Copy Link
Add to Bookmark
Report
Phone Punx Magazine Issue 02
The Phone Punx Network Presents
--Phone Punx Magazine--
----Issue two----
"This Issue is dedicated in Loving Memory of 1-800-487-9240"
August 07, 1999
Last Updated: August 07, 1999
http://fly.to/ppn
(Mirror: http://worship.to/ppn)
phonepunx@yahoo.com
Contents
~Intro by Mohawk
~Targeted Long-Distance Dialing on a Siemens 9006 Switch by Biterror
~Countermeasures Revisited by Seuss
~Poor Man's CLLI Locator by Mohawk
~Datu's: the tool of the New Age Phreak by MMX
~SASS Test Number Access by Lineside
~Intro to Paging Networks and POCSAG/FLEX interception by Black Axe
~Satellite Systems: Reception by Black Axe
~The elusive Project Angel by Mohawk
~Zine writing suggestions by Phone Punx Staff
~Cyberpunk Culture by Mohawk
~Letters
.....The Staff of Phone Punx Magazine.....
Mohawk..................Editor in chief
Seuss ......................Editor/Head tech. writer
Lineside...................Staff writer
Black Axe...............Staff writer
MMX......................Staff writer
Bit Error..............Staff writer
.....Magazine Information.....
-Disclaimer
ll information is protected by the 1st amendment. However, this
information should not be used in any other way except education.
Our purpose is to provoke thought and we might even entertain you,
if you're good. Nothing in this issue has been tested and we do not
guarantee that it will work. We cannot ensure your safety both
legally and physically and what the hell, mentally if you try anything
in this issue.
-Release Dates
Phone Punx Magazine is released about every 4 months, however there is
no set release date. Issues can come out a day or a year after the last
one but we will try to stick to around 3 to 4 months.
-Writers Wanted
We are always looking for more writers. If you want an article published
or if you would like to become a regular writer, send us an email. We would
really like to concentrate on phreaking and large phreaking projects. That is
why the release date for new issues is 3 to 4 months, instead of 2 months
like the OCPP. However, not all articles have to be related to phreaking.
We are experimenting with some new sections that will cater to our audience
with topics other then phreaking. If you feel that you have an article
that would be of interest to phreaks but it is about hacking, cyberpunk-culture,
etc, let us know and we will evaluate each article on an individual basis.
We are also looking for ways to compensate our writers for their time and
effort in writing articles. We will add a link to your webpage but
we may also start a page where we will post a banner or two of your choice.
Any other suggestions are also welcome.
-Distribution Sites
Help us spread the magazine to a wider audience by becoming a
distro site. All you have to do is keep the issues on your website
with a link to them somewhere. Not only will this help us reach more
people, but our readers will have another place to get the zine if
something happens to the site. We need people to distribute the zine and
past issues of the OCPP. A list of distro sites is available on the
"About PPN" page.
-Network Links
The Phone Punx Network is more than just one webpage. We hope to span
several webpages that will encompass member websites and distro sites.
To get a network link you must be a staff writer or be involved with the
PPN in another way and have a website that is related to phreaking in some
way or another. If you can't do that, become a distro site and provide
a link back to us. You will also have to add a Phone Punx Network graphic
that links back to the site.
-Issue Updates
Issue updates will occur when they are warranted. To make sure you always have
the freshest issue of PPM, check the "last updated" date on the top of the issue.
It is important that you always have the latest issue because we do screw up
often and we are always fixing our mistakes. To be notified of updates of the
issues, join the phone punx newsletter.
-Phone Punx Newsletter
To stay up to date with the latest in the Phone Punx Network, sign up for the
Newsletter. You will be notified of the release of new issues, updates to past
issues, and other PPN news. All email addresses are kept confidential. Just send
an email to ocpp@hotmail.com letting us know you'd like to subscribe. If you
would like anything announced or whatever to be added in there, feel free to
send it to us.
-Links
Please update your OCPP links. Change the name to Phone Punx Network and the
URL to http://fly.to/ppn, if you have a link to us on your page, let us know
and we'll link you back.
-Letters
We will print your letters. If you would like to make a comment, ask a question, or
whatever, send them in and we will publish them. If you don't want your letter
published, just let us know. All email address will not be published unless you
tell us otherwise.
-Contact info
Our email address is phonepunx@yahoo.com
To subscribe to the mailing list send an email to ocpp@hotmail.com
Copyright info is located at the end of the issue
Intro
by Mohawk
This should be considered the first "real" issue. The last issue was a mix
of new articles and articles that were going to be published in OCPP. The articles
in this issues are some of the best we've ever published. I'm really proud of
everyone involved with not just the zine, but the network as a whole. Things have
really progressed since last issue. I will no longer be providing updates to the
network, the page, etc. in the intro section of the zine. That way, years from now,
you don't have to read about pointless news that happened so long ago. News about
the website, additions to the network, etc. will be on the News page only from now
on. However, I will still talk about changes within the zine itself.
Speaking of which, we've got some new writers for this issue. Black Axe,
Bit Error, and MMX all have some great articles in this issue. I'm really happy
with the staff we have now. We also have some more new writers that should debut
next issue. Of course, if you would like to join the staff, feel free to email
me. The network itself will continue to grow with some big things coming up soon
thanks to X-Logik. The next issue should be out in about 3 or 4 months. It looks
like were gonna try to stick to a quarterly release date but that's just an
estimate. We're still getting some loose ends together here and things will only
continue to improve. There are still people out there that don't know were still
alive.
