Copy Link
Add to Bookmark
Report
Phone Punx Magazine Issue 01
1
The Phone Punx Network Presents
--Phone Punx Magazine--
----Issue one----
"Carjackers of the Information Super Highway"
April 26, 1999
Last Updated: May 04, 1999
http://fly.to/ppn
phonepunx@yahoo.com
Contents
~Intro by Mohawk
~Seuss
-Better Homes and Telephone Surveillance
-Paper chase
~Security Breach
-NOKIA 2160 NAM PROGRAMMING INFO by Maniac
~Scamming by Nothing
~Beating the Caller ID by the Fixer
~Lineside
- LMOS/MLT CODES AND MEANINGS
- Field Techs and Wiretaps
~Controlled Environmental Vaults by Tom Farely
~Cyber Culture
- The impact of the flag burning amendment by Mr. X2
- Cyber McCarthyism by Mohawk
.....The Staff of Phone Punx Magazine.....
Mohawk..................Editor in chief
Seuss ......................FAQ editor/Head tech. writer
Czechmate...............Staff writer
Phear.......................Staff writer/Graphics
Admiral...................Staff writer
Lineside...................Staff writer
Black Axe...............Staff writer
Maniac....................Staff writer/Head writer of Security Breach
.....Magazine Information.....
-Disclaimer
All information is protected by the 1st ammendment. However, this
information should not be used in any other way except education.
Our purpose is to provoke thought and we might even entertain you,
if you're good. Nothing in this issue has been tested and we do not
garuntee that it will work. We cannot assure your safety both
legally and phsically and what the hell, mentally if you try anything
in this issue.
-Release Dates
Phone Punx Magazine is released about every 4 months, however there is
no set release date. Issues can come out a day or a year after the last
one but we will try to stick to around 3 to 4 months.
-Writers Wanted
We are always looking for more writers. If you want an article published
or if you would like to become a regular writers, send us an email. We would
really like to concentrate on phreaking and large phreaking projects. That is
why the release date for new issues is 3 to 4 months, instead of 2 months
like the OCPP. However, not all articles have to be related to phreaking.
We are experimenting with some new sections that will cater to our audience
with topics other then phreaking. If you feel that you have an article
that would be of interest to phreaks but it is about hacking, cyberculture,
etc, let us know and we will evaluate each article on an individual basis.
We are also looking for ways to compensate our writers for thier time and
effort in writing articles. We will add a link to your webpage but
we may also start a page where we will post a banner or two of your choice.
Any other suggestions are also welcome.
-Distribution Sites
Help us spread the magazine to a wider audience by becoming a
distro site. All you have to do is keep the issues on your website
with a link to them somewhere. Not only will this help us reach more
people, but our readers will have another place to get the zine if
something happens to the site. Email us before you set it up because we
need people to distribute the zine, past issues of the OCPP, and the
FAQ too. If you would like to distribute all 3, you will revcieve a special
link on our page because your just such a nice person.
-Network Links
The Phone Punx Network is more than just one webpage. We hope to span
several webpages that will encompass member websites and distro sites.
To get a network link you must be a staff writer or be involved with the
PPN in another way and have a website that is related to phreaking in some
way or another. If you can't do that, become a distro site and provide
a link back to us. A Phone Punx Network link graphic will be made soon
and must appear on the main page of the site (it won't be that big).
-Issue Updates
Issue updates will occur when the warrant. To make sure you always have
the freshest issue of PPM, check the "last updated" date on the top of the issue.
It is important that you always have the latest issue because we do screw up
often and we are always fixing our mistakes. To be notified of updates of the
issues, join the mailing list.
-Mailing List
To stay up to date with the latest in the Phone Punx Network sign up for the
mailing list. You will be notified of the release of new issues, updates to past
issues and other PPN news. All email address are kept confidential. Just send
an email to ocpp@hotmail.com letting us know you'd like to subscribe.
-Links
Please update your OCPP links. Change the name to Phone Punx Network and the
URL to http://fly.to/ppn, if you have a link to us on your page, let us know and we'll
link you back.
-Letters
We will print your letters. If you would like to make a comment, ask a question, or
whatever, send them in and we will publish them. If you don't want your letter
published, just let us know.
-Contact
Our email address is phonepunx@yahoo.com
To subscribe to the mailing list send an email to ocpp@hotmail.com
Copyright info is located at the end of the issue.
Intro
by Mohawk
Two years since the release of the first issue of OCPP, we are back with a
new name, look, purpose, writers, etc. Change is good. Where did we go, why the
change, what the hell is the PPN/PPM????? . Well let's start from the begining.
You might want to skip this whole paragraph if you don't want to read this
boring stuff but I do owe the readers an explanation. I warn you, it's nothing
exicting. Around the time of the release of OCPP 10, I was thinking about changing
the zine and the page to suit the ever changing needs and goals of our staff and our
readers. The zine grew into something I never thought posible. It was just a
little hobby thing by a couple of people but it wound up being a zine that had a pretty
big readership (with no outside help) which many people look toward as a sign of
authority, reference, help, etc. I still can't believe it that people refered to us
when they we're having problems with something or some people saying that we we're the
best zine. While some may or may not dispute that, it isn't our goal. Those we're just
people's opinions but it was still amazing to see that stuff. So I wanted to change
the format of the zine and the webpage. Between changing the zine and the webpage,
maintaining the FAQ, releasing a new issue, and all my real life activites I just
couldn't handle it all and I didn't want to release a half-done issue. Around
that time, most of the page went down due to someone canceling thier account where we
had most of our stuff. Now on top of that all those other things I had to do, I had
to put the page back up. A few months after that, ml.org went out of business so
almost all of our links were dead so we had almost no traffic coming to the site.
Life just kept swamping me with things I had to do but a couple people reminded me
around the same time about the zine and I decided I had to get to work on it any
chance I get.
As I said before, we changed everything to keep up with the changing needs
and goals with the zine and the readers. This zine will be forever changing and
we will be experimenting with new things. Your input will greatly affect what does
and does not go in the zine. Let us know what you like, don't like, or would like to
see in the zine. This will still be a phreaking zine but we will also cover other
topics such as cyber-culture, hacking, technology, and anything else that we feel
our readers might enjoy. We hope to focus on big phreaking projects so that is why
the projected release date has been made every 3 to 4 months instead of every 2.
The Phone Punx Network, or PPN is made of former OCPP members and other people
that help us out in one way or another. Some people are involved with writing the
zine, distributing it, writing the FAQ, or anything else that helps us out. By
dividing up the work, we are able to bring you a better product. The Phone Punx
Magazine is the zine put out by the some of the members of the PPN. Not all PPN
members are involved in the zine. All of this is still in it's early stages so this
is all subject to change. We are looking for people to get involved in the PPN, email
us for more info. Of course, we will always need articles and staff writers.
We hope that you enjoy the new format. Things will be changing constantly.
We also need people to update thier OCPP links. Change the name to Phone Punx
Network and the URL to http://fly.to/ppn, if you have a link to us on your page,
let us know and we'll link you back. Send us your comments, questions, and
suggestions. Also, this issue is a compilation of articles from the 10th issue of
OCPP that never came out and new articles. As we get established the quality and
quanitity of the articles will increase.
~Seuss
Suess maintains the Alt.Phreaking FAQ, visit the webpage at:
http://members.tripod.com/~SeusslyOne/
Better Homes and Telephone Surveillance
by Seuss
Tapping Phones is old (and black) hat to many phone phreaks. Keeping
your tap undetected for a long period is another matter however. Some
taps are so poorly made or implemented that spy-shop 'tap detectors'
will pick them up. Below are a few suggestions on how to keep your
surveillance on the down-low a little longer by using techniques and
tools somewhat more advanced than a beigebox.
* Physical hiding
No matter how well designed or installed, if the person you're
monitoring sees your device, you're screwed. Hiding your tap might seem
obvious, but remember to be creative. If possible, don't hide the tap
on or anywhere near their property. Tracing their line down to a little
used wiring cabinet far away is an option. Secreting away your tap in a
pedestal terminal or wiring enclosure is easier, but runs the risk of a
telco employee finding it. A common solution among 'pros' is to set up
a dummy demarc box or other official looking cover for their tap
(Foraging in the back of company cherrypicker trucks or the Graybar
catalog are the best sources for these things). If you're setting up a
fake demarc or have enough time and privacy to mess with a real
enclosure, find the connection point for the pair you want to tap and
draw traces from them to the back of the circuit board or connector
block with metallic paint. Paint over your traces and no one is likely
to be the wiser. Large wiring cabinets have fat bundles of wire at the
bottom of the blocks, why not secret your device away in the middle of
it or split the monitored pair here? The Phone Book by M.L. Shannon has
some excellent ideas on hiding phone taps and bugs.
