should discover a Remob during his (or her) scanning
excursions,  please keep in mind the very strict federal laws
regarding wiretapping and unauthorized use of private Bell property.

                            -= Exodus =-



Red Box Plans by the Jolly Roger

Red Box Plans                                   by the Jolly Roger

Red boxing is simulating the tones produced by public payphones when you
drop your money in. The tones are beeps of 2200 Hz + 1700 Hz
Nickle = 1 beep for 66 milliseconds.
Dime = 2 beeps, each 66 milliseconds with a 66 millisecond pause between
beeps.
Quarter = 5 beeps, each 33 milliseconds with a 33 millisecond
pause between beeps.

There are two commonly used methods being used by Phreaks to make free calls.
1. An electronic hand-held device that is made from a pair of Wien-bridge
oscillators with the timing controlled by 555 timing chips.
2. A tape recording of the tones produced by a home computer. One of
the best computers to use would be an Atari ST. It is one of the easier
computers to use because the red box tones can be produced in basic with only
about 5 statments.

                            -= Exodus =-


The Phreak file courtesy of the Jolly Roger

The Phreak file                            courtesy of the Jolly Roger

202 282 3010 UNIV. OF D.C.           
202 553 0229 PENTAGON T.A.C.         
202 635 5710 CATHOLIC UNIV. OF AMERICA
202 893 0330 DEFENSE DATA NETWORK    
202 893 0331 DEFENSE DATA NETWORK    
202 965 2900 WATERGATE               
203 771 4930 TELEPHONE PIONEERS      
206 641 2381 VOICE OF CHESTER        
212 526 1111 NEW YORK FEED LINE      
212 557 4455 SEX HOT LINE            
212 799 5017 ABC NY FEED LINE        
212 934 9090 DIAL-AN-IDIOT           
212 976 2727 P.D.A.                  
212 986 1660 STOCK QUOTES            
213 541 2462 STOCK MARKET REPORTS    
213 547 6801 NAVY SHIPS INFO         
213 576 6061 "     "                 
213 664 3321 NEWS FOR THE BLIND      
301 393 1000 "     "                 
301 667 4280 LOTTERY INFO            
312 939 1600 "  "                 
404 221 5519 NUCLEAR COMMISSION      
408 248 8818 1ST NAT'L BANK          
415 642 2160 EARTHQUAKE REPCRT       
505 883 6828 "     "
512 472 2181 "     "                 
512 472 4263 WIERD RECORDING         
512 472 9833 "     "                 
512 472 9941 INSERT 25 CENTS         
512 472 9941 SPECIAL RECORDING       
512 870 2345 "     "                 
516 794 1707 "     "                 
619 748 0002 LOOP LINE    
619 748 0003 "     "                 
703 331 0057 MCI           (5 DIGITS)
703 334 6831 WASH. POST              
703 354 8723 COMPEL INC.
703 737 2051 METROPHONE    (6 DIGITS)
703 835 0500 VALNET        (5 DIGITS)
703 861 7000 SPRINT      (6/8 DIGITS)
703 861 9181 SPRINT      (6/8 DIGITS)
714 974 4020 CA. MAINFRAME           
716 475 1072 N.Y. DEC-SYSTEM         
800 222 0555 RESEARCH INSTITUTE      
800 223 3312 CITIBANK
800 227 5576 EASTERN AIRLINES        
800 248 0151 WHITE HOUSE PRESS       
800 321 1424 FLIGHT PLANES           
800 323 3026 TEL-TEC       (6 GIGITS)
800 323 4756 MOTOROLA DITELL         
800 323 7751 M.C.I. MAINFRAME        
800 325 4112 EAsYLINK                
800 325 6397 F.Y.I.                  
800 344 4000 MSG SYSTEM              
800 368 6900 SKYLINE ORDER LINE      
800 424 9090 RONALD REAGAN'S PRESS   
800 424 9096 WHITE HOUSE SWITCH      
800 438 9428 ITT CITY CALL SWITCHING 
800 521 2255 AUTONET                 
800 521 8400 TRAVELNET     (8 DIGITS)
800 526 3714 RCA MAINFRAME           
800 527 1800 TYMNET                  
800 621 3026 SPECIAL OPERATOR        
800 621 3028 "     "                 
800 621 3030 "     "                 
800 621 3035 "     "                 
800 631 1146 VOICE STAT              
800 821 2121 BELL TELEMARKETING     
800 828 6321 XEROX            $      
800 858 9313 RECORD-A-VOICE          
800 882 1061 AT&T STOCK PRICES       
914 997 1277 "     "                 
916 445 2864 JERRY BROWN             
N/A 950 1000 SPRINT                  
N/A 950 1022 MCI EXECUNET            
N/A 950 1033 US TELEPHONE            
N/A 950 1044 ALLNET        (6 DIGITS)
N/A 950 1066 LEXITEL
N/A 950 1088 SKYLINE       (6 DIGITS)