Targeted Long-Distance Dialing on a Siemens 9006 Switch
by Biterror
Disclaimer:
This information is for information purposes only. I am not responsible for
abuse of the info herein.
Intro:
With phone systems becoming more and more advanced and companies relying
on them to perform increasingly advanced tasks, there are often holes in these
systems that can be accessed by the enterprising among us. These holes are often the
result of sloppy or misinformed switch programming and may be utilized without tone
generators or account codes. Specifically, this file deals with an often-overlooked
aspect of programming in the Siemens 9006 office PBX.
The Situation:
Making free calls through a PBX is nothing new. However, the strategy
in the past has been to find a local company with a phreakable PBX, hack it, and
acquire a dial tone to make long distance calls. This is, of course, illegal and
usually results in increased security measures by that company. Why not use 800
numbers to call the city you want to reach and, through a little cleverness on
your part, achieve local (long distance to you) phone access that way?
It's easy, it works, and it's totally legal. I have successfully used
this plan to call friends near a large metro area for over a year. In that
time, no changes have been made to the programming of the switch I am dialing
and no Bell agents have knocked on my door. I know that the company's switch
I am using is a Siemens 9006 with Phonemail SE so the keystrokes that follow
are for that setup. Mileage will vary on other PBXs.
A Note on Tie Trunks:
Geographically dispersed offices of a company have to have a way to
communicate with each other. They could just pick up their phones and dial each other
long distance, but then the long distance charges would be outrageous. There is an
easier, cheaper way to talk to each other: tie trunks.
Tie trunks are usually T-1 lines leased from a local dialtone provider
that connect offices together (say an office in Mobile, AL with company HQ
in New Orleans). These trunks allow someone in Mobile to dial a 4 digit extension
and reach someone in the New Orleans office, instead of having to dial on the
10 digit long distance plan.
Aside from saving money, it's just more convenient to dial long distance
as if you were calling someone in the next cubicle. Keeping this in mind, let's
try to make some calls.
For example's sake, let's say you want to call your girlfriend who
lives in Slidell, LA. The only problem is, you reside in Knob Lick, KY. And since
you man the Knob Lick KFC drive through for a living, you don't exactly have
wads of bills to drop on phone charges. The first thing you need to do is have
your girlfriend whip out a Slidell phone book and find a small to medium-sized
company that has an 800 number. Don't pick some huge company like Sprint or
Fujitsu, because they won't be using a Siemens 9006 PBX. If she can't find a
number in Slidell, check the New Orleans phone book (this example assumes that
Slidell is a local call from New Orleans). The Internet is also a good place to
look for 800 numbers. Also try to find out if this company has branch offices and
where they are located.
Once you find the main toll free number for the company, dial it
(after business hours if possible) and wait for the auto attendant to answer. When
the attendant asks you to press a key if you know your party's extension, press
that key. Or if you prefer, and if the switch menus offer it, you can spell an
employees last name and be transferred to their extension. We just want to reach
an extension, it doesn't matter whose it is.
You must now enter an extension. If you decide to spell an employee
name, go for the obvious Smith and Jones, or you could be there all damn night.
Dialing an extension by number is also trial and error. Look at the company's local
telephone number and use the last four digits of that number as a basis for guesses.
For example, if the local number of the company is 555-8000, try extensions in the
8100's, 8200's, 8300's, etc. Extension numbers may be arbitrary and can have any
DID number.
Once you have a working extension, you will be transferred to someone's
voicemail. You may be connected on the local company PBX, or you may have transferred
to another identical PBX on the corporate tie trunks. You'll know more when you try
your outside call. You can listen to the voicemail message you just dialed or bypass
it with the proper button. When the voicemail beeps for you to begin your message,
hit the * (star) key followed by the # (pound) key. This brings you back to the
attendant, but now you should be one level deeper in the 9006's menu tree. The
attendant should read you a grocery list of options that you may choose from. When
she (or he) tells you the keys to hit to transfer to another extension, do it. Now
you dial your girlfriend's extension, preceded by a 9 (to access outside lines)
and followed by a # (to let the switch know you have finished inputting
the number you want to transfer to.) Hit # again to allow the switch to dial out.
It's that easy! Provided you are still on the local switch, your call should go through.
If the Siemens switch you dialed is on a tie trunk and the extension you dialed
rings someone at a branch office in say, Mobile, AL, then your call is not likely
to go through. Unless of course the idiot switch programmer did not exclude
long distance transfers in his dial plan. Then you can transfer to any number anywhere
from that extension, but that is not likely. It may not even allow local calls on
a transfer, only four digit extensions. If that's the case, you are SOL and will
have to find another company to try. I never said this would be easy, but it is a
great way to make calls to targeted cities with little expense to either party. The
Siemens switch may possibly be running a third party software program called Telemate.
Telemate's sole purpose is to record incoming and outgoing digits which
it saves to a file or outputs to a printer. It's mostly for accounting purposes,
to see which employees are screwing around and which are actually making legit calls.
Your phone number travels the whole way with your call and can be recorded. Calling
from a payphone is still your best bet.
Countermeasures Revisited
~Seuss
The most prevalent information on telephone counter-surveillance has been
floating around for at least 15 years. Short the pair at the demark and measure
resistance. Open the pair at the demark and measure the resistance. Abnormally high
or low resistances indicate a phone tap. Forrest Ranger wrote about it in text
files, M.L. Shannon and Paul Brookes included it in their books, and an untold
number of phone phreaks have employed this technique. Despite its popularity, this
technique has its shortcomings: it fails to detect devices installed in the outside
plant, split pairs are undetected and transmitters built into the phone are not tested
for.