* Defeating sweep procedures
Balance tests:
Resistive balance tests are a standard step in phone sweeps.
Effectively a technician measures the resistance from each side of the
pair to an earth ground and looks for discrepancies, as series taps
generate a large imbalance. (Yes, I know that a proper tech would
likely run a more accurate stress balance test) After installing a
series device, run a balance test yourself and add a potentiometer or
a few resistors so the line is more or less perfectly balanced (within
10 ohms should do it). Make sure the total resistance doesn't go up too
far, and remember that the line needs to be disconnected at the CO to
measure resistance.
Tone Sweeps:
Is anyone still using harmonica bugs? I hope not, as these are some of
the easiest things for a TSCM tech (or for that matter anyone who can
dial a tone sweep) to defeat. *DO NOT* use cheap tone activated taps or
bugs. For those of you with a DIY bent, using a series of DTMF tones to
trigger a device would be a much better option. You'll want to make a
note that wardialers might set one of these off. To overcome the
possibility of someone activating the tap by dialing the phone, use A B
C D tones or start the code with something a customer usually doesn't
dial (like X11 codes that are out of use in your area).
Resistance and Capacitance checks:
The most obvious way to check for phone taps is to measure the
resistance of the line under the correct conditions. If the resistance
is much higher than it should be, there's likely something there.
Logical. BUT if the line contains a bridged tap or the cable is
(physically) wet, the resistance of the loop is altered. If your tap
resides on a line with such a flaw, anyone checking the line will
likely chalk the resistance discrepancies up to the bridged tap after
checking for AC faults. For those of you lacking the several thousand
dollars for a line analyzer to determine bridged taps etc. yourself,
call the phone company and ask about having 'your' line tested for ISDN
or DSL readiness. In order to qualify for high speed services a line
must have minimal amounts of bridged taps and no loading coils.
Time Domain Reflectometers:
These things are stock tools of the TSCM trade and the phone company. A
TDR can map out almost anything on a line (like your tap) if used
properly. It's unlikely that you'll have to worry about a TDR being
used to find a tap unless you attempt to surveil a big company or
government agency. Hooking up your tap up behind a loading coil and/or
behind a bridge tap will help obfuscate it, but it can still be found
through near end/far end crosstalk analysis (its an even bigger pain in
the ass than it sounds).
* Tricks for sneakier taps
Coils and Hall-Effect transistors:
Using an induction coil (or electric guitar pickups...) around the pair
will make for a VERY hard to detect tap. Theres a debate about the
ability of even a good waveform TDR to find such connections. Hall
effect transistors give the same result, but with better audio.
Splits:
Split the pairs and make a sweeper miserable. Find a dead pair in the
same binder group as the pair that you want to monitor, and connect it
to the pair you want to tap tip to tip and ring to ring and put your
tap on that. Anyone finding it will likely chalk it up to an old
splice.
Series taps:
Install series taps as close as possible to the target telephone.
Putting a series imbalance (like the one caused by a tap or dropout
relay) in an area of high current (near the CO) creates a hum on the
line. This is an important point if you're intercepting data. Modem
users tend to notice when several kbps are chopped off their connect
speed overnight due to line noise.
Parallel taps:
Install parallel taps as far as possible from the subject phone.
Methods of sweeping using o-scopes in conjunction with a tone sweep are
less and less effective the farther away the device is.
DATUs:
Using the audio monitor of a DATU would be the greatest way to monitor
a phone, but to the best of my knowledge no one has done it yet. Due to
the problem of how the signal is inverted, its quite possible that it
can't just be reinverted into clear speech. If someone finds out,
please drop me a line.
Paper chase
by Seuss
I've noticed most phone phreaks are rather disorganized. I, quite
frankly, don't give a damn about the state of other people's living
spaces; until someone loses a manual or document of MINE in their
tide of crap. If the idea of pissing off your compatriots doesn't
bother you terribly, what about rooting through your stuff struggling
to burn credit card receipts after you're tipped off that the feds
are preparing to come a'knocking.
Before you start overhauling all your paperwork it's important to
distinguish between notes and archives. Your notes should be in a
small, unobtrusive notebook. In here you should have the dialups,
passwords, et. al that you use on a constant basis. Archives are
your reference library; things that you don't need at your side
24/7. Archives can be squirreled away with minimum
inconvenience.
Keep your archives together. A filing box is ideal if you have a slew
of loose stuff. Accordion folders are great for smaller collections.
If you go trashing a lot get a heavy cardboard box too so you can throw
your unsorted papers somewhere. Make an effort to empty and sort it
regularly. Locking up your documents might be a good idea if you have
nosy siblings/roommates/parents. Remember to keep a spare key somewhere
in case your first is lost, or you want someone else to open your files
in an emergency. Note: cover plates for light switches make ideal
places to hide keys.
Be picky about what you keep in your archives. Credit card receipts,
cellphone contracts and other incriminating documents should have the
important parts transcribed and the originals be disposed of ASAP.
If you want to get rid of something do it right and destroy it. I
don't care what claims pen companies make about "indelible" ink,
lighter fluid or WD-40 has dissolved every ink I've ever run
across. Most phone phreaks are broke, so buying a shredder is
usually out of the question. For those of you with greater resources
try to spring for a cross shredder, as it reduces paper to
confetti. Burning docs is cheap, effective as anything, and can
usually be done quickly. Having a special furnace or burn box for
emergency burning is the best idea. Remember that grinding ash to
powder also helps, and that many plastics generate toxic fumes.
Digital documents require different handling, but allow you to show
off more of your cleverness more in hiding them. No matter what, you
must ENCRYPT YOUR FILES!!! From here you can interlace your docs
into .gif or .jpg files, insert them into program as comments in
the code (I have a copy of my phone directory in a copy of PGP I
compiled myself), or post them on webservers as undisplayed files
(especially handy in case of formats, crashes, beer spills,
etc). Remember not to hide files on your k-rad phreaking page, put up
an innocuous front.
I've accumulated ALOT of stuff in my time, and a lot of it I keep
on tape. After a minute of so of music have recordings of you
reading off dialups, passwords, notes, or whatever else you might
have. If you have a passion for older computers, many of them held
data on audio tape.....
~Security Breach
Maniac
Read back issues of Security Breach on the PPN zine archive.
NOKIA 2160 NAM PROGRAMMING INFO
by Maniac
1. NOKIA 2160 NAM PROGRAMMING INFO
(Maniac note: this is verbatim from the the original sheet. I can probably scan the
original sheet for those who are interested. It has some display pictures on it,
which I can't include in text.)
NOKIA MOBILE PHONES, INC.
FOR AUTHORIZED DEALER USE ONLY
NOKIA 2160 SERIES CELLULAR TELEPHONE
NAM PROGRAMMING INSTRUCTIONS
All Nokia 2160 cellular telephones are capable of supporting authentication. The
programmer must decide which form of A-Key is desired for use. The two options are
either RANDOM or DEFAULT A-Key. If the RANDOM key is desired for use, use the quick
NAM programming sequence. If a DEFAULT A-Key is desired, then the complete NAM
programming method is used to program NAM location number 2. The clear key can be
used to correct mistakes.
MENU DRIVEN EASY NAM PROGRAMMING FOR THE NOKIA 2160 P2/EFR HANDPORTABLES
USE FOR A RANDOM A-KEY
1. Turn on the phone and enter programming access code (*#639#)
2. Enter the 10 digit area code and phone number and press the 'send' key (or the 'OK'
soft key in display)
3. Enter system ID code (SID) supplied by cellular service provider (1-5 digit SID) and
press the 'send' (or 'OK' ) key.
*Optional settings are language and lock code (see below)
*Programming is completed
*Phone automatically powers off then back on NOTE: Change the lock code by adding a
pound sign and a new lock code after the SID. (Example: 175#7788 ; Lock code = 7788).