-----------------------------------
PHONE #       | DESCRIPTION/CODE
-----------------------------------
201-643-2227  | CODES:235199,235022
              |       AND 121270
              |
800-325-4112  | WESTERN UNION
              |
800-547-1784  | CODES:101111,350009
              |       AND 350008
              |
800-424-9098  | TOLL FREE WHITE HS.
              |
800-424-9099  | DEFENSE HOT LINE
              |
202-965-2900  | WATERGATE
              |
800-368-5693  | HOWARD BAKER HOTLN
              |
202-456-7639  | REAGANS SECRETARY
              |
202-545-6706  | PENTAGON
              |
202-694-0004  | PENTAGON MODEM
              |
201-932-3371  | RUTGERS
              |
800-325-2091  | PASSWORD: GAMES
              |
800-228-1111  | AMERICAN EXPRESS
              |
617-258-8313  | AFTER CONNECT
              | PRESS CTRL-C
              |
800-323-7751  | PASSWORD:REGISTER
              |
800-322-1415  | CODES:266891,411266
              |       AND 836566
              | (USED BY SYSOP)
-----------------------------------
 The following 800 #'s have been
collected however no codes have
been found yet! if you hack any
please let me know...
-----------------------------------
phone #         | codes:
-----------------------------------
800-321-3344    | ???????????
800-323-3027    | ???????????
800-323-3208    | ???????????
800-323-3209    | ???????????
800-325-7222    | ???????????
800-327-9895    | ???????????
800-327-9136    | ???????????
800-343-1844    | ???????????
800-547-1784    | ???????????
800-547-6754    | ???????????
800-654-8494    | ???????????
800-682-4000    | ???????????
800-858-9000    | ???????????
800 #'s with carriers.
800-323-9007
800-323-9066
800-323-9073
800-321-4600
800-547-1784
1-800 numbers of the goverment.
800-321-1082:NAVY FINANCE CENTER.
800-424-5201:EXPORT IMPORT BANK.
800-523-0677:ALCOHOL TOBACCO AND.
800-532-1556:FED INFORMATION CNTR1-1082:NAVY FINANCE CENTER.
800-424-5201:EXPORT IMPORT BANK.
800-523-0677:ALCOHOL TOBACCO AND.
800-532-1556:FED INFORMATION CNTR.
800-325-4072:COMBAT & ARMS SERVICE.
800-325-4095:COMBAT SUPPORT BRANCH.
800-325-4890:ROPD USAR COMBAT ARMS.
800-432-3960:SOCIAL SECURITY.
800-426-5996:PUGET NAVAL SHIPYARD.
Directory of toll free numbers.
800-432-3960:SOCIAL SECURITY.
800-426-5996:PUGET NAVAL SHIPYARD.
Directory of toll free numbers.
301-234-0100:BALTIMORE ELECTRIC.
202-456-1414:WHITE HOUSE.
202-545-6706:PENTAGON.
202-343-1100:EPA.
714-891-1267:DIAL-A-GEEK.
714-897-5511:TIMELY.
213-571-6523:SATANIC MESSAGES.
213-664-7664:DIAL-A-SONG.
405-843-7396:SYNTHACER MUSIC.
213-765-1000:LIST OF MANY NUMBERS.
512-472-4263:WIERD.
512-472-9941:INSERT 25.
203-771-3930:PIONEERS.
213-254-4914:DIAL-A-ATHIEST.
212-586-0897:DIRTY.
213-840-3971:HOROWIERD
203-771-3930:PIONEERS
471-9420,345-9721,836-8962
836-3298,323-4139,836-5698
471-9440,471-9440,471-6952
476-6040,327-9772,471-9480
800-325-1693,800-325-4113
800-521-8400:VOICE ACTIVATED
213-992-8282:METROFONE ACCESS NUMBER
617-738-5051:PIRATE HARBOR
617-720-3600:TIMECOR #2
301-344-9156:N.A.S.A PASSWORD:GASET
318-233-6289:UNIVERSITY LOUISIANA
213-822-2112:213-822-3356
213-822-1924:213-822 3127
213-449-4040:TECH CENTER
213-937-3580:TELENET
1-800-842-8781
1-800-368-5676
1-800-345-3878
212-331-1433
213-892-7211
213-626-2400
713-237-1822
713-224-6098
713-225-1053
713-224-9417
818-992-8282
1-800-521-8400
After entering the sprint code,and, C+Destination number.Then enter this:
number:"205#977#22",And the main tracer for sprint will be disabled.
215-561-3199/SPRINT LONG DISTANCE
202-456-1414/WHITE HOUSE
011-441-930-4832/QUEEN ELIZABETH
916-445-2864/JERRY BROWN
800-424-9090/RONALD REAGAN'S PRESS
212-799-5017/ABC NEW YORK FEED LINE
800-882-1061/AT & T STOCK PRICES
212-986-1660/STOCK QUOTES
213-935-1111/WIERD EFFECTS!
512-472-4263/WIERD RECORDING
212-976-2727/P.D.A.
619-748-0002/FONE CO. TESTING LINES
900-410-6272/SPACE SHUTTLE COMM.
201-221-6397/AMERICAN TELEPHONE
215-466-6680/BELL OF PENNSYLVANIA
202-347-0999/CHESAPEAKE TELEPHONE
213-829-0111/GENERAL TELEPHONE
808-533-4426/HAWAIIAN TELEPHONE
312-368-8000/ILLINOIS BELL TELEPHONE
317-265-8611/INDIANA BELL
313-223-7233/MICHIGAN BELL
313-223-7223/NEVADA BELL
207-955-1111/NEW ENGLAND TELEPHONE
201-483-3800/NEW JERSEY BELL
212-395-2200/NEW YORK TELEPHONE
515-243-0890/NORTHWESTERN BELL
216-822-6980/OHIO BELL
206-345-2900/PACIFIC NORTHWEST BELL
213-621-4141/PACIFIC TELEPHONE
205-321-2222/SOUTH CENTRAL BELL
404-391-2490/SOUTHERN BELL
203-771-4920/SOUTHERN NEW ENGLAND
314-247-5511/SOUTHWESTERN BELL
414-678-3511/WISCONSIN TELEPHONE
800-327-6713/UNKNOWN ORIGIN
303-232-8555/HP3000
315-423-1313/DEC-10
313-577-0260/WAYNE STATE
512-474-5011/AUSTIN COMPUTERS
516-567-8013/LYRICS TIMESHARING
212-369-5114/RSTS/E
415-327-5220/NEC
713-795-1200/SHELL COMPUTERS
518-471-8111/CNA OF NY
800-327-6761/AUTONET
800-228-1111/VISA CREDIT CHECK
713-483-2700/NASUA
213-383-1115/COSMOS
408-280-1901/TRW
404-885-3460/SEARS CREDIT CHECK
414-289-9988/AARDVARK SOFTWARE
919-852-1482/ANDROMEDA INCORPORATED
213-985-2922/ARTSCI
714-627-9887/ASTAR INTERNATIONAL
415-964-8021/AUTOMATED SIMULATIONS
503-345-3043/AVANT GARDE CREATIONS
415-456-6424/BRODERBUND SOFTWARE
415-658-8141/BUDGE COMPANY
714-755-5392/CAVALIER COMPUTER
801-753-6990/COMPUTER DATA SYSTEMS
213-701-5161/DATASOFT INC.
213-366-7160/DATAMOST
716-442-8960/DYNACOMP
213-346-6783/EDU-WARE
800-631-0856/HAYDEN
919-983-1990/MED SYSTEMS SOFTWARE
312-433-7550/MICRO LAB
206-454-1315/MICROSOFT
301-659-7212/MUSE SOFTWARE
209-683-6858/ON-LINE SYSTEMS
203-661-8799/PROGRAM DESIGN (PDI)
213-344-6599/QUALITY SOFTWARE
303-925-9293/SENTIENT SOFTWARE
702-647-2673/SIERRA SOFTWARE
916-920-1939/SIRIUS SOFTWARE
215-393-2640/SIR-TECH
415-962-8911/SOFTWARE PUBLISHERS
415-964-1353/STRATEGIC SIMULATIONS
217-359-8482/SUBLOGIC COM.
206-226-3216/SYNERGISTIC SOFTWARE
Here are a few tips on how not to get caught when using MCI or other
such services:
   1- Try not to use them for voice to voice personal calls. Try to use
      them for computer calls only. Here is why:
      MCI and those other services can't really trace the calls that
      come through the lines,they can just monitor them. They can
      listen in on your calls and from that,they can get your name and
      other information from the conversation. They can also call
      the number you called and ask your friend some questions. If
      you call terminals and BBS'S then it is much harder to get
      information. For one thing,most sysops won't give these dudes
      that call any info at all or they will act dumb because they
      PHREAK themselves!
   2- Beware when using colored boxes! They are easy to find!!!!!
   3- Try to find a sine-wave number. Then use an MCI or other service
      to call it. You will hear a tone that goes higher and lower. If
      the tone just stops,then that code is being monitored and you
      should beware when using it.
----------------------------------------
     If you do get caught,then if you think you can,try to weasel out of it.
    I have heard many stories about people that have pleaded with the MCI
 guys and have been let off. You will get a call from a guy that has been
 monitoring you. Act nice. Act like you know it is now wrong to do this
 kind of thing.....just sound like you are sorry for what you did. (If you
 get a call,you probably will be a little sorry!)
 Otherwise,it is very dangerous!!!!!!! (Very with a capital V!)