What you'll need:
- Access to a local DATU.
- A multimeter with high impedance scales (several meters that measure into the
giga-ohm range are available) and a capacitance meter.
- An induction probe.
- A frequency counter or near field detector.
- Something that makes continuous noise, like a tape player.
- Ancillary tools (screwdrivers, a can wrench, etc.)
First, call the Phone Company to ask about your line's readiness for ISDN or
DSL. High-speed services demand a line with no loading coils and a minimum amount
(less than 2500 ft.) of bridged taps. Either will cause inaccurate measurements.
Begin by taking the phone off hook and turning on your tape player
(to turn on voice activated transmitters). Now give your phone a pass with your
near field detector or frequency counter. Transmitters in the phone will hopefully
be picked up at this point. (Note: some speakerphones are prone to normal RF leakage)
Next measure the capacitance of the line, dividing the value by .83
(the average mutual capacitance for a mile of phone line). This is roughly the
length of your line. Write it down, you'll need it later. Remember that .83 is an
average value, which can range from .76 to .90 depending on line conditions. To get
a more accurate measurement you can fine tune your figure by comparing capacitance
measurements on a section of plant cable of a known length, or use a TDR.
Disconnect all the phones from the line you want to test. Go to your demark
and disconnect your pair on the customer access side. Short the pair and measure the
resistance of the line from the farthest jack with the meter set to its lowest scale.
Reverse the polarity of the meter and measure again. If either resistance is more
than a few ohms, it would suggest a series device wired into the line somewhere on
your property. Now return to your demark, open the pair, and cover the ends in
electrical tape. Measure the resistance of the pair with the meter set to its highest
scale. A less than infinite resistance would suggest a device wired in parallel to
your line.
Testing in the outside plant should be conducted from the telco side of
the demark point in order to avoid measurement error from the station protector
circuit. Call that DATU and short the pair, then measure the resistance of the
line. Compare the value you got for your line's length with the figures below:
Wire Gauge Loaded Pair Unloaded Pair
26ga 84.33 83.33
24ga 52.89 51.89
22ga 33.72 32.39
19ga 17.43 16.10
Note: 5ESS switches incorporate a 'test bus' that will add about 500 ohms to
the shorted pair.
These figures will vary with temperature, splices, wet sections, and a host
of other reasons. Large deviancies could (but don't necessarily) suggest something
wired in series with the line. This measurement may be supplemented by either a
resistance to ground measurement of both sides of the pair and a capacitance balance
test, or a voltage measurement. A resistive imbalance of more than 10 ohms or a
noticeable drop in off-hook voltage calls for further inspection.
To test for parallel devices in the outside plant, open the line with the
DATU and repeat the parallel test as described above.
Testing for telephone hook-switch compromises requires an induction probe.
Reconnect your pair at the demark and plug all your phones back in. Turn your tape
player back on and put it near your phone. Now probe all the lines coming through
your demark point. If you hear the tape player through the probe, your phone's
hook-switch has been compromised.
Checking for splits on your line requires an induction probe and access
to a plant wiring cabinet. Add a tone to either lead of your pair with the DATU.
Probe all the conductors in the binder pair, listening for the trace tone. If you
hear the tone on more than two leads (the ones connected to the line you're checking)
your line has been split. This can be either a bad splicing job, or someone
intentionally hooking a pair up to your line.
If any of the above tests suggests that there is something on your line,
remember that there are plenty of innocent reasons a test could turn up positive,
so a detailed physical search is in order. Disassembling the phone in question and
comparing the innards to a schematic would be a wise idea at this point. Take the
covers off your phone jacks, dig around in your demark point, peek inside wiring
cabinets if you can, and so on. There are some places that are likely out of your
reach, but keep in mind that they're likely out of reach to many wiretappers as well.
Seuss maintains the alt.phreaking FAQ (http://members.tripod.com/~SeusslyOne/)
Poor Man's CLLI Locator
by Mohawk
A lot of people are interested in finding buildings with switches in them.
Most these people are in the telecommunications, Cable, or some other professional
industry. And anyone else, who does, is probably a phreak. This mostly involves
Central Offices for reasons such as trashing and breaking into bell vans to steal
that treasured Bell hardhat. Any building that has a switch is assigned a CLLI
code. Whatever your motivation for finding a switching center, it isn't easy to
do for free, until now however. This article will explain what CLLI is and how
to locate most switching centers for free.
CLLI is an abbreviation for Common Language Location Identifier. Bell Labs
invented Common Language in the 70's. It's purpose was to track all AT&T network
components with a consistent coding system. After the break up of AT&T in 1984,
Bellcore (now Telcordia) took over ownership of Common Language information
products. It was then expanded to cover more then just AT&T network components.
The CLLI code is an 11-character code equipment designation which is coded
as follows: Characters 1 through 4 represent the Exchange or Locality, 5 and 6
the State, 7 and 8 the location code within the exchange, 9 through 11 represent
the unique equipment type. Sometimes a CLLI code will be represented by 6 normal
characters followed by 5 X's. This is a MXC or Miscellaneous Exchange Carrier
which usually denotes a switch that handles paging, cellular, PCS, or some other
new technology.
CLLI locations are important to the telephone and cable industry for various
reasons that will effect how they set up their business and how they serve their
customers. To figure out the locations of these CLLI's they use software that
uses a CLLI database to determine the location, exchange, NXX's served, LATA,
Feature group, etc. The one that we will be discussing is CO Finder and a demo
version can be downloaded at http://www.stuffsoftware.com.