Change the language by adding a pound sign and a new language code after the code
(Example: 175#0 ; Language = English). Language code: 0 (default) = English, 1 =
French, 2 = Spanish, 3 = Portuguese Change the lock code and language code by
separating each set of numbers by a pound sign (Example: 175#7788#2 ; where the
SID = 00175, Lock code = 7788,Language = Spanish).
COMPLETE NAM PROGRAMMING INSTRUCTIONS
USE FOR DEFAULT A-KEY
ACCESS NAM PROGRAMMING MODE:
1.Turn the phone on.
2.Enter the NAM access code. Factory default is: *3001#12345[MENU]
3.If the screen to the right appears, you have entered the access code correctly.
(Maniac note: screen to the right looks like this: see below
Field Test
NAM 1
NAM 2
If it does this you're in luck)
If after several attempts you cannot access NAM programming, it is possible that the
access code has been changed, or the phone is in need of service.
MAIN MENU SELECTION
4. Press the [Scroll-Key] up or down until the indicator points at the desired menu
option. Select from the following:
NAM 1 NAM 2 NAM 3 Security Emergency
SW version Serial No. Programmed Field Test
5.Press the [Select] soft key to access the Sub-Menu from and of the above Main
Menu selections.
PROGRAMMING NAM's 1 THROUGH 3
6. Press the [Scroll-Key] to scroll through the selected NAM parameter list. An
optional personalized wake-up message can be programmed during the "Own Number"
sequence by pressing the [ABC] key and entering the text.
7. If the value is incorrect, press the [Select] soft key and use the numeric keypad to make
any changes.
HOME SYSTEM ID HOME SOC OWN NUMBER
PSID/RSID LISTS(Note 1) DEFAULT SETTINGS
"DEFAULT SETTINGS"
NAM STATUS (Enable/Dis) ACCESS METHOD
LOCAL OPTION PRIMARY PAGING CH
DEDICATED A CCH DEDICATED A NUMBER
DEDICATED B CCH DEDICATED B NBR
OVERLAOAD CLASS GROUP ID
SID ALPHA TAG CNTRL A-KEY CODE
PUBLIC SYSTEMS PRIVATE SYSTEMS
RESIDENTIAL SYSTEMS
8. Use the [OK] soft key to store the new information that has been entered.
9. Repeat steps 6 through 8 for the remaining NAM parameter options to be viewed and/or
changed.
10. To program other NAMs, press [Quit] to return to the Main Menu. Select NAM 2 or NAM 3.
Once the Home System ID and Own Number are programmed, the phone will automatically set
the NAM Status to enabled.
PROGRAMMING THE SECURITY CODE:
11. From the Main Menu, use the scroll keys to select the "Security" Sub-Menu, then press
[Select] and the current 5-digit security code will be displayed. The default value is 12345.
12. To change the Security Code at this time, use the numeric keys to enter the new value.
13. Press the soft key [OK] to store changes. Note: The Lock Code will be automatically
changed to the last 4 digits of the new security code.
PROGRAMMING EMERGENCY NUMBERS:
14. From the Main Menu use the scroll key to select the "Emergency" Sub-Menu, press the
[Select] soft key to access the emergency numbers.
EMERGENCY NUMBER 1 (911)
EMERGENCY NUMBER 2 (*911)
EMERGENCY NUMBER 3 (None)
15. To change the current value, use the scroll key to select the desired field and
press [Select]. Use numeric keys to enter new values.
16. To save the value, press the soft key [OK]. Press [Quit] to exit the menu.
SERIAL NUMBER (ESN):
17. From the Main Menu, use the scroll key to display the "Serial No." or ESN of the phone.
Press [Quit] to exit the menu
PROGRAMMED: (DATE THE PHONE IS FIRST PROGRAMMED)
18. From the Main Menu, use the scroll key to display the "Programmed" menu
19. Press [Select] and enter a four-digit number that corresponds to the month and year the
phone is sold. Example (mmyy) 0197 = January 1997, 0996 = September 1996.
NOTE: This menu location can be programmed only one time. Once the date has been
entered it cannot be changed. Any attempt to enter the menu once it has been programmed
will receive a short beep and the message "DATE ALREADY STORED". EXITING NAM
PROGRAMMING:
20. To exit the NAM programming mode, turn the phone off and leave it off for five seconds.
DEFAULT CODES:
Lock Code = 1234, Security Code = 12345
System Acquisition; Public/PSID/RSID Access Code = 123456.
FIELD TEST:
The FIELD TEST MODE is used to investigate how the phone is reacting to the cellular
system. The FIELD TEST information covers signal strength, battery charging status,
cellular state and encryption status. The information is designed to display information
relating to Analog Control Channels, Digital Control Channels, Analog Voice Channels,
and Digital Voice Channels. All the information provided in the FIELD TEST display is in
accordance with IS-136.
To activate the FIELD TEST mode you must be in NAM programming. Instructions for
entering NAM programming are on the opposite side of this page.
(Maniac note: In this case, opposite side means see above).
Use the following steps to enable the FIELD TEST mode.
From the Main Menu use the scroll key to display the "FIELD TEST" menu and press the
[Select] soft key. Use the scroll key to select Enable and press the soft key [OK]. A second
option is available to enable the field test display with back lighting constantly illuminated
while connected to a car kit.
Turn the 2160 off then back on. Once the power up self-test is complete, the FIELD TEST
display will begin automatically. Scroll through the different displays using the scroll key.
To disable the FIELD TEST mode, return to NAM programming and disable the function
under the FIELD TEST menu.
PROGRAMMING PSIDS AND RSIDS:
The Nokia 2160 provides the option to program Private (PSIDs) and Residential (RSIDs)
System ID's as prescribed by IS-136. The PSID/RSID list is programmed to support
system selection/re-selection processes and SID display functions. The Nokia 2160 P2
product will support up to 15 different Private or Residential Systems. These instructions
allow a person to program 5 of the 15available locations. The other 10 locations are
reserved to ensure available locations for automatic programming. Using the NAM
programming menu to program the PSID/RSID is just one of the several ways that this
information can be programmed. The phone also supports automatic programming of the
PSID/RSID values via registration accept message from a Public & Private system, manually
prompting with System Scan Sub-Menu option New Search, or via Over the Air
Programming. Follow these instructions to program the PSID/RSID lists
1. Enter the NAM programming menu and select NAM 1 (or desired NAM).
(Note: PSID/RSID is currently only available in the NAM 1 location. PSID is included in
NAM 2 and 3 for future use.)
2. Use the scroll key to display "PSID/RSID LISTS" and press [Select].
3. Use the scroll key to select the P/RSID 1 or the desired P/RSID (1 through5).
Press the [Select] soft key.
4. Each list contains:
SYSTEM TYPE:
Select Private or Residential system type.
PSID/RSID: System ID of the Private or Residential system. Indicates which
PSID/RSID the mobile will respond to.
CONECTED SYSTEM ID: Connected System ID. The SID that the PSID/RSID is
connected to.
ALPHA TAG: The name of the Private or Residential SID that will be displayed
when the phone uses the PSID/RSID.
OPERATOR CODE: (SOC) This is the System Operator Code.
US-AWS=001,
Canada-Rogers CantelInc.=002,
Bell South Cellular=003,
Southwestern Bell Mobile Systems=004,
Vanguard=007, Century Cellunet=008,
Pacific Telecom Cellular=009,
Midwest Wireless Communications=010,
Rural Cellular Corporation=011,
Cellular Mobile Systems of St. Cloud=012,
Palmer Wireless Inc.=014
COUNTRY CODE: Enter the Country Code of the PSID/RSID.
PUBLIC SERVICE PROFILES: Contains up to 4-channel and color code values for
each private or residential system. This information is necessary to initiate scanning
for the Private or Residential System.
PRIVATE OPER. FREQUENCIES: Enter the actual channel number(s) that the private
system uses. Up to 4channels per PSID/RSID are allowed.
---------END----------
Unfortunately, I don't own this model of phone, so I couldn't test any of this information.
But it's straight off the manufacturer's sheet, so it should all be correct. I did have to fix
a few typos though...Maniac
Scamming
by nothingg
Six Flags Great Adventure:
Well now right away don't be distracted by the fact that I put
Great Adventure. For all I know these could work at ANY theme park,
but I FOR SURE know they will work at Six Flags Parks, and I have
experience at Great Adventure.