 UpDated in '94........          -= Exodus =-


PC-Pursuit Port Statistic's


         Subject:    PC-Pursuit Port Statistic's
         Date:       06/29/89
         Written by: PC-Pursuit Users
         ============================================================
         Introduction:
         =============
              The last 30 days of PC-Pursuit have been extremely
         controversial.  Users and ex-users have demanded accurate
         statistics, and Telenet has provided us with very little.
         And the data that was provided is questionable.  Well, here
         is some data that is guaranteed to be accurate and make
         Telenet scream. If you wish to update this data on your own,
         we will tell you how later in this text.
              The following chart consists of all the direct Telenet
         addresses of the PC-Pursuit city nodes and the total number
         of modems on each node.  Here is what the data means:
         NJNEW/3 2011    .12    56
         !     ! !        !      \-- Total Number of Modems in NJNEW
         !     ! !        \- Last Working Suffix of Address sequence.
         !     ! \- Direct Telenet Address Prefix.
         !     \--- Baud Rate of This Port is 300.
         \--------- Mnemonic.
         Please note that there are several perfectly legal ways to
         connect to a PC-Pursuit port such as NJNEW/3:
              Ways To Connect to NJNEW/3:
                   1)   C D/NJNEW/3,PCP10000,<password>   [HUNT]
                   2)   C 2011,PCP10000,<password>        [HUNT]
                   3)   C 2011.10,PCP10000,<password>     [NON HUNT]
         The first, is self explanatory.  The second does the same
         thing as the first, only that it is slightly faster and gives
         the user much greater flexibility.  The third is an example
         the flexibility, because a request is made to connect to the
         tenth, and only the tenth, modem on the NJNEW/3 port.
              By simply attempting to connect to every single modem
         in the 2011 chain, we were able to count the number of modems
         on each port and come up with the following charts which were
         extracted on June the twenty ninth of the year 1989:
         Rotary   Direct  Max.  City     Rotary   Direct  Max.  City
         Port     Address Range Total    Port     Address Range Total
         -------- ------- ---   -----    -------- ------- ---   -----
         NJNEW/3  2011    .12   56       CAOAK/3  4155    . 4   16
              /12 201301  .40                 /12 415216  . 8  
              /24 20122   . 4                 /24 41511   . 4  
         DCWAS/3  202115  . 6   46       CAPAL/3  415106  . 4   12
              /12 202116  .24                 /12 415224  . 8  
              /24 202117  .16                 /24 <NONE> <NONE>
         CTHAR/3  <NONE> <NONE>  8       CASFA/3  415215  . 6   20
              /12 203120  . 8                 /12 415217  .10  
              /24 <NONE> <NONE>               /24 41523   . 4  
         WASEA/3  20617   . 4   30       ORPOR/3  50320   . 2    8
              /12 20619   .22                 /12 50321   . 6  
              /24 20621   . 4                 /24 <NONE> <NONE>
         NYNYO/3  212315  . 4   22       AZPHO/3  60222   . 4   20
              /12 212316  .14                 /12 60223   .12  
              /24 21228   . 4                 /24 60226   . 4  
         CALAN/3  213412  . 8   40       MNMIN/3  612120  . 4   22
              /12 213413  .28                 /12 612121  .14  
              /24 21323   . 4                 /24 61222   . 4  
         TXDAL/3  214117  . 6   30       MABOS/3  617311  . 4   32
              /12 214118  .22                 /12 617313  .20  
              /24 21422   . 4                 /24 61726   . 8  
         PAPHI/3  215112  . 6   36       TXHOU/3  713113  . 8   42
              /12 2155    .22                 /12 713114  .24  
              /24 21522   . 8                 /24 71324   .10  
         OHCLE/3  21620   . 4   26       CACOL/3  71423   . 4   18
              /12 21621   .18                 /12 7144    .10  
              /24 216120  . 4                 /24 71424   . 4  
         CODEN/3  303114  . 4   40       CASAN/3  714119  . 4   20
              /12 303115  .18                 /12 714213  .12  
              /24 30321   .22                 /24 714124  . 4  
         FLMIA/3  305120  . 6   28       CASDI/3  714102  . 4   22
              /12 305121  .18            (619)/12 714210  .14  
              /24 305122  . 4                 /24 714121  . 4  
         ILCHI/3  312410  . 8   40       UTSLC/3  80120   . 4   22
              /12 312411  .28                 /12 80121   .14  
              /24 31224   . 4                 /24 80112   . 4  
         MIDET/3  313214  . 6   30       FLTAM/3  81320   . 4   18
              /12 313216  .18                 /12 81321   .10  
              /24 31324   . 6                 /24 813124  . 4  
         MOSLO/3  3145    . 4   16       MOKCI/3  816104  . 4   20
              /12 314421  . 8                 /12 816221  .12  
              /24 31420   . 4                 /24 816113  . 4  
         GAATL/3  404113  . 8   32       CAGLE/3                ??
              /12 404114  .20                 /12 81821   .18  
              /24 40422   . 4                 /24  
         CASJO/3  408111  . 4   34       CASAC/3  9167    . 4   16
              /12 40821   .26                 /12 91611   . 8  
              /24 408110  . 4                 /24 91612   . 4  
         WIMIL/3  41420   . 4   24       NCRTP/3  91920   . 4   20
              /12 41421   .16                 /12 91921   .12  
              /24 414120  . 4                 /24 919124  . 4  