The demo uses an outdated database and has limited features. However,
it is still very useful. Two CLLI's can be displayed at the same time so
you can compare them and figure out the air-mile distance between them. You can
also get the Vertical and Horizontal Coordinates. These are based upon a 1/10
mile grid from a reference point on a U.S. map. These coordinates are converted
from Latitude and Longitude and are referenced in tariffs as the official means
by which to calculate the interoffice mileage between CLLI codes. This doesn't
really do you any good to figure out where the switching center is. The full
versions of CO Finder and other CLLI Locator programs have options that give you
the address of the switching centers. However, these programs are very expensive.
CO Finder is currently going for $100.00 and the updates are even more expensive.
However, other CLLI locators are way more expensive then that.
To find a switching center for free open up CO Finder and find a CLLI that
you want. If you want to find the CLLI code that serves your local area select
your NPA, for example 212. Now click on NXX and type in your NXX, (ex. 209). The
CLLI NYCMNYBW21T should pop up with all it's related info. Now to find the exact street
location of that switching center, go to http://www.mapquest.com and click on
"online maps". Instead of entering in an address, scroll down to "Telephone
Area Code Search" Now enter in your NPA and NXX. A map will come up with a redstar
on it. You didn't specify an address or other location, just a phone number so
the red star on the map denotes the exact location of the switching center that serves
the NXX you typed in. You can then get driving directions to it and even figure
out if there are any Denny's Restaurants along the way within a certain mile radius
that you specify.
One drawback to MapQuest is that it can't locate MXC's. To do this, open up
the MXC you want to find in one window. Then open up a regular CLLI that can plot
on MapQuest. You should use the closest one to the MXC. Click on the miles
button between the two windows to calculate the exact air-mile distance. Now open
up a map, preferably the phonebook map because they have a really small scale. Using
a compass open it up to the distance between the two offices. Try to estimate the
exact location of the CLLI you got from MapQuest and then draw a circle. In or
around the circle is where you should find the MXC.
The really interesting thing about all this, is that if a terrorist wanted to
find the location of a switch to bomb, they could do so anonymously and free. Not
only can you find all the switches in a town, but this method will also allow you to
locate switches on military bases. It's kinda scary what kind of information is
available to people for free over the Internet. Hell, if we were at war with
a country, they could have all of our communications mapped out for free.
To compensate for the old database, keep the phonebook handy so you can see
what new NXX's have been added to a certain exchange. You can use mapquest to
figure out what office serves the new NXX's in your area. If you can't find an
NXX listed in CO Finder, type it into Map Quest and see where it points you too.
Remember to adjust for NPAs as they existed in January of 1998. For a list of
other CLLI locators visit the alt.phreaking FAQ at http://fly.to/ppn. These
programs aren't the greatest though. CO Finder is your best bet. Telecordia will
soon release a demo of "Locate It" and we will test that out when it is released.
This is still a new idea we are exploring so please email us with your findings.
DATUs - The Tool of the New Age Phreak
Major Note #1: All of the first four paragraphs are adapted/condensed from the
administration manual. But be honest with yourself before criticizing me for
"stealing" this article. When was the last time "YOU" called Harris and SE'd it out
of them? Huh? Didn't think so bitch.
The Harris Direct Access Test Unit Remote Terminal extends the field technician's
testing capabilities of subscriber lines through the non-metallic environment of a
pair gain system. Typical pair gain systems include SLC-96, SLC-Series 5, etc. The
system has three major components (see Figure 1); the Direct Access Test Unit (DATU),
the Pair Gain Applique II (PGA II), and the remotely located Metallic Access Unit (MAU).
Direct Access Test Unit - Remote Terminal
====== ====== ==== ==== = ====== ========
The DATU-RT is a printed circuit card that provides microprocessor control of line
preparation functions, voice prompted menus and status reports to the technician . It
allows technicians to access and perform specific loop conditioning and tone generating
functions on any working subscriber line to prepare the line for use with field test
equipment. The card is installed in the Metallic Facility Terminal (MFT) bay and connected
to the Central Office switch.
Pair Gain Applique II
==== ==== ======== ==
The PGA II is a printed circuit card that extends the DATU-RT capabilities into the
pair gain environment and serves as the interface between the DATU-RT and the switch's
Pair Gain Test Controller (PGTC). It determines the status of the PGTC and its metallic
DC test pair, provides carrier channel signaling and transmission test results, and
controls the DATU-RT's access to the MAU. The card is installed in the MFT frame and
connected to the switch.
Metallic Access Unit
======== ====== ====
The MAU provides the standard DATU-RT line conditioning functions as directed by the
DATU-RT. It eliminates the need for metallic bypass pairs from the switch to the
remotely located pair gain terminal. The enclosure is installed inside the cabinet
housing the pair gain equipment. One DATU-RT and one PGA II, working together in the
same switch, may serve a maximum of 212 separate MAU locations. The RT system provides
the technicians the ability to perform a series of line preparation functions to
subscriber lines. These functions are established and maintained by authorized personnel.
[Now, onto my part of the article]
NOTE #2: I refusing to speak about administrator mode for three reasons:
1) If you accidentally screw something up, the DATU probably won't work.
2) You don't own any DATU that you're using (nor do you have permission),
and therefore committing a crime by accessing one.
3) I think that if I talk about things like changing the NTT Busy Test,
you will do something naughty. VERY naughty.