1. Employee Notice
2. Ok, so how do I get in?! I'm broke!!!
3. Whew! It's hot! I need a drink, but I'm still broke!!!
4. Ai-ite, it's night, but now I'm hungry, and still broke!!!
5. Hey check out this laser tag game, however, I'm broke!!!
6. How would I go about changing my monetary status?
7. I need to go home, but my redbox's all wet and I have no change!!!
1. Well, if you work there, like I no longer do (I quit) DON'T BE A
FOOL! Don't even attempt to steal money and watch it while sneaking
a pretzel or churro or funnel cake, They're watching. By they I mean
the Loss Prevention Department. They're high tech bastards. Ok, ever
see on TV those tiny pencil point type cameras? Oh yeah, they use
those, ALOT of them, and they don't just monitor, they RECORD. I've
seen too many friends go down like this. Stealing money WILL get you
caught. By the way, don't pull ANY of these Six Flags scams
if you work there or plan to work there, many employees will
recognize you and report you. This is a precaution, do what you
want, but as a FINAL warning, PLEASE be careful, and ALWAYS remember,
you leave footprints wherever you walk, COVER THEM GOOD!
2. On to the goods. You're standing outside the gate. You do
NOT have a ticket. How the hell are you going to get in?! Well,
ALAS, there is only one way I know of. Great adventure uses a stamp
that can barely be seen as a yellow stamp, but glows in the black
light. Now many of us have this stupid SpyTech inkpad which can
only be seen in the dark. If you have that you're so set, smear
some on your left hand and walk into the re-enter gate. If they ask
questions get REALLY bitchy and say you aren't a slob and you wash
your hands, it seems to be smeared, anyhow, bitch until you get in,
whatever you do DON'T GIVE UP. That's how you get caught. Well, in
the case that you have NO IDEA what SpyTech is cuz you weren't an
eleet little kiddo like I was, you're not out of luck! As long as
someone in your party, preferably a clean someone, has a season pass
or a ticket. In this case, let them go in, then they should come
out and get their hand stamped. Next they should find a secluded
place to meet you. Now comes the cool part, Lick your hand, get it
really wet (you could always use the water fountain, but saliva
ALWAYS seems to work better). Smack your left hands' together
until the saliva/water forms an airtight seal, and PRESTO! you
are both stamped! Now, don't be an idiot and come in at the same
time as your friend, people may get suspicious.
3. Ok, so now you're hot, thirsty, and broke, right? Get over it,
go to the water fountain! Haha, just kidding. Now the only choice
is do you want soda or water? Water is the easy one, go up to a stand
with a soda fountain and say, can I have some icewater, but none of
that expensive poland spring shit. Now, soda's a little trickier.
You'll have to be with another person for best results. Go up to a
stand with a fountain and say, my friend and I both want
some water, can we have it in a big cup so we can share it? Now cups
aren't counted so they'll usually be happy to oblige, and if they
aren't...BITCH! The customer is #1 all the time, they'll give it to
you. Now, I know what you're thinking, now I just have a big water
idiot! Well, spill it out, or drink it if you so desire. Go up to
another stand that has a fountain (out of sight from the first> and
say that you spilled your soda/juice. They'll give you a new
one, company policy, and even if they don't believe you, just act
cool and don't worry, they'll do it, it's company policy.
4. Hungry eh? Well you have a few options here. You can get
anything for free, no problem. Lets start small: fries. Make
sure you know exactly what you want. Lets say you want fries and a
burger. Go to a place that has MANY ordering windows. Go up to one
and say you dropped your burger and fries, but make sure you remember
EXACTLY what you told them you dropped. They should give it to you
no problem, and if they don't, you guessed it, BITCH. Now if they
ask you WHERE you dropped it, just say oh, over by the (insert ride
name here), some asshole bumped into me, he didn't even apologize
(go on until they're sick of you're little spontaneous story) and
they'll give it to you. Now, if you want to risk getting thrown out
of the park, go for the biggs. There are two big places in the park
to go to: the grill and the pizza place. Now, lets say you want a
4 person order of ribs, which comes to like $40. Now that's a scam,
so take your time and stalk the restaurant. Wait until you see one
of the cashiers get replaced and when the supervisor who
accompanied them leaves, and get on their line. If for
some reason you get on the line of a cashier who's been around, abort.
Now once you get in this person's line and remember your order good
<ie. 4 orders of ribs and 4 cokes> and come up with an exact place
where you "dropped it" and a BIG story, and STAY calm while keeping
in mind, it IS company policy to replace dropped food. Tell the
cashier what you dropped where you dropped it and your sob story.
Now, first thing they'll ask you is, do you have you're receipt? Of
course you don't so search your pockets and after pulling out no
receipt say that it must have been on one of the trays. Now the
next question they'll ask is where you dropped it so they can get
someone to (wink)(wink) clean it up. A.K.A. check out if you really
dropped it. Your response must be immediate and sound something
like: well when I dropped it these grounds guys wearing green
clothes said they'd clean it up for me and told me that I could get a
replacement. This should get you either food or a manager. If
you get a manager, retell the SAME story and they'll probably
ask you to sign something which you should proceed to do with
a false name. If none of this works walk away cursing under your
breath loud enough for them to hear you and loudly say,
I am going to complain, and I'm never coming back to great
adventure again (loud enough to get everyone in the
restaurant's attention). If this STILL doesn't work, then you're
out of luck, keep walking.
5. Well, if you've never played laser tag, definitely pull this
one off. All you have to do is pay for a game, play it, and there's
a big timer at the top, when it gets down to the last minute, scream
for the attendant and act VERY frustrated with your laser. Tell him
it doesn't work and it hasn't worked since the game started, act really
bitchy and shake the laser. When he tries it say "See, see!!!" He'll
say that it's working perfectly. But you must claim that it isn't.
By now the game should be over, and you've had your 14 minutes. Now
bitch to the attendant at the desk and he'll either give you a
refund or a free game, and if you don't want the free game, bitch
until you get a refund!
6. No money? Need money to play Area 51 at the arcade and try to
beat me but I am #1 (NIN) anyhow, perhaps you want to win a souvenir
for you're girlfriend. These are too risky to scam, so here's what
you do. Walk around the park, find 2 arcades and 2 soda machines,
the expensive bottle ones. Now tell the attendant you stuck a dollar
in the change machine and no change came out, tell them you stuck 2
dollars into the soda machine but the light blinked and NO soda came
out, and you pushed ALL of the buttons, you should come out with
around 6 bucks, more than you had before. This is a fairly well
known trick, but whatever you do, do not claim to have put a $5 in
because they open the machine and look at the last 3 bills, and if
none of them are $5's, they warn the park about a possible scammer
and you're screwed out of ANY type of scamming.
7. Now this one is kind-of Great Adventure specific. There is a
giant chair that morons pay like $10 to get their picture taken in.
At night the chair is closed due to lack of light. BEHIND the chair
is a phone. Since you're a Phreakish Punk, pick it up dial 9, your
area code and your number. And nobody will notice, because you are
behind a GIANT chair! Anywhere else, just look for
a phone with nobody around and use it, be careful though.
Thanks for putting up with my typos and I hope this has taught
you a bit about scamming Six Flags to death, but wait! There's
more, non-six flags scams!
Ok, here's the generic scam section.
1. I'm at the movies, but drinks are $3, help me!
2. Mall + Broke + Hungry = scam!
3. Final Note (Springer)
1. Well here's the deal, go over to a garbage can and pull out a cup.
Most movie theaters offer free refills. Take a key or any sharp object
and poke a tiny hole in the bottom of the cup. Now splash some water
on your shirt in the bathroom or at the water fountain. Bring the cup
to the attendant and say I'd like a refill of (insert beverage here)
but my cup has a leak man, can I get a new one? They'll give you a
new one, with unlimited refills of course.
2. Ok, so you have the situation set up what are you going to do?
Well, all these Chinese places are willing to give out samples and
so is roli boli. Pass by those places and pick up some samples.
Now put a hat on and get some more. Next it's time for desert. Go
over to McDonalds and say can I have a free sample of ice cream.
They'll give it to you, in a nifty little cone too.
3. Well as my final note, I'd like to say that neither nothingg (me)
or the PPN or the Twisted Nickel endorse using any of these methods
to rip off evil domineering companies nor to we encourage using these
methods. I am merely pointing out the many flaws in a system thought
to be perfect.