         01/29/89       PC-Pursuit Modems Statistics Chart
                                 Number of Modems         City
              Mnemonic        300      1200      2400     Total
              ---------- -------- --------- --------- ---------
              NJNEW            12        40         4        56
              DCWAS             6        24        16        46
              CTHAR             0         8         0         8
              WASEA             4        22         4        30
              NYNYO             4        14         4        22
              CALAN             8        28         4        40
              TXDAL             6        22         4        32
              PAPHI             6        22         8        36
              OHCLE             4        18         4        26
              CODEN             4        18        22        44
              FLMIA             6        18         4        28
              ILCHI             8        28         4        40
              MIDET             6        18         6        30
              MOSLO             4         8         4        16
              GAATL             8        20         4        32
              CASJO             4        26         4        34
              WIMIL             4        16         4        24
              CAOAK             4         8         4        16
              CAPAL             4         8         0        12
              CASFA             6        10         4        20
              ORPOR             2         6         0         8
              AZPHO             4        12         4        20
              MNMIN             4        14         4        22
              MABOS             4        20         8        32
              TXHOU             8        24        10        42
              CACOL             4        10         4        18
              CASAN             4        12         4        20
              CASDI             4        14         4        22
              UTSLC             4        14         4        22
              FLTAM             4        10         4        18
              MOKCI             4        12         4        20
              CAGLE             4        18         4        26
              CASAC             4         8         4        16
              NCRTP             4        12         4        20
                         -------- --------- --------- ---------
              Total           166       562       170       898
                         ======== ========= ========= =========
              Average   4.8823529 16.529412         5 26.411765
              NOTE: CASAC/3, CASAC/24 were estimated.
         I think the statistics basically speak for themselves.
         I am sure there will no doubt be hundreds of people who will
         not smile at the number of specific kinds of ports supported,
         not to mention the number of 'dead' or 'down' modems you will
         find when you verify the totals.  Usually, 2% to perhaps 10%
         of the modems are 'dead' with specific ones repeatedly
         failing week after week.
         History Of This Collection:
         ===========================
              Almost a year ago a small selected group of devoted
         individuals got together to discuss problems with the PC-
         Pursuit Network, in the middle of our discussions a question
         was asked as to how the network really processes our calls.
         This was intended to help us assess SET? commands and other
         such matters.  When the address hypothesis was offered we
         quickly set out to prove it.  It was proved in about 3
         minutes with the discovery of 2011 (First try was xxx1).  The
         data has continually been collected and analyzed ever since,
         but until now, has never been mass released.
              A small group of teen age hackers discovered several
         interesting things that can be done with these addresses--
         many of which will not be discussed here short of mentioning
         that these ports connected to via these addresses are not
         limited to PC-Pursuiters.  You can, however, fight "dead"
         dialout modems in cities via the address method.  Dead modems
         can be located in about 10 seconds (faster than Telenet), and
         can either be reported or skipped past by the user connecting
         to the next modem in the sequence after the "dead" one.
         (Note: Say 2011.3 is dead, connect to 2011.4 and you will be
         past it.  If 2011.4 is busy, go to 2011.5.  The reader should
         notice 2011.3 is the same as 2011C.)
              The most interesting value of these addresses is that
         one can count the number of ports that Telenet keeps so
         secret (Grin).  When there were only 28 cities in operation
         there were an average of 2.7 300 baud, 9.4 1200 baud, and 2.5
         2400 baud modems in each city.  Some cities had as little as
         2 modems on a port and as many as 12.  Only recently has the
         number of modems per city begun to jump.
         How To Update The Count Yourself:
         =================================
              An ID is not required to "request" one of these ports,
         thus the tallying can be done any time of day by simply
         typing the number at the @ prompt.  Here is an example with
         four modems (NJNEW/24):
         @20122.1
         201 22A REFUSED COLLECT CONNECTION 19 80
         @20122.2
         201 22B REFUSED COLLECT CONNECTION 19 80
         @20122.3
         201 22C REFUSED COLLECT CONNECTION 19 80
         @20122.4
         201 22D REFUSED COLLECT CONNECTION 19 80
         @20122.5
         201 22E ILLEGAL ADDRESS 19 80
         The reader should be aware that PC-Pursuit ports always
         respond with '19 80'.  Do not confuse it with '19 00', which
         are not PC-Pursuit ports.  In the above example we know there
         are four ports because the forth was the last existing port
         before we encountered the 'ILLEGAL ADDRESS.'  There are
         several ways to signify that you have gone one beyond the end
         of the ports:
            1)  xxx xxx ILLEGAL ADDRESS 19 80
            2)  xxx xxx NOT OPERATING 19 80
            3)  The request freezes (Note: Issue a BREAK then D <C/R>
                to abort the attempt yielding 'ATTEMPT ABORTED'.)
         You should be aware that modems which are out of order in the
         middle of the sequence can respond with 'NOT OPERATING' or
         may freeze the request.  You should also note that when
         updating the existing list, all you need to do is try to
         request the next modem beyond the end as of the last check.
         Finding Newly Added Ports:
         ==========================
              Many ports have not yet been installed; hence, we do not
         yet know the addresses.  New ports may be found by entering
         the first three digits of the area code and appending (1-29,
         101-129, 201-229, 301-329, etc.) until the 'REFUSED COLLECT
         CONNECTION 19 80' appears.  Once this is found, simply log
         onto the port address with your ID and R/V dial some silly
         series of digits, disconnect the port, then connect to the
         PC-Pursuit mnemonic you think it might be and R/V redial the
         last number.  If the numbers match, you found it.



Computer Based PBX Courtesy of the Jolly Roger (Originally an Apple ][ file for forgive the upper case!)

Computer Based PBX                     Courtesy of the Jolly Roger
    (Originally an Apple ][ file for forgive the upper case!)