To access the DATU, dial the telephone number assigned to the DATU. Upon
connection, you will hear a 440hz "dial tone" indicating that the DATU has answered and
is ready for password entry. Dial the password of the DATU, which is defaulted for
technicians at 1111. If the first digit of the password is not entered within seven
seconds after the DATU answers, it will release the line. Upon entering a successful
password, another DATU dial tone is heard, prompting you to dial the seven-digit subscriber line number (in other words, the number you want to test). Occasionally, something will be wrong at the CO, the DATU will say "Error, bad no-test trunk" and a pulsating 440hz tone
will be heard. If you ever get this, than you probably are accessing a DATU at either a CO
where someone is asleep at their desk, or in a remote office. I have yet to get this
error at a heavily manned CO. You also won't be able to run tests if you get this message. Anyway, after the DATU prompts you to dial the subscriber line number, a few things can
happen. If you dialed a number not served by that DATU, you will get the message:
"INVALID PREFIX." and another DATU dial tone. Upon dialing a correct number, if the
line is idle, the DATU accesses the line and you will hear "Connected to, ddd-dddd.
OK. Audio Monitor." You can then select a line conditioning function anytime after the
voice message begins, including the 10 seconds of audio monitor before the menu is
presented. If the line is busy, the DATU will say "Connected to ddd-dddd. Busy line.
Audio Monitor." The busy line will then be monitored for 10 seconds. It should be said
at this point that all audio traffic is unintelligible. After the 10 seconds of audio
monitor, the DATU will send two 614hz tones in rapid succession to indicate the end of the monitor period. Features that would be disruptive to a call in progress are not available
if the DATU-RT detects a busy line condition. These functions include "High-level Tone",
"Open Subscriber Line", and "Short Subscriber Line".
Functions of the DATU
========= == === ====
Anyway, after learning the status of the line, the functions are presented in a
menu format. Main Menu functions are announced as follows:
DIAL 2 FOR AUDIO MONITOR.
DIAL 33 FOR TIP/RING SHORT TO GROUND.
DIAL 37 FOR RING GROUND.
DIAL 38 FOR TIP GROUND.
DIAL 44 FOR TIP/RING HIGH LEVEL TONE.
DIAL 47 FOR RING HIGH LEVEL TONE.
DIAL 48 FOR TIP HIGH LEVEL TONE.
DIAL 5 FOR LOW-LEVEL TONE.
DIAL 6 TO OPEN SUBSCRIBER LINE.
DIAL 7 TO SHORT SUBSCRIBER LINE.
DIAL STAR TO KEEP TEST AFTER DISCONNECT.
DIAL POUND FOR NEW SUBSCRIBER LINE.
A quick description of each of the functions:
1 - Announce Main Menu
2 - Audio Monitor
Provides a way to verify that the busy test was correct. Traffic on the
line is audible but unintelligible. Audio Monitor is automatically disabled
at regular intervals to insure that the DATU-RT is able to detect DTMF tones
in the event an exceptionally strong audio signal is present. This occurs at
regular six-second intervals and is of approximately two seconds duration.
3 - Short to Ground
The "Short to Ground" function is used to connect the Tip, Ring or both leads
to Ground potential. If only a single lead (Tip or Ring) is selected, the
opposite lead is unterminated.
4 - High Level Tone
This function places 577-Hz high-level (+22 dBm) interrupted tone bursts on
the Tip lead, Ring lead or both. If a single lead is selected, the opposite
lead is grounded. This function is typically used for the purpose of conductor
or pair identification.
5 - Low Level Tone
This function places 577-Hz low-level (-12 dBm) interrupted tone bursts on
both the Tip and Ring leads. Because the tone signal is longitudinal, use of
this function does not disrupt traffic on a busy line. Tone bursts can be
heard only on a telephone instrument connected between Tip or Ring and
Ground. This function is typically used for the purpose of conductor or
pair identification on a busy subscriber line.
6 - Open Subscriber Line
The "Open Subscriber Line" function removes Battery and Ground potentials
from the subscriber's Tip and Ring leads.
7 - Short Subscriber Line
The "Short Subscriber Line" function provides an electrical short across
the subscriber's Tip and Ring leads.
* - Hold Functions (Keep Test After Disconnect)
The "Hold Test" feature provides a means by which a line condition asserted
by the DATU-RT is maintained for a specified time interval after disconnecting
from the DATU-RT. The duration of the Hold Test interval is entered through
the telephone keypad and is specified in minutes. Any interval may be entered,
however, the DATU-RT will not maintain a line condition longer than the Access
Timeout interval. The programmed function is automatically cancelled by the
DATU-RT when the specified time interval or, if of a shorter duration, the
Access Timeout interval has elapsed.
[At this point, it should be noted that upon setting up a DATU, the
administrator determines the Access Timeout Interval, which is basically a
timer to say "goodbye" once you've lounged too long on the DATU. By default,
the Access Timeout is 10 minutes. Also, after hitting *, the DATU will prompt
you with either "DIAL NUMBER OF MINUTES" or "DIAL 2 DIGITS FOR NUMBER OF
MINUTES". With respect to single digit entries, "0" is interpreted as 10
minutes. Also, after you use this function, the DATU will expect you to
be finished and will say "PLEASE HANG UP."]
# - New Subscriber Line
This function releases the currently-held subscriber line so that another
subscriber line may be accessed.
Before moving on, there is one other function that is worth mentioning.
9 - Permanent Signal Release
The "Permanent Signal Release" function causes the removal of Battery and
Ground potentials from a permanent signal line served by a step-by-step switch.