~ nothingg
Please send any questions to n0thingg@hotmail.com
Beating Caller ID
by The Fixer
v.1.03
(C) 1998 The Fixer's Tech Room
For free distribution - you may freely repost & distribute this but not
for profit without permission of the author. See further restrictions
at the end of this file.
To start off with - 12 Ways to beat Caller ID
(0) This doesn't count as a way to beat CID, but there's a general
principle to consider when contemplating ways to beat CID.
Generally, the CID signal your target sees corresponds to the owner
of the dial tone you call him from. If you call direct, you dial
from your own dial tone and your line is identified. If you call a
third party, and by whatever means manage to acquire his dial tone,
and from there dial out, it is the number associated with that
second dial tone that your target sees. Some of the ideas following
this were developed with this basic idea in mind.
(0.5) This also doesn't count, but remember that beating Caller ID as
such is only the first layer of your protection. If your calling is
sufficiently annoying or criminal, there is *always* a paper trail
(ANI data, billing data, trouble reports, *57 traces, etc) leading
back to the phone you first called from. That trail is not always
easy or worthwhile to track you down with. Whether or not the trail
is followed depends entirely upon how pissed off your target is and
how much co-operation he can get from the phone company, law
enforcement, etc.
(1) Use *67. It will cause the called party's Caller ID unit to
display "Private" or "Blocked" or "Unavailable" depending on the
manufacturer. It is probably already available on your line, and if
it isn't, your local phone company will (most likely - please ask
them) set it up for free. This is the simplest method, it's 100
percent legal, and it works.
(2) Use a pay phone. Not very convenient, costs 25 or 35 cents
depending, but it cannot be traced back to your house in any way,
not even by *57. Not even if the person who you call has Mulder and
Scully hanging over your shoulder trying to get an FBI trace (sic).
Janet Reno himself couldn't subpoena your identity. It's not your
phone, not your problem, AND it will get past "block the blocker"
services. So it's not a totally useless suggestion, even if you
have already thought of it.
(3) Go through an operator. This is a more expensive way of doing it
($1.25-$2.00 per call), you can still be traced, and the person
you're calling WILL be suspicious when the operator first asks for
them, if you have already tried other Caller ID suppression methods
on them.
(4) Use a prepaid calling card. This costs whatever the per-minute
charge on the card is, as they don't recognize local calls. A lot
of private investigators use these. A *57 trace will fail but you
could still be tracked down with an intensive investigation (read:
subpoena the card company). The Caller ID will show the outdial
number of the Card issuer.
(5) Go through a PBX or WATS extender. Getting a dial tone on a PBX is
fairly easy to social engineer, but beyond the scope of this file.
This is a well-known and well-loved way of charging phone calls to
someone else but it can also be used to hide your identity from a
Caller ID box, since the PBX's number is what appears. You can even
appear to be in a different city if the PBX you are using is! This
isn't very legal at all. But, if you have the talent, use it!
(6) I don't have proof of this, but I *think* that a teleconference
(Alliance teleconferencing, etc.) that lets you call out to the
participants will not send your number in Caller ID. In other
words, I am pretty sure the dial tone is not your own.
(7) Speaking of dial tones which aren't yours, if you are lucky enough
to live in an area with the GTD5 diverter bug, you can use that to
get someone else's dial tone and from thence their identity.
(8) Still on the subject of dial tones that aren't your own, you can
get the same protection as with a payphone, but at greater risk,
if you use someone else's line - either by just asking to use the
phone (if they'll co-operate after they hear what you're calling
about) or by the use of a Beige Box, a hardware diverter or bridge
such as a Gold Box, or some other technical marvel.
(9) This won't work with an intelligent human on the other end, it
leaves you exposed if the called party has a regular Caller ID box
with memory, and has many other technical problems which make it
tricky at best and unworkable for all but experts. A second Caller
ID data stream, transmitted from your line after the audio circuit
is complete, will overwrite the true data stream sent by the telco
during the ringing. If the line you are calling is a BBS, a VMB, or
some other automated system using a serial port Caller ID and
software, then you can place your call using *67 first, and then
immediately after the other end picks up, send the fake stream. The
second stream is what the Caller ID software processes, and you are
allowed in. See the technical FAQs below for an idea of the
problems behind this method; many can be solved.
(10) Someone in alt.2600 (using a stolen AOL account, so I can't credit
him or her properly) suggested going through 10321 (now 10-10-321)
or 10288. Apparently using a 10xxx even for a local call causes
"Out of Area" to show up on the Caller ID display. I live in Canada
where we don't have 10xxx dialing so I can't verify nor disprove
this.
(11) There are 1-900 lines you can call that are designed to circumvent
Caller ID, ANI, traces, everything. These services are *very*
expensive, some as high as $5.00 a minute, but they include long
distance charges. This was first published in 1990 in 2600
magazine, and in 1993 the IIRG reported that 1-900-STOPPER still
works. Beware - even if you get a busy signal or no answer, you
will get charged at 1-900 rates! Another one published in 2600 in
1990: 1-900-RUN-WELL. That one supposedly allows international
calls. I'm not about to call either one to find out. Note that you
could still be caught if the operators of these services were to be
subpoenaed.
(12) Use an analog cellular phone. Most providers of plain old analog
service show up on Caller ID as "Private" or "Out of Area" or a main
switchboard number for the cell network. This is becoming less and
less true as cellular providers move to digital cellular and PCS,
which pass the phone's number on Caller ID. Corollary: Rent a
cellphone by the day. This might even be cheaper than using a
prepaid phone card.
How Caller ID Works
Caller ID is a data stream sent by the Phone Company to your line
between the first and second ring. The data stream conforms to Bell
202, which is a 1200 baud half-duplex FSK modulation. That is why
serial Caller ID boxes run at 1200 baud.
The data stream itself is pretty straightforward. Here's an example:
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU'^D 032415122503806467x
The first thing of note is the 30 U's. Those are actually sync pulses.
A "U" is 55 hex, or 01010101 binary. This is called the "Channel
Seizure Signal."
After that comes 130 milliseconds of 1200 Hz (the Bell 202 "mark"
frequency) which usually shows up in the datastream as a character or
two of garbage.
That is followed by the "message type word", which is 04 hex for
standard Caller ID, 07 hex for Name & Number. A word, by the way, is 8
bits for our purposes.
That is followed by the "message length word" which tells us how many
bytes follow.
The next four bytes are the date, in ASCII. In the example above, the
date is 0324, or March 24th.
The next four bytes after the date are the time, also in ASCII. In the
example, the time is 1512, or 3:12pm.
The next 10 digits is the phone number that is calling. In the
example, the phone number is 250-380-6467. The number is also in ASCII
and doesn't contain the hyphens. Some phone companies will leave out
the area code and only transmit 7 digits for a local call, others will
always send the area code as well.
If this were a name-and-number Caller ID data stream, the number would
be followed by a delimiter (01h) and another message length byte to
indicate the number of bytes in the name. This would be followed by the
name itself, in ASCII.
If this call originated from an area that doesn't support Caller ID,
then instead of the phone number, a capital "O" is transmitted (4F hex).
If the call was marked "private" as a result of the caller using *67 or
having a permanent call blocking service, then instead of the phone
number, a capital "P" (50 hex) would be sent.
The very last byte of the data stream is a checksum. This is calculated
by adding the value of all the other bytes in the data message (the
message type, length, number and name data, and any delimiters) and
taking the two's complement of the low byte of the result (in other
words, the two's complement of the modulo-256 simple checksum of the CID
data).
Some Technical FAQ's
Q: When I block Caller ID with *67, does it send my number anyway and
just set a "private bit" so that the other person's Caller ID Display
unit won't display it?
A: No. The person you're calling doesn't get your phone number anywhere
in his data stream if you block your call that way. All he/she gets
is "P" and the date/time of the call.
I would like to refer to an experiment I performed in March, 1998
with a Serial Port Caller ID, which delivers the raw data stream to a
PC for software interpretation. The following Usenet message (edited
for this file) is the report I published on that experiment:
Newsgroups: alt.2600
From: The Fixer <fixer@bc1.com>
Date: Tue, 24 Mar 98 16:12:58 -0800
Subject: Caller ID and *67 - The Facts
OK, it's time to shovel the bullshit that is piling up in this
newsgroup about Caller ID.