TO GET A BETTER UNDERSTANDING OF WHAT A PBX CAN DO, HERE ARE A FEW BASIC
FUNDAMENTALS.THE MODERN PBX IS A COMBINED COMPUTER,MASS STORAGE DEVICE,
AND OF COURSE A SWITCHING SYSTEM THAT CAN:
      [1] PRODUCE ITEMIZED,AUTOMATED BILLING PROCEDURES,TO ALLOW THE
          IDENTIFICATION AND MANAGEMENT OF TOLL CALLS. [HAHAHA]
      [2] COMBINE DAYTIME VOICE GRADE COMMUNICATION CIRCUITS INTO
          WIDEBAND DATA CHANNELS FOR NIGHT TIME HIGH SPEED DATA
          TRANSFERS.
      [3] HANDLES ELECTRONIC MAIL [ INCLUDING OFFICE MEMOS ].
      [4] COMBINE VOICE CHANNELS INTO A WIDEBAND AUDIO/VISUAL
          CONFERENCE CIRCUIT,WITH THE ABILITY TO XFER AND
          CAPTURE SLIDES,FLIPCHARTS,PICTURES OF ANY KIND.
BOTH THE EXTERNAL AND INTERNAL CALLING CAPACITY OF THE PBX SYSTEM MUST BE
CAREFULLY CONSIDERED BECAUSE MANY BUSINESS OPERATIONS RUN A VERY HIGH RATIO
OF INTERNAL STATION TO STATION DIALING AND A LOW CAPACITY SYSTEM WILL NOT
HANDLE THE REQUESTED TRAFFIC LOAD.
A CRITICAL FACTOR IS THE NUMBER OF TRUNKS AND THE CENTRAL OFFICE FACILITIES
THAT ARE USED FOR OUTSIDE CONNECTIONS.ANOTHER IS THE NUMBER OF JUNCTIONS OR
[LINKS] THAT MAKE UP THE INTERNAL CALLING PATHS.
TO UNDERSTAND THE SERVICES AVAILABLE ON A TYPICAL COMPUTER RUN PBX IT IS
NECESSARY TO INTRODUCE THE SUBJECT OF TIME DIVISION SWITCHING.IN A TIME
DIVISION SWITCHING NETWORK ALL CONNECTIONS ARE MADE VIA A SINGLE COMMON BUS
CALLED (OF COURSE) A 'TIME-DIVISION BUS'.EVERY LINE TRUNK THAT REQUIRES A
CONNECTION WITH ANOTHER IS PROVIDED WITH A PORT CIRCUIT.ALL PORT CIRCUITS
HAVE ACCESS TO THE TIME DIVISION BUS THROUGH A TIME DIVISION SWITCH.
[WHEN TWO PORTS REQUKRE CONNECTION,THEIR TIME DIVISION SWITCHES OPERATE AT
A VERY HIGH FREQUENCY (16,000 TIMES PER SECOND).THIS TECHNIQUE,WHICH IS
CALLED 'SPEECH SAMPLING',ALLOWS MANY SIMULTANEOUS CONNECTIONS OVER THE SAME
TIME DIVKSION BUS.EACH CONNECTION IS ASSIGNED A TIME INTERVAL,THE 'TIME SLOT'
,AND THE NUMBER OF TIME SLOTS IDENTIFIES THE NUMBER OF SIMULTANEOUS CONNECT-
IONS AMONG PORTS.]
THE NEXT CRITICAL ITEM IS CIRCUIT PACKS.THE SYSTEM ELEMENTS THAT WE WILL BE
DESCRIBING IN FUTURE TUTORIALS [LINES/TRUNKS/SWITCHES,MEMORY AND CONTROL] ARE
CONTAINED ON PLUG IN CIRCUIT PACKS.EACH LINE CIRCUIT PACK CONTAINS A NUMBER
OF LINES,IN EXAMPLE,FOUR.BUT THE ASSIGNMENT OF STATION NUMBERS TO ACTUAL
PHONE LINE CIRCUITS IS FLEXIBLE.
THE SYSTEM MEMORY IS CONTAINED IN CIRCUIT PACKS WHICH PROVIDE THE CALL
PROCESSING FUNCTIONS.THE CIRCUIT PACKS ARE HELD IN SMALL FRAMES CALLED
'CARRIERS'.WITHIN EACH CARRIER,THE CIRCUIT PACKS ARE PLUGGED INTO POSITIONS:
THE 'SLOTS'.EVERY CIRCUIT CAN BE ADDRESSED BY,SAY A FIVE DIGIT NUMBER WHICH
TELLS ITS LOCATION BY CARRIER-SLOT-CIRCUIT.... [STARTING TO GET THE IDEA?]
THERE CAN BE THREE TYPES OF CARRIERS IN A MODERN PBX SYSTEM:
                O LINE CARRIERS
                O TRUNK CARRIERS
                O CONTROL CARRIERS
THE LINE CARRIERS CONTAIN STATION LINES.IN A.T.& T.'S "DIMENSION" MODEL,FOR
EXAMPLE,A TOTAL OF 52 TO 64 LINES ARE PROVIDED.THE TRUNK CARRIERS CONTAIN
SLOTS FOR 16 TRUNK CIRCUIT PACKS.THE CONTROL CARRIER INCLUDES PROCESSOR,
MEMORY,CONTROL CIRCUITRY,DATA CHANNELS FOR ATTENDANT CONSOLE CONTROL AND
TRAFFIC MEASUREMENT OUTPUTS.
PBX SYSTEMS WILL DIRECTLY REFLECT THE TYPES OF SERVICES OFFERED AT THE C.O.
           O CCSA
           O CCIS
           O PICTUREPHONES [SOONER THAN YOU THINK MY PHRIENDS]
COMMON CONTROL SWITCHING ARRANGEMENTS ( CCSA ) PERMIT ANY UNRESTRICTED TELE-
PHONE STATION TO CALL ANY OTHET INTERNAL OR EXTERNAL SYSTEM STATION BY USING
THE STANDARD SEVEN DIGIT NUMBER.ALTERNATE ROUTING IS A FEATURE OF CCSA SERVICE
THE INTERFACILITY,ALTERNATE ROUTED CALLING PATHS ARE ACCOMPLISHED AT THE TELE-
PHONE COMPANY CENTRAL OFFICE LEVEL,NOT AT THE PBX LEVEL.
A SYSTEM OF INTEREST TO LARGE SCALE TELEPHONE USERS IS COMMON CHANNEL INTER-
OFFICE SIGNALLING (CCIS).TYPICALLY,THIS TECHNIQUE EMPLOYS COMMON CHANNELS TO
CARRY ALL INTERFACILITY SIGNALLING INSTRUCTIONS: DIAL PULSES,ON HOOK (IDLE),
OFF HOOK (BUSY),AND SO ON,BETWEEN TWO SWITCHING CENTERS. [ GETTING WARM ].
CCIS REPLACES OLDER METHODS OF INTEROFFICE SIGNALLING SUCH AS 'IN BAND' AND
'OUT OF BAND' TECHNIQUES. BY THE WAY,REAL PHREAKS ARE SELLING THEIR BOXES TO
IDIOTS WHO STILL THINK THE'RE WORTH ALOT...THE FORMER (IN BAND) TRANSMITS
SIGNALLING DATA WITHIN THE NORMAL CONVERSATION BANDWIDTH.IT'S SHORTCOMING IS
THAT FALSE INFORMATION MAY BE TRANSMITTED DUE TO UNIQUE TONE OR NOISE
COMBINATIONS SET UP IN THE TALKING PATH. [THIS IS THE OFFICIAL REASONING].
OUT OF BAND SIGNALLING TECHNIQUES PLACED THE INTEROFFICE DATA IN SPECIAL
CHANNELS,GENERALLY ADJACENT TO AND IMMEDIATELY ABOVE THE VOICE PATH.TO PRE-
SERVE INTERCHANNEL INTEGRITY,OUT OF BAND SIGNALLING REQUIRES VERY EFFECIENT
FILTERING OR GREATER 'BAND GUARD' SEPERATION BETWEEN CHANNELS.