This function is typically used to clear a busy condition resulting from a line
fault so that normal line tests may be performed. After pressing "9" on the
keypad, the DATU responds with "PERMANENT SIGNAL RELEASE." After executing the
required sequence of operations, the DATU tests the subscriber line to determine
whether the busy condition has been cleared. The result of this test is then
announced as either "OK" if the line is idle or "BUSY LINE" if the line is busy.
This function is not available unless specifically enabled by the DATU
administrator. Unless enabled, any attempt to use this function results in the
message "ERROR - PERMANENT SIGNAL RELEASE DISABLED." Permanent Signal Release
will function only on a line that the DATU has identified as busy. An attempt to
use this function on an idle line results in the message "ERROR - IDLE LINE"
Single Line Access
====== ==== ======
Moving right along... If you should find yourself "testing" the line that you're
calling the DATU with, you will realize that you can't test that line, since you're
using it to call the DATU. An interesting predicament. The DATU is prepared as always
to handle your problem. By dialing "*" before the subscriber line number, the DATU will
wait until you hang up, and "then" test the line. Pretty simple, eh? Oh yes, and for
those who wonder why there is no "audio monitor" during single line access: after you
select the test function, the DATU will ask you for the "number of minutes". The
testing doesn't start until one minute after you hang up.
Sadly, the actual Administrator's Guide went into great detail on the use of each
feature of the DATU more than three times by the end of it. Stupid corporate products.
Conditioning of Carrier System Lines
============ == ======= ====== =====
NOTE: Unless you have a fairly basic grasp of the way pair gain systems operate, I
would suggest skipping this section.
After dialing the subscriber line number, if the line is on a pair gain system,
the DATU announces, ACCESSING and repeats the subscriber telephone number entered. The
DATU announces the state of the subscriber line/NTT with one of the following voice
messages:
PAIR GAIN LINE, PROCESSING. - if the line is idle and is a pair gain line.
BUSY LINE - if the line is busy.
If the selected line is busy, the DATU cannot determine whether the line is served
by a carrier system. It is, therefore, not possible for the DATU to activate the Pair Gain
Test Controller (PGTC) and metallically connect the DC Bypass pair at the RT to the
subscriber line. Without this metallic connection, the DATU cannot condition the line.
In this case, only the "Audio Monitor" and "Low-Level Tone" functions are available to
the user. Because it's signal is longitudinal, the Low-Level Tone function is generally
not effective when used on a busy carrier system line. If the line is idle, the DATU
attempts to activate the Pair Gain Test Controller (PGTC). The PGTC, in turn, tests
the carrier channel and communicates the results to the DATU. These operations require
additional time and may result in a delay of up to 30 seconds. After successfully
completing these steps, the RT system identifies the carrier channel as follows:
SINGLE-PARTY LINE - if a single-party channel unit is detected.
MULTI-PARTY LINE - if a multi-party channel unit is detected.
COIN LINE - if a coin channel unit is detected.
If the DATU is unable to activate the PGTC or the PGTC encounters a problem in testing
the carrier channel, the DATU issues one of the following voice messages:
BYPASS PAIR BUSY OR PGTC FAILURE - the DC Bypass pair is in use, all PGTC
test circuits are busy or the PGTC cannot complete carrier system connections.
PAIR GAIN SYSTEM ALARM - the carrier system serving the selected line is in a
major alarm condition.
CHANNEL NOT AVAILABLE - channel test results were not provided by the PGTC.
BAD CHANNEL - channel tests failed - possible bad channel unit.
After a failure in carrier channel tests or in activating the PGTC, the DATU remains
in Menu Item Selection mode so that the central office personnel may more easily
determine the problem. If one of the above error messages is heard, however, the DATU
is probably not connected to the line to be tested. Therefore, line conditioning commands
will be accepted and confirmed by the DATU but the condition may not necessarily exist
on the line anytime after one of the above error messages is heard.
Remote Terminal (RT) Access
====== ======== ==== ======
After the DATU has successfully accessed the subscriber line and acquired channel
test results, the DATU will say "PLEASE ENTER PAIR GAIN SYSTEM ID. DIAL STAR TO END."
Enter Pair Gain System ID using telephone keypad. To condition line from Central
Office using the bypass pair, enter "0*". Use the following section (Alphanumeric
Pair Gain System ID Entry) if Pair Gain System ID includes alphabetic or punctuation
characters. If selected, the bypass pair must be in place between the host element of
the DATU at the Central Office and the RT.
Alphanumeric Pair Gain System ID Entry
============ ==== ==== ====== == =====
This section describes the method by which alphabetical letters may be entered using
a standard 12-key DTMF keypad.
a. Enter any leading numbers that are part of the Pair Gain System ID in
the normal manner.
b. Enter "**". This key sequence places the RT system in a special mode in
which alpha and certain other non-numeric characters may be entered as a
series of two-digit key codes.
c. The first key depression simply identifies the key on which the desired
character is stamped or printed. Press the key on which the character appears.
For example, if character is "A", "B", or "C," press the "2" key.
d. The second key depression identifies a single character from the group
(typically three letters) selected with the first keystroke. The character
is identified by it's position on the key. To select the first, press "1".
If the desired letter is the second of the three, press "2". Press "3"
if the desired letter is the third of the group.
e. Repeat steps "c" and "d" for each alpha character in the Pair Gain System ID.
When the last character has been entered, enter "**" just as previously done
in step "b". This restores the "numeric entry" mode. Special two-key sequences
are assigned to the letters "Q", "Z" and certain punctuation characters. The
table below outlines these.
f. Enter any trailing numbers that are part of the Pair Gain System ID.
g. Any combination of letters and numbers may be entered in this manner.