A few people are saying that when you block your Caller ID with
*67, the switch sends your number anyway along with a so-called
"private bit" that tells the Caller ID display unit to suppress
display of the number.
In order to squelch those who'd rather flame back with "show me
proof" than just read a FAQ, here is the proof. These are
actual raw data captures from a Bell 202 demodulator (better
known as a serial port Caller ID) which I captured myself today.
They prove conclusively that the "Private Bit" is a myth.
Here is what I got in my raw data stream when I called my voice
line from one of my BBS lines (which is unlisted, hence the
PRIVATE string in the name field):
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU'^A^H03241512^A2503806467^G^OPRIVATE x
This is what I got when I did the same thing with *67:
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUU^P^A^H03241512^D^AO^H^AP(ÿ
The number I was calling from was 250-380-6467. That string is
clearly displayed in the first (non *67) call. In the number
field of the second call, only the letter "O" is transmitted.
In the name field, only the letter "P" is transmitted.
In both calls, the date and time (03/24, 15:12) is transmitted,
but transmission of the calling telephone number is suppressed
in the second call. There is no "private flag" suppressing
display of the number by the display unit; the calling number is
not transmitted at all!
For those of you unfamiliar with the CID raw data stream, the
U's are actually sync pulses (an ASCII "U" is 01010101 binary).
The control characters are field delimiters. The first 8-digit
number is the date and time in MMDDHHSS format. The second
number in the first call is the phone number, in NPANXXXXXX
format. That is followed by the name (for those of us with name
& number CID). The ^O (0Fh) just before the name indicates how
many characters are in the name - in this case "PRIVATE" is
padded out with 8 spaces (20h) to make 15 characters. At the
very end is an 8-bit checksum.
Believe me, if I were wrong about this, there would be a huge
marketing frenzy to sell "*67 proof Caller ID boxes" and I would be
making a fortune selling my Serial Caller ID software, which works
directly with the data streams illustrated above!
Q: Can't I just send noise down the line to scramble the Caller ID
signal between the rings?
A: No. Your phone line doesn't generate the Caller ID signal. It is
made by the switch on your calling party's line, and the audio
circuit between your line and his is not completed until after he
picks up the phone.
Q: Do 1-800 numbers have Caller ID? Can I hide my identity from them?
A: Some do have Caller ID, and the *67 block will work, but many more
have real-time ANI - Automatic Number Identification. This is an
older technology which uses a separate line to deliver your number,
and cannot be blocked. And all 800 subscribers get a list of
everyone who called them on their monthly bill, blocked or not.
Q: Can I hide my identity by sending a fake Caller ID signal down the
line before they answer?
A: *Generally*, no. The audio circuit between your phone line and their
line is not completed until the other party picks up. Once they do,
they would hear your fake signal and know what you were doing...
unless the person you're calling is very poorly informed or
untrained. Even so, most Caller ID devices have memory and so the
person you're calling could just as easily scroll back through the
box's memory and find your true number.
Once upon a time, the phone system worked differently, and the audio
circuit WAS connected even before the called party picked up. A
device called a "mute" or a "black box" was used to take advantage of
this fact and allow anyone calling a line with a black box to do so
toll-free. If the system still worked that way (and there's no
technical reason why it couldn't in these days of digital switching)
then yes, it would be very feasible to send a fake Bell 202 data
stream down the line; in fact you'd hear the real one every time you
called someone with Caller ID and you'd get a really good feel for
the timing involved. But if it worked that way, then black boxes
would also still work, and they don't.
Q: How about *69? If I protect my call using *67, can they still call
me back?
A: Not in 604/250 anyway, and probably not most places.
Some interesting notes about this: When *69 was first introduced
here in 250, if you tried to *69 a blocked call, you would get a
recording telling you that the number could not be announced. And it
would then offer to connect you anyway! I guess it was business who
asked for the change because that meant a telemarketer using *67
would have people call back and their switchboard answer "Sleazebag
Marketing, how can I help you?". At that point the number was a
white pages lookup away. So BC Tel, and I would venture to guess its
parent company GTE and many others, changed it so that *69 won't even
call back.
If you find in your area that you CAN call back with *69 to a *67
protected number, you're a lucky sonofabitch! Why is that? Well,
with the "old" working of *69, you may still be able to get the
number of a blocked caller if you are (a) lucky and (b) patient. Take
your phone off the hook until midnight (if it's a business) or early
afternoon (if it's a person). THEN activate *69. No incoming calls
will have come into your line since it was off-hook, so your line's
*69 last-call register will still have their phone number in it, and
at those times you are far more likely to get an answering machine
which may spill the beans as to who called you... clever huh?
Final Word
Caller ID can be worked around in so many ways that it really offers no
value to its subscribers. I am not against the existence of Caller ID,
as I have been on the receiving end of harassing phone calls and slimy
telemarketers, all of whom I've been able to put in their place thanks
to this technology. There's no doubt that Caller ID can help bring
those who deserve it to justice. But at the same time, we all have the
right to privacy, and the option to not share your identity with someone
you're calling is, and always should be, available.
For this reason, I think that Caller ID should be available free on
every line as part of the basic service. It's worth nothing anyway!
---------------------------------------------------------------------------
That's it. This file may be updated as I receive more information.
Look for updates on my web site at
http://techroom.base.org
or if that doesn't work,
http://bc1.com/users/fixer
---------------------------------------------------------------------------
This file is a freely-distributable copyrighted work. You may repost
this file free of charge without modifications, but no for-profit
distribution is allowed without prior arrangement with the author.
Two individuals who have stolen my work in the past are hereby
prohibited and enjoined from possessing or distributing this file:
Pinhead the Cenobite and Jolly Roger. If you are either of these
individuals, you must delete this file from your system now. If you are
not, you may not knowingly allow either of these individuals to receive
this file if it is in your power to prevent such reception. Retention
of this file on your system or on any backup constitutes acceptance of
this term.
(C) Copyright 1998 The Fixer's Tech Room, a division of Whirlwind
Software (British Columbia). All rights reserved.
~Lineside
LMOS/MLT CODES AND MEANINGS
assembled by Lineside
If you didn't know, LMOS stands for Loop Maintenance Operating
system, and MLT is the mechanized Loop Test. The following are codes and
their meanings for the BellSouth LMOS. They may however be similar, the same
or totally different in other areas. Hopefully someone out there will put
these to good use.
OUTSIDE PLANT (04xx)
0400 Trouble not cleared
0401 Pair change
0402 Pair cut dead ahead
0403 Pair transposed
0407 Pair reconstructed
0408 Miscellaneous
0409 Wrong pair assigned
0410 Cable
0412 Cable damage (non-telco)
0420 Non-accessible plant
0430 Accessible plant
0431 Accessible cross box/SAC etc
0440 Wire
0450 Lightwave/ fiber cable
0461 Repeater plug-in
0462 Apparatus case
0463 RT-common equipment circuit pack
0464 RT-POTS channel unit
0466 RT-Wiring/physical/etc
0467 RT-power
0468 Protection
0470 (DLC) Lockups and precaution measures
0480 Multi-channel and other loop electronics
0490 Air pressure systems
PUBLIC COMMUNICATION (02xx)
0200 Other station equipment standard
0210 Full money box
0220 Enclosure/support equipment
0230 Portable phone cart
0240 Coin and card set
0250 1F2 coin telephone
0260 RACTS/OMNI phone
0270 Collect call timing device (CCTD)
0280 AUGAT monitoring equipment
0290 SMART coin telephone
WIRE (03xx)
0300 Corporate com./ public wire
0340 Network interface
0350 Network terminating wire
0370 Protection
0381 Service drop wire buried/ permanent
0382 Service drop wire buried/ temporary
0383 Service drop wire buried/ cutover
0384 Service drop aerial
FOUND OK- IN (08xx)
0800 Found ok- in
0890 FOK- in for data base driven services
0891 FOK- in calling card service
0892 FOK- in automatic intercept system
0893 FOK- in Expanded 911 service (E911)
0895 FOK- in watch alert
0897 FOK- in 700 service
0898 FOK- in expanded 800 service
0899 FOK- in dial it
CAUSE CODES
100 Telephone company employee
200 Non-employee
210 Customer action
220 Other utility
222 Foreign worker
230 Motor vehicle
270 Telco master contractor
280 Petroleum/ chemical
300 Plant or equipment
400 Weather
410 Lightning
500 Miscellaneous
600 Unknown
Central Office (05xx)