Brought to you in the Cookbook IV courtesy of Exodus!!!!!!!!!!!!



Getting Money out of Pay Phones by the Jolly Roger

Getting Money out of Pay Phones                by the Jolly Roger

I will now share with you my experiences with pay telephones.  You will discover
that it is possible to get money from a pay phone with a minimum of effort.
Theory: Most pay phones use four wires for the transmission of data and
codes to the central office.  Two of them are used for voice (usually red and
green), one is a ground, and the last is used with the others for the
transmission of codes.
It is with this last wire that you will be working with.  On the pay phone that
I usually did this to, it was colored purple, but most likely will be another
color.
What you will do is simply find a pay phone which has exposed wires, such that
one of them can be disconnected and connected at ease without
fear of discovery. You will discover that it is usually a good idea to
have some electrical tape along with you and some tool for cutting this
tape.
Through trial and error, you will disconnect one wire at a time starting with
the wires different than green and red.  You do want a dial tone during
this operation.
What you want to disconnect is the wire supplying the codes to the telephone
company so that the pay phone will not get the 'busy' or 'hang-up' command.
Leave this wire disconnected when you discover it.
What will happen:  Anytime that someone puts any amount of money into the pay
phone, the deposit will not register with the phone company and it
will be held in the 'temporary' chamber of the pay phone.
Then, (a day later or so) you just code back to the phone, reconnect the wire,
and click the hook a few times and the phone will dump it all out the shute.
(What is happening is that the 'hangup' code that the phone was not
receiving due to the wire being disconnected suddenly gets the code and
dumps its' 'temporary' storage spot.)
You can make a nice amount of money this way, but remember
that a repairman will stop by every few times it is reported broken and
repair it, so check it at least once a day.
Enjoy and have fun.. Many phones I have done this to, and it works
well with each.. 
                                         -= Exodus =-


How Ma Bell Works by the Jolly Roger


       
In  this  article,  I  will first describe  the  termination, 
wiring,  and  terminal  hardware most commonly used in  the  Bell 
system, and I will include section on methods of using them.
     -------------
     LOCAL NETWORK
     -------------
The   local   telephone   network   between   the    central 
office/exchange  and  the  telephone subscribers can  be  briefly 
described as follows:
From  the  central office (or local exchange) of  a  certain 
prefix(es), underground area trunks go to each area that has that 
prefix  (Usually  more than one prefix per area.)  At  every  few 
streets or tract areas, the underground cables surface. They then 
go to the telephone pole (or back underground,  depending on  the 
area)  and  then  to the subsribers house (or in the case  of  an 
apartment building or mutliline business,  to a splitter or  dis-
tribution box/panel). 
Now  that  we have the basics,  I'll try and go in-depth  on  the 
subject.
    ------------------
    UNDERGROUND CABLES
    ------------------
These  are sometimes inter-office trunks,  but usually in  a 
residential  area they are trunk lines that go to bridging  heads 
or  distribution  cases.  The cables are about 2-3  inches  thick 
(varies),  and  are  either  in  a metal  or  pvc-type  pipe  (or 
similiar).  Rarely (maybe not in some remote rural areas) are the 
cables  just 'alone' in the ground.   Instead they are usually in 
an  underground cement tunnel (resembles a small sewer or  storm-
drain.)   The manholes are >heavy< and will say 'Bell system'  on 
them.  they can be opened with a 1/2 inch wide crowbar (Hookside) 
inserted  in the top rectangular hole.  There are ladder rungs to
help you climb down.  You will see  the cable  pipes on the wall,
with the blue and white striped one being  the inter-office trunk
(at  least  in my  area).  The others  are local  lines,  and are
usually marked or color  coded.  There is almost  always a posted
color code  chart on the wall, not to mention  Telco manuals de-
scribing the cables and terminals, so I need not get into detail.
Also, there is usually  some kind  of  test equipment,  and often
Bell test sets are  left  in there.
       --------------
       BRIDGING HEADS
       --------------
The  innocent-looking  grayish-green boxes.   These  can  be 
either trunk bridges or bridging for residences.  The major trunk 
bridging  heads  are usually larger,  and they have the  'Western 
Electric' logo at the bottom,  whereas the normal bridging  heads 
(which  may  be different in some areas-depending on the  company 
you are served by.  GTE B.H.'s look slightly different.  Also, do 
not  be  fooled by sprinkler boxes!)  They can be found  in  just 
about every city.
To open a bridging head: if it is locked (and you're feeling 
destructive),  put a hammer or crowbar (the same one you used  on 
the  manhole) in the slot above the top hinge of the right  door.  
Pull hard, and the door will rip off. Very effective! If it isn't
locked (as usual),  take a 7/8 inch hex socket and with it,  turn
the bolt  about 1/8 of a turn  to the  right  (you  should hear a
spring release inside). Holding the bolt, turn the handle all the
way to the left and pull out.
To Check for a test-set (which are often left by Bell employees),
go inside - First check  for a test-set  (which  are  often  left 
by  Bell  employees).   There should be a panel of terminals  and 
wires.   Push the panel back about an inch or so,  and rotate the 
top  latch  (round with a flat section)  downward.   Release  the 
panel  and it will fall all the way forward.  There is usually  a 
large  amount  of wire and extra terminals.   The  test-sets  are 
often hidden here,  so don't overlook it (Manuals,  as  well,  are 
sometimes placed in the head).   On the right door is a metal box 
of alligator clips.   Take a few (Compliments of Bell.).  On each 
door is a useful little round metal device. (Says 'insert gently' 
or'  clamp  gently - do not overtighten' etc..)  On the front  of 
the disc, you should find two terminals.  These are for your test 
set.   (If you dont have one, dont despair -I'll show you ways to 
make basic test sets later in this article).
Hook the ring (-) wire to the 'r' terminal;  and the tip (+) 
wire  to the other.  (By the way,  an easy way to  determine  the 
correct polarity is with a 1.5v LED.   Tap it to the term.  pair, 
if  it  doesnt light,  switch the poles until it does.   When  it 
lights,find the longer of the two LED poles:  This one will be on 
the  tip wire (+).   Behind the disc is a coiled  up  cord.  This 
should have two alligator clips on it..  Its very useful, because 
you dont have to keep connecting and disconnecting the fone (test 
set) itself, and the clips work nicely.
On  the  terminal  board,  there should be  about  10  screw 
terminals  per  side.   Follow the wires,  and you can see  which 
cable pairs are active.  Hook the clips to the terminal pair, and 
you're set!   Dial out if you want,  or just listen (If someone's 
on theline).  Later,  I'll show you a way to set up a true  'tap' 
that  will let the person dial out on his line and receive  calls 
as normal, and you can listen in the whole time.  More about this 
later...
On  major  prefix-area bridging heads,  you can  see  'local 
loops' ,which are two cable pairs (cable pair = ring+tip,  a fone 
line)  that are directly connected to each other on the  terminal 
board.   These  'cheap  loops' as they are called,  do  not  work 
nearLy  as  well  as the existing ones set up  in  the  switching 
hardware  at the exchange office.   (Try scanning your  prefixes' 
00xx  to 99xx #'s.)  The tone sides will announce themselves with 
the 1008 hz loop tone,  and the hang side will give no  response.  
The  first  person  should dial the 'hang' side,  and  the  other 
person dial the tone side,  and the tone should stop if you  have 
got the right loop.)
If  you want to find the number of the line that you're  on, 
you  can either try to decipher the 'bridging log' (or whatever), 
which is on the left door.  If that doesnt work,  you can use the 
follwing:
     ---------------------------
     ANI # (Automatic Number ID)
     ---------------------------
This  is a Telco test number that reports to you the  number 
that youre calling from (It's the same, choppy 'Bell bitch' voice 
that you get when you reach a disconnected #) 
For the   213 NPA - Dial 1223
          408 NPA - Dial 760
          914 NPA - Dial 990
These  are  extremely useful when messing with any  kind  of line
terminals, house boxes, etc.
Now that we have bridging heads wired, we can go on... (don't 
forget to close and latch the box after all... Wouldnt want GE 
and Telco people mad, now, would we?) 
     -------------------------------------
     "CANS" - Telephone Distribution Boxes
     -------------------------------------