Repeat the appropriate steps as necessary.
h. Enter a single star (*) to complete the Pair Gain System ID entry.
i. After the Pair Gain System ID has been successfully entered, the DATU
will say "PLEASE ENTER PAIR NUMBER. DIAL STAR TO END." Enter the pair
number for the subscriber's line using the telephone keypad.
j. The DATU provides verification of the Pair Gain System ID entry with a voice
message. If a valid ID was entered, the DATU announces "ACCESS" followed by
the ID previously entered. If the Pair Gain System ID is not valid or if the
bypass pair was selected, the DATU announces "USE BYPASS PAIR".
Two-Key Sequences-Non-Numeric Keypad
2nd Key
1st Key
1 2 3 4 5
1 . , - /
(space) (period) (comma)(hyphen)(slash)
2 A B C
3 D E F
4 G H I
5 J K L
6 M N O
7 P R S Q
8 T U V
9 W X Y Z
Some Words About Male Voiced DATUs
==== ===== ===== ==== ====== =====
At this point, I should mention at least something about those DATUs with an
incredibly sexy male voice. These are an "extreme" rarity at the date of writing.
In fact, in a list of over 200 DATUs that I have, I only know of one that still
works. Upon speaking to the man at Harris who actually developed the DATU, he said,
"It's so old, you could blow dust off it." However, since it is still in use, I will
soon be writing some words about it. Please note that if you find a DATU-I in use,
that I would love to be told, as I would like to get a recording of the administrator
menu for it.
Last Remarks (for this issue)
==== ======= ==== ==== ======
To begin my ending, I would like to say to anyone who thinks "hey, cool,
I'll DATU an AOL access number and make it busy," is not only lame and stupid, but
also factually wrong. The NTT can't access hunt lines, and you may inadvertently set
off an audible alarm at your CO by doing so. Oh yes, and the "LO SLEEVE" LED of the
DATU will go on when you try. Next issue, I will go into the wild and crazy world of
the test interface for non standard offices. Following that, well, I'll see what I
can dig up for you. Perhaps something about (dare I say)... Administrator mode?
Physical and Electrical Specifications
======== === ========== ==============
(directly copied from administration manual)
Physical Dimensions
Length: 8.0 inches
Width: 7.5 inches
Height: 2.0 inches
Weight: 1.7 pounds
Electrical
Battery Input Requirement (measured with respect to CO ground):
* -46 to -54 volts DC
* 600 mA maximum
* 2 volts peak-to-peak noise maximum from CO
Access Line Interface (Ground Start)
1. Tip and Ring Parameters in Off-Hook Mode:
* Meets FCC Part 68 requirements
* Resistance is 120 - 280 ohms at 20 to 80 mA
* Minimum DC current required is 20 mA
* Typical AC impedance, at 1 kHz, is 640 ohms
2. Tip and Ring Parameters in On-Hook Mode:
* Meets FCC Part 68 requirements
* Minimum ring detect level is 65 volts AC rms
* Uninterrupted pre-trip ring duration is 300 ms
* Ringer equivalence is 0.5B
3. Secondary Dial Tone:
* Secondary dial tone is provided upon ring trip, password
entry, and new subscriber line selection
* Dial tone is silenced when a digit is dialed or when the DATU-RT
times out
* Dial tone level is -16 dBm +/-3 dBm
* Dial tone frequency is 440 Hz +/-8 Hz
* Harmonic distortion is less than 10%
4. DTMF Dial Decoding:
* Each incoming dual-tone signal is translated into one of the
12 character sets shown in Table 6-1
* Frequency deviations of up to +/-2.5% are accepted and all
deviations greater than +/-3.5% are rejected
* DTMF tones greater than 50 ms are accepted
* Interdigit timing is greater than 40 ms and less than seven
seconds are accepted
* Signal strength per frequency of -20 to 0 dBm are accepted
5. Voice Message Output:
* Average voice level is -13 dBm
* Voice frequency range is 200 to 3,000 Hz
No Test Trunk Interface
1. Tip and Ring Parameters in Idle Mode:
* Resistance is greater than 20M ohms
2. Tip and Ring Parameters in Active Mode:
* Resistance is 100 to 180 ohms at 20 - 90 mA
* Maximum DC current is 90 mA
* Typical AC impedance, at 1 kHz, is 660 ohms
3. MF Output Parameters:
* Each outgoing dual-tone sinusoidal signal is translated from
one of the 12 character sets shown in Table 6-1
* Frequency deviation is less than +/-2%
* Signal strength per frequency is -5 to -15 dBm
* Digit duration is 70 ms
* Interdigital pause is 70 ms
4. Dial Pulse Addressing Parameters:
* Percent break is 60%
* Repetition rate is 10 pulses per second
* Interdigital time is 1,000 ms
5. Sleeve Current Parameters:
* Low current mode is 7 to 10 mA into 120 ohm sleeve
* High current mode is 50 to 70 mA into 120 ohm sleeve
* Maximum external sleeve loop resistance is 700 ohms
Test Function Parameters
1. Open test is greater than 20M ohms
2. Tip and ring shorted is less than 2 ohms
3. Tone Test:
* Frequency is 577 Hz
* Frequency error is less than +/-3%
4. Low-Level Tone Test:
* Typical signal strength, measured tip-to-ground or
ring-to-ground:
* At the CO is -12 dBm +/-3 dBm
* At 18,000 cable feet from the CO is -19 dBm
5. High Level Tone Test (Differential):
* Tip-to-ring signal strength is +22 dBm +/-3 dBm
* Tip-to-ground or ring-to-ground signal strength is +17
dBm +/-3 dBm.