0501 Dial up port
0502 Data port
0503 Packet switch
0504 Data link
0510 CO equipment
0511 Common equipment
0512 Linkage/network/grid
0514 Billing equipment
0515 Trunk
0516 Public service trunk
0517 Office conversation
0520 Translation
0521 Generic/par. work error
0522 Generic/par. document error
0525 Line work error
0526 Line document error
0527 Network work error
0528 Network document error
0529 Line work error CCSR
0530 Distribution frame
0531 MDF cross connection missing
0532 MDF cross connection broken
0533 MDF cross-connection work error
0540 Frame other
0541 MDF cable protector
0544 Terminal wire clipping/conn.
0550 Power
0551 DC power equipment
0552 AC power equipment
0553 Ringing plant
0554 Standby emergency power
0560 Misc. equipment
0562 Line testing equipment
0563 Concentrator
0564 Range extender
0565 Carrier system
0566 AMARC
0567 ISDN service
0568 SLC channel unit
0569 SLC common circuit pack
0570 Special services equipment
0572 Wiring option
0573 Carrier channel
0574 Signaling
0581 Mechanized system failure
0582 Line translations unknown
0586 Signal transfer point (stp)
0587 Tandem office
0588 Switching system design
0590 Data base for data base driven services
0591 Calling card services (ccs)
0592 Automatic callback calling
0593 Enhanced 911 service
0594 Equal access
0595 Watch alert other
0596 TOUCHSTAR
0597 700 series services
0598 Expanded 800 service
0599 Dial-it service
Field Techs and Wiretaps
by Lineside
1......General information
2......Wiretap check request
3......Field tech inspection
4......Wiretaps discovered during routine field inspections
5......Other unlawful use of the companies service
1...General
The purpose of this section is to specify the terms and
conditions of assistance of the telephone company to law enforcement
agencies engaged in, or about to be engaged in, wiretapping activities.
Also the procedure for handling reports of the use of telephone
facilities for bookmaking and dissemination of wagering information.
This practice is being revised to remove the Customer
Service Center and the Annoyance Call Center from the trouble report
flow. Any call to the CSC reporting a wiretap or suspected wiretap
should be transferred to the Centralized Repair Service Attendant
Bureau (CRSAB).
The security organization ha
s the exclusive responsibility
for acceptance of Federal or State Court orders written emergency
certifications, which is required for a lawful wiretap. Any
request received for information or assistance in this regard shall
be referred to immediately to the security organization.
The security organization has complete responsibility for
the direction of the company actions following the discovery of an
actual or suspected wiretap. A follow-up procedure will be followed
by security to ensure that all assistance provided by the company is
terminated when the court order or emergency certification expires.
Protection of the privacy of telephone communication is
fundamental to the telephone business. It is Bell policy to
investigate and resolve any actual or suspected threat to the customers
privacy. In line with this policy, every reasonable effort will be
made to resolve all customer complaints. However, it is unlawful for
Bell personnel to disclose the existence of a lawful wiretap to the
customer. Therefore, the following procedures must be observed
strictly in processing customer requests for wiretap inspection or
in reporting any wiretap device that may be found.
All company personnel who discover an actual or suspected
wiretap device shall report the discovery through the lines of
organization to security, without taking further action. In those
instances where a trouble is caused by the wiretap device, it may
be disconnected only after the security organization has been notified.
2...Wiretap Check Request
The centralized repair service attendant bureau (CRSAB)
shall have the responsibility for handling initial customer
complaints concerning wiretaps or other illicit activities. The
RSA will take the report on any call received at the CRSAB
concerning wiretaps or other illicit activities. This report will
be taken as a Category 1. Customer Direct (CD). The CRSAB shall
transmit all requests of this nature to the installation maintenance
center (IMC). The handling code "WIRETAP" will be used to transmit
this report.
The IMC should input additional auto screen rules to direct
these type reports for manual screening. All personnel handling this
type report will document findings utilizing the EST transaction
in LMOS. This means, MA's will document the test and referral
information. SCC will document their findings, I&M will document
their findings etc. Each action taken on this report must be
documented accurately.
The maintenance administration (MA) will perform trouble
verification tests. If a wiretap exists, it may be indicated by the
test results. It no trouble is indicated or a CO fault is indicated,
the MA will refer the report to the switching control center (SCC)
for further analysis. The SCC will assign the appropriate CO the
task of inspecting the office equipment for the suspected wiretap.
The CO will inform the SCC of its findings during the inspection.
The SCC will close the report to the IMC. In those instances where
the CO may locate wiretap, it must not be disturbed. The technician
must inform the manager who in turn will notify the security
department. If after analysis has been completed by the SCC and
the IMC a wiretap has not been found, it may be necessary to
dispatch a field technician for a complete inspection.
3...Field Technician Inspection
Reports involving suspected wiretaps should be dispatched on
the same day on which they were received, when practicable. It is
strongly recommended that a field manager accompany the technician
during the inspection.
The technician will inspect only equipment/wiring that
is owned/provided by Bell. Equipment/wiring that is provided by the
customer or agent of the customer, will not be inspected. The
customer will not be billed for the inspection of equipment/wiring
provided by Bell. If the customer subscribes to a wire maintenance
plan, the technician will inspect through the customers connection
block. If the customer does not subscribe to a wire maintenance plan,
the technician offer to inspect the wiring for time and material.
If the inspection does not uncover an unlawful wiretap, the
technician may advise the customer that no wiretap was found. When
a wiretap, or what appears to be a wiretap is found, security
must be notified immediately. Under no circumstances will any Bell
personnel disclose or verify the existence of an actual or
suspected wiretap to a customer.
If a wiretap is trouble inducing, security may direct the
technician to correct the trouble or disconnect the device from the
line. The security department shall notify the appropriate
law enforcement agency and shall determine if further action is
required.
After the trouble is cleared, the technician will close
the report using established procedures. The customer must be
advised that the trouble is cleared, but the only statement that
may be made about a wiretap device is "NO UNLAWFUL WIRETAP DEVICE
WAS FOUND".
4...Wiretaps Discovered During Routine Field Operations
If a wiretap, or what appears to be a wiretap, is discovered as a
result of routine field operations, where there has been no customer
complaint or request for a wiretap inspection, security shall be
notified immediately. Under no circumstances will Bell personnel, other
than security or individuals acting under the express direction of
security, disclose the existence of the actual or suspected wiretap
to a customer.
-If security determines that a wiretap discovered in this fashion
is lawful, no report shall be made to the customer.
-If security determines that a wiretap discovered in this fashion
is unlawful, law enforcement and the customer shall be notified.
5...Other Unlawful Use of the Companies Service
If in the course of one's work an employee overhears a conversation
or otherwise obtains information indicating that any services
provided by Bell are being used for bookmaking or for the
dissemination of wagering information or other unlawful
purposes, all facts will be reported to the employee's immediate
supervisor, or will notify security.
**** THERE IS NO VIOLATION OF SECRECY OF COMMUNICATIONS WHEN
DURING THE NORMAL COURSE OF BUSINESS WITHOUT INTENT TO MONITOR
FOR THE PURPOSE OF OBTAINING SUCH INFORMATION, AN EMPLOYEE
OVERHEARS A COVERSATION WHICH INDICATES UNLAWFUL USE OF
TELEPHONE COMPANY FACILITIES AND REPORTS THE CONVERSATION TO
HIS/HER SUPERVISOR. ****
Controlled Environmental Vaults
by Tom Farley
Visit Tom Farley's website for more articles and past issues of Private Line
at http://www.privateline.com
I wrote about controlled environmental vaults in "private
line" Number 7 (Volume 2, Number 4, July/August 1995). A C.E.V. is
an underground structure that often houses telephone equipment .
The one I went into and took pictures of for that issue's Outside
Plant article housed a 5ESS. In effect, it is a small central office
underground. These inconspicuous, buried buildings allow companies
like RTC to distribute its switching capacity more equally around its
serving area. Your only clue to a C.E.V.'s location is its top -- a four
by four foot flat steel panel two or three feet off the ground, rising
out of the earth like a green, squarish mushroom.