Basically, two types:
1> Large, rectangular silver box at the end of each street.
2> Black, round, or rectangular thing at every telephone pole.
Type 1 -   This is the case that takes the underground cable from 
the  bridge and runs it to the telephone pole cable (The  lowest, 
largest  one  on the telephone pole.)  The box is always  on  the 
pole nearest the briging head, where the line comes up.  Look for 
the 'Call before you Dig - Underground cable' stickers..
The  case box is hinged,  so if you want to climb the  pole, 
you  can open it with no problems.   These usually have 2 rows of 
terminal sets. 
You  could try to impersonate a Telco technician and  report 
the  number as 'new active' (giving a fake name and fake  report, 
etc.)   I  dont recommend this,  and it  probably  won't  (almost 
positively won't) work,  but this is basically what Telco linemen 
do).
Type  2 - This is the splitter box for the group of houses around 
the  pole  (Usually  4 or 5 houses).   Use it  like  I  mentioned 
before.   The terminals (8 or so) will be in 2 horizontal rows of 
sets.   The  extra  wires  that  are  just  'hanging  there'  are 
provisions for extra lines to residences (1 extra line per house, 
thats  why  the insane charge for line #3!)  If its the  box  for 
your  house  also,  have fun and swap lines with  your  neighbor!
'Piggyback'  them  and  wreak havoc  on  the  neighborhood  (It's 
eavesdropping  time...)  Again,  I don't recommend this,  and its 
difficult to do it correctly.  Moving right along...
     ------------------------------
     APARTMENT / BUSINESS MULTILINE
           DISTRIBUTION BOXES
     ------------------------------
Found  outside the buliding (most often on the  right  side, 
but not always...   Just follow the wire from the telephone pole) 
or  in the basement.   It has a terminal for all the lines in the 
building.   Use it just like any other termination box as before. 
Usually says 'Bell system' or similar.  Has up to 20 terminals on 
it (usually.) the middle ones are grounds (forget   these).   The 
wires come from the cable to one row (usually the left one), with
the other row of terminals for the other row of terminals for the 
building  fone wire pairs.   The ring (-) wire is usually the top 
terminal if the set in the row (1 of 10 or more),  and the tip is 
in the clamp/screw below it.  This can be reversed, but the cable 
pair is always terminated one-on-top-of-each- other,  not on  the 
one  next  to  it.  (I'm  not sure why the other  one  is  there, 
probably as aprovision for extra lines) Don't use it  though,  it 
is usually to close to the other terminals, and in my experiences 
you get a noisy connection.
Final note:  Almost every apartment, business, hotel, or anywhere 
there   is  more  than  2  lines  this  termination  lines   this 
termination method is used.  If you can master this type, you can 
be  in control of many things...   Look around in your area for a 
building  that  uses this type,  and practice hooking up  to  the 
line, etc.
As  an  added  help,here is the basic  'standard'  color-code  for 
multiline terminals/wiring/etc...
Single line:  Red = Ring
            Green = Tip
           Yellow = Ground *
*  (Connected  to  the ringer coil  in  individual  and  bridged 
    ringer   phones (Bell only)  Usually  connected to the  green 
    (Tip)
Ring (-) = Red
           White/Red Stripe
           Brown
           White/Orange Stripe
           Black/Yellow Stripe
Tip (+) =  Green (Sometimes
            yellow, see above.)
           White/Green Stripe
           White/Blue Stripe
           Blue
           Black/White Stripe
Ground =   Black
           Yellow
      ----------------------
      RESIDENCE TERMINAL BOX
      ----------------------
Small,  gray (can be either a rubber (Pacific Telephone) or  hard
plastic  (AT & T) housing deal that connects the cable pair  from 
the  splitter box (See type 2,  above) on the pole to your  house 
wiring.  Only 2 (or 4, the 2 top terminals are hooked in parallel 
with the same line) terminals, and is very easy to use.  This can 
be  used to add more lines to your house or add an external  line 
outside the house.
      ---------
      TEST SETS
      ---------
Well,  now  you  can  consider  yourself a minor  expert  on  the 
terminals and wiring of the local telephone network.  Now you can 
apply  it  to whatever you want to do..  Here's another  helpful 
item:
How  to  make  a Basic Test-Set and how to use it  to  dial  out, 
eavsdrop, or seriously tap and record line activity.
These are  the  (usually) orange hand set fones  used  by  Telco 
technicians to test lines.   To make a very simple one,  take any 
Bell (or other,  but I recommend a good Bell fone like a princess 
or a trimline. gte flip fones work excllently, though..) fone and 
follow the instructions below.
Note:    A 'black box' type fone mod will let you tap into  their 
line,  and with the box o,  it's as if you werent there. they can 
recieve  calls and dial out,  and you can be listening the  whole 
time! very useful.  With the box off, you have a normal fone test 
set.
Instructions:
A  basic black box works well with good results.   Take the cover 
off  the fone to expose the network box (Bell type  fones  only).  
The <RR> terminal should have a green wire going to it (orange or 
different  if  touch tone - doesnt matter,  its the same  thing). 
Disconnect the wire and connect it to one pole of an SPST switch.  
Connect  a  piece  of wire to the other pole of  the  switch  and 
connect it to the <RR> terminal.   Now take a 10k hm 1/2 watt 10% 
resistor  and  put  it  between the <RR>  terminal  ad  the  <F> 
terminal,  which  should have a blue and a white wire going to it 
(different for touch tone).  It should look like this:
-----Blue wire----------<F>
                   !
----White wire-----!
                   !
              10k Resistor
                   !
                   !
--Green wire--     !----<RR>
              !    !
               SPST
What  this  does in effect is keep the hookswitch  /  dial  pulse 
switch (F to RR loop) open while holding the line high with  the 
resistor.   This gives the same voltage effect as if the fone was 
'on-hook',  while  the 10k ohms holds the voltage right above the 
'off hook' threshold (around 22 volts or so, as compared to 15-17  
or normal off hook 48 volts for normal 'on-hook'), giving
Test Set Version 2.
Another  design is similar to the 'type 1' test set (above), 
but has some added features:
From >----------------Tip------<To Test
Alligator                        set
Clip >----------------Ring-----<phone
            !                !
            x                !
            !                !
            o                !
            !    x---RRRRR---!
            !   x            !
            !---x            !
                 x----0------!
x    = Spst Switch
o    = Red LOD        0   = Green LED
RRRRR= 1.8k 1/2 watt  xxxx= Dpst switch
        resistor
When the SPST switch in on, the LED will light, and the fone 
will become active.   The green light should be on.  If it isn't, 
switch  the dpst.   If it still isnt,  check the polarity of  the 
line and the LEDs.   With both lights on, hang up the fone.  They 
should all be off now.   Now flip the dpst and pick up the  fone.  
The  red  LED shold be on,  but the green shouldnt.   If  it  is, 
something is wrong with the circuit.  You wont get a dial tone if 
all is correct.
When  you  hook  up  to the line with  the  alligator  clips 
(Assuming you have put this circuit inside our fona and have  put 
alligator clips on the ring and tip wires (As we did before)) you 
should  have the spst #1 in the off posistion.  This will greatly 
reduce the static noise involved in hooking up to a line. The red 
LED can also be used to check if you have the correct polarity.
With  this  fone you will have the ability to listen  in  on 
>all< audible line activity,  and the people (the 'eavesdropees') 
can use their fone as normal.
Note that test sets #1 and #2 have true 'black boxes', and can be 
used for free calls (see an article about black boxes).

Test Set Version 3

To do test set 3:
Using a trimline (or similar) phone, remove the base and cut 
all  of  the wire leads off except for the red (ring -)  and  the 
green  (tip +).   Solder alligator clips to the  lug.   The  wire 
itself  is  'tinsel' wrapped in rayon,  and doesnt solder  well.  
Inside  the one handset,  remove the light socket (if it has one) 
and install a small slide or  toggle switch (Radio Shack's micro- 
miniature  spst works well).   Locate the connection of the  ring 
and the tip wires on the pc board near where the jack is  located 
at the bottom of the handset.  (The wires are sometimes black or 
brow instead of red and green,  respectively).   Cut the foil and 
run 2 pieces of wire to your switch.  In parallel with the switch 
add  a .25 uf 200 VDC capacitor (mylar,  silvered mica,  ceramic, 
not  an electrolytic).  When the switch is  closed,  the  handset 
functions normally.   With the switch in the other position,  you 
can listen without being heard.
Note:  To  reduce the noise involved in connecting the clips to a 
line,  add  a  switch selectable 1000 ohm 1/2  watt  resistor  in 
series with the tip wire. Flip it in circuit when connecting, and 
once on the line, flip it off again. (or just use the 'line disc- 
onect'  type  switch as in the type 2 test  set  (above)).   Also 
avoid   touching the alligator clips to any metal parts or  other 
terminals,  for  i causes static on the line and raises  poeple's 
suspicions. 
      ---------
      RECORDING
      ---------
If you would like to record any activity,  use test set 1 or 
2  above  (for unattended recording of >all< line  activity),  or 
just  any test set if you are going to be there to  monitor  when 
they are dialing, talking, etc. 
Place  a  telephone pickup coil (I recommend the Becoton  T-5  TP 
coil  or equivalent) onto the test set,  and put the TP plug into 
the mic.  jack of any standard tape recorder.  Hit play, rec, and 
pause.   Alternate  pause when you want to record (I  dont  think 
anyone should have any difficulty with this at all...)
Well,  if  you  still can't make a test set or you dont have  the 
parts, there's still hope.  Alternate methods:         
1>  Find  a  bell test set in a manhole or a  bridging  head  and 
'Borrow it indefinately...
2>  Test sets can  be  purchased from:
    Techni-Tool
    5 Apollo Road
    Box 368
    Plymouth Meeting PA., 19462
Ask for catalog #28
They  are usually $300 - $600, and are supposed to have  MF 
dialing  capability as well as TT dialing.  They are also of much 
higher quality than the standard bell test sets.
If you would like to learn more about the subjects covered here, 
I suggest:
1>  Follow Bell trucks and linemen or technicians and ask  subtle 
    questions. also try 611 (repair service) and ask questions..
2> Explore your area for any Bell hardware,  and experiment  with 
   it.  Don't try something if you are not sure what youre doing, 
   because you wouldnt want to cause problems, would you?

                               -----Exodus-----