It turns out that Roseville Telephone Company installed the
first C.E.V. in California back in 1986. Here's a history of that vault,
reprinted with permission, from Steve Chanecka's book, _The History
of The Roseville Telephone Company_:
"'The company is looking at the serving area west of Antelope
Road by using a controlled environmental vault which meets the
concerns of nearby residents since it is aesthetically appealing. We
will use it to house a remote switching unit which will serve this
area. Plant from our central office to the 'CEV' will be fiber optics
and from the remote location to the subscribers will use normal
copper wire. Basically, this unit will serve the same function as a
mini-substation, but will be underground and therefore does not
detract from homes in the neighborhood.'
"Ned Kindelt explained the CEV in more detail in a late 1985
article in _Line Chatter_. 'A CEV is a central office located
underneath the ground. The equipment vault is 10 feet, six inches
wide and 24 feet long, and will contain a remote unit in Citrus
Heights for control. The remote switch unit will be wired for 4,608
lines.' In addition, the CEV had air conditioning, a dehumidifier, an
automatic sump pump and an alarm system.
"The use of CEVs was pioneered by Roseville Telephone in
California. The state's first one was placed on Lichen Drive in Citrus
Heights in late 1986. The engineering, splicing and installation was
a long, arduous process, according to project director, splicer Jim
Hood. He reported in the October 1986 _Line Chatter_
'Our first CEV is almost past history. This has been a very
difficult project for many departments. This vault is powered from
the Citrus Heights central office by our first fiber optic cable. Our
second vault, already a work-day reality for some departments will
be located on Antelope Road near the Foothill Christian Center. To
say that this has been a learning experience is being tactful.'
"That first CEV may have been challenging but the concept was
a lifesaver for Roseville Telephone. Faced with an aggressive
expansion of residential housing in the Antelope area of Citrus
Heights, the company's conduit capacity to run copper cable from its
Citrus Heights central office under Interstate 80 was insufficient
for the long term. Had there been no other option, the company would
have faced costly construction to increase its underground conduit
system.
"The CEV approach solved this. Rather than making the conduit
system larger, the use of fiber optics resulted in the cable bundle
running through the conduits being smaller in diameter. Thin, very
high capacity fiber optics connected the central office and the CEV.
The far thicker copper cable ran from the CEV to the customer. Fiber
optics enabled much more information to be transmitted through a
much smaller bundle of wires. Leon Bower, director of outside plant
engineering, explained to fellow employees why CEVs and fiber
optics made sense in the fall of 1985:
'If you read local papers, you are aware that the area roughly
north of Antelope Road, between the railroad and Watt Avenue in
Sacramento County, is about to be developed. They are projecting
between 13,000 and 14,000 new homes in the Antelope Urban
Reserve in the next 20 years. For the area west of the freeway we
are projecting a requirement of 16,000 lines for that 20 year
period.'
'To serve this area with conventional copper cables would
require an investment of some $3.5 million at today's cost in outside
plant alone. Underground conduit systems would have to be
reinforced, at a very high cost, to accommodate the fourteen 1500-
pair, 24 gage feeder cables needed. A fiber cable will cost us about
$102,000. . .'
"Since 1986, 12 more CEVs scattered evenly throughout the
company's service have placed impressive digital switching
power and data transmission capacity close to the users at
an economical price. Moreover, all but one of the company's 13
operating CEVs at the end of 1994 were located inside utility right-
of-ways. The company did not have to buy the site of the CEV or
obtain permits to put them in the ground. Most people are not even
aware of where the CEVs are placed."
It is my understanding that each vault is backed up with
alternative routing, that is, a separate fiber comes in from two
directions to the vault. A single accident will not cause any vault to
go down. The _History of the Roseville Telephone Co._, by the way, is
a fascinating read and an important contribution to independent
telephony. RTC is the 23d largest telephone company in America and
one of the most progressive. The book is over four hundred pages in
hardback. $20 in the U.S. plus $3.50 shipping. Call (916) 786-1117.
There's a discount for orders of five or more. Or order by mailing
from the following: Telephone Book, Roseville Telephone, P.O. Box
969, Roseville, CA 95678. And make sure to visit their telephone
museum at 106 Vernon Street in Roseville from 10:00 to 4:00 p.m. on
Saturdays.
~Cyber Culture
In this section, issues in the cyber world that will effect the H/P scene in
one way or another will be discussed. Submissions for this section are
always welcome.
The impact of the flag burning amendment
by Mr. X2
There has been a lot of talk lately about the proposed amendment that
would make flag burning illegal. Now I have never burned a flag and
I don't have any intentions of doing so. However, burning a flag is
part protected under free speech. Anyone who studies constitutional law
learns that our freedoms are not a 100% guaranteed. If that was the case
there would be anarchy. We give up some freedoms in certain situations
to protect our other rights and the rights of other people. For example,
you cannot yell fire in a movie theater or call in a bomb threat. As
long as your expressions does not infringe on the rights of others, than
it is basically OK. With all that out of the way, how the hell does
burning a flag infringe someone else's rights? Unless you catch someone
on fire in the process than I just don's see it. Well this bill is being sent
to the government to be kicked around for a while and if it passes it will
be put up for vote to become law. In that case, 2/3 of the states have to
ratify it in order for it to become law. While it may be a ways off, it
is important for everyone reading this zine to keep in the back of your
mind. I know your wondering where this is all going in a phreak zine. Well,
I'm sure that most of you reading this support free speech and especially
free speech on the net. When you support such issues, it is important to
look at the big picture and support all related issues. If flag burning is
made illegal, then what else isn't protected under free speech? Previous
court cases and other laws are taken into account when deciding issues
that are new and confusing. If the flag burning amendment passes and then
some time down the road, a bill comes up restricting speech on the net,
people will look at other free speech issues such as the flag burning
amendment. It is also important to support any reasonable free speech issue
not just flag burning. When you support something, you have to support
other's related beliefs as well.
Cyber McCarthyism
by Mohawk
I'm not gonna go into the Colorado shooting but it is important to focus
on one event related to the shooting. Shortly after the media first
reported about the shooting, people went on their computers and made
fake profiles claiming they were in the Trench Coat Mafia, made jokes
about it, and even made a couple of TCM webpages. Once the FBI started
it's investigation, there was a broad search conducted on the Internet
for any clues about the shooting. This was because Eric Harris had various
webpages that gave some signs as to what would happen on april 20th. They
also wanted to see if anyone else was involved. All of Eric Harris'
accounts and webpages were shut down so that no one could tamper with
evidence. Even while I am writing this, there is still a shroud of
mystery as to what exactly happened, why, and if anyone else was
involved or knew about it. During this Internet investigation, anyone
who had anything mentioned about the trench coat mafia on line got
their accounts cancelled, webpages removed, and anything else they had
on the net deleted. Some people on AOL lucked out and just got
warnings although they got all thier files deleted. I've talked to people
that go their accounts cancelled for just posting somewhere that the
trench coat mafia sucks. While this wasn't a wide spread epidemic
it has the implications of someday becoming one. What if a hacker did
some major damage. I mean kill a lot of people. Then the hacker
is painted as this evil person who just wants to cause havoc for
other people and he is just one out of a whole subculture full of
these evil hackers. The media has a field day. They do profiles on
hackers, ya know pimples face nerds who no one likes, plays doom all
day and listens to manson. Can you imagine what would happen to
hackers? No one would want anything to do with hackers on their
service. Thousands of accounts would be canceled, webpages
would be removed, and we would have more than just a crackdown
on our hands. Pretty disturbing huh? How do we prevent this?
That's a good question. Be responsible and try to keep a good
image of hackers would be my best guess. It would be a lot easier
to get people to think that most hackers are nice people before this
happens than afterwards. This has already happened in spurts but to
no major extent. Even if there was a large hackers are nice guys
campaign it probably won't even do that much good. I would like to hear
from you on this topic of Cyber McCarthyism. Is it something to
think about? Is it a problem now? Will it be a problem in the future?
What can we do to prevent it? It's not just hackers that have to
worry about this, any cyber-community may be vulnerable to this.
Copyright 1999 Phone Punx Network. Feel free to distirbute this issue however,
do not modify this file in any way. All issues are free and are not allowed to
be sold in any form. If you are sellling issues you can only charge what it cost
to reproduce them. Keep the information free. All works are owned by the PPN
and/or the authors of the article. If you feel that you own the copyright to a
work printed in this issue and have not given the permission of the author to
republish it, please email us.
Comments