Tables and Other Assorted References
====== === ===== ======== ==========
Table 6-1. DTMF and MF Decoding
Frequency Groups
Character DTMF MF
Set Low High Low High
1 697 1209 700 900
2 (ABC) 697 1336 700 1100
3 (DEF) 697 1477 900 1100
4 (GHI) 770 1209 700 1300
5 (JKL) 770 1336 900 1300
6 (MNO) 770 1477 1100 1300
7 (PRS) 852 1209 700 1500
8 (TUV) 852 1336 900 1500
9 (WXY) 852 1477 1100 1500
* 941 1209
0 941 1336 1300 1500
# 941 1477
KP 1100 1700
ST 1500 1700
Acronyms That You Are Too Stupid To Know
======== ==== === === === ====== == ====
DATU - Direct Access Test Unit
HILARY - Guess :)
PGA - Pair Gain Applique
PGTC - Pair Gain Test Controller
RT - Remote Terminal
SLC - Subscriber Line Carrier (a pair gain system)
Index of Supplemental Files
===== == ============ =====
figure1.gif - DATU System Application Diagram
figure2-1.gif - Connections for All Systems (Except: 5 ESS With Integrated SLC Only,
DMS-10 and DMS-100)
figure2-2.gif - System Connections for 5 ESS With Integrated SLCs Only
figure2-3.gif - DMS-100 MDF Connections
figure2-4.gif - DATU-RT Card Pin Locations
table2-1.gif - List of NTT Circuit Numbers
table2-2.gif - LED Functions (kinda useless, but good info for SEing)
table4-1.gif - DATU Line Access Main Menu
440hz.wav - 440hz. The DATU dial tone.
614hz.wav - Two beeps heard after initial audio monitor period ends.
badntt.wav - A rare recording of a DATU reading a "Bad No Test Trunk." Thank you god,
for creating the Greenwood Lake CO.
menu.wav - The Main Menu.
prgain.wav - DATU RT working through a SLC-96 and finding a multi party line. Listen
carefully to hear Digital Matrix telling me that I should "go outside and
get him some cake". Don't ask why.
*To get these files, go to the Phone Punx Files page: http://fly.to/ppn
SASS Test Number Access
by Lineside
lineside@telehack.net
SASS test numbers can be interesting to find and play with. If you've
ever heard of DATU's (Direct Access Test Unit) or have played with one, you'd
find that SASS numbers are very similar to them. (If you want to know more
about DATU's, read MMX's article in this issue.)
For comparison, here are the test functions of a DATU:
-Audio Monitor (busy, idle line, intercept)
-Short ring to ground (tip open)
-Ring Ground
-Short tip to ground (ring open)
-High level tone on tip and ring
-High level tone on ring (tip grounded)
-High level tone on tip (ring grounded)
-Low level tone
-Open line
-Short line
-Permanent signal release
(taken from NPA DATU text)
When calling a SASS number, instead of having to directly enter a security
code it will first of all respond with an ANAC (meaning it gives you the number you
are calling from.) It will do so twice. The time during the second ANAC is when you
enter your 4-digit security code (BellSouth seems to love using 1111 and 1122 for a
lot of their stuff, including their SASS and DATU). After doing so, you get to the menu.
The menu consists of the following functions and tests which you
select using different DTMF keys:
4- Busy line verification (for deluxe call waiting/ memory call)
5- A DTMF keypad test
6- Number identification
7- Ringback test
8- Transmission measurement tests:
1- Single tone: choose between 03(304Hz) and
32 (3204Hz)
3- Three tone slope (400Hz,1004Hz, 2804Hz)
5- Quiet termination
6- Milliwatt tone
7- Tone sweep: choose start and end tone between
03(304Hz) to 32 (3204Hz). For a full tone
sweep you enter *
8- Number identification sweep: 1200HZ- 2200HZ
(for caller id)
9- Data sweep (900Hz- 2800Hz)
0- 10 tone slope (304Hz- 3204Hz)
*- return to main menu
Instead of forcing a disconnect with ## as you would with a DATU, after using the
SASS you can just hangup.
SASS functions such as the ANAC, ringback and DTMF test (for finding out
those stored #'s in butt-sets???) can be pretty useful. As for finding SASS numbers
in your area, the telco may or may not have a designated or often used prefix.
In my area the DATU and SASS numbers seem to be pretty mixed up and spread out
while regular test numbers such as ANAC usually share their prefix with lots of other
interesting telco numbers. Again, this could be different in your area.
If you have any questions, especially if you are in the south-east area,
please contact me with any questions or comments.
Visit Lineside's Telecom Site: http://www.angelfire.com/ga/Lineside/
An Intro to Paging Networks and POCSAG/FLEX interception
by Black Axe
Pagers are very, very common nowadays. Coverage is widespread and cheap, and the
technology is accepted and understood by most. Ever wonder, though, what happens on these
paging networks? Ever wonder what kind of traffic comes across those pager frequencies?
Ever listen to your scanner on a pager frequency in frustration, hearing the data stream
across that you just can't interpret? Want to tap your radio, get a decoding program, and
see what you've been missing?
Before I begin, let's cover just exactly how those precious few digits make it from
the caller's keypad to the display of the pager in question (or, perhaps, your monitor).
Let's look at this in the perspective of a drug dealer with a pager (Joe), and a confused
old lady paging him (Ethel).
First, Ethel picks up her phone, and dials Joe's pager number (555-1234).
Ethel hears the message "type in your phone # and hit #, so she complies and enters
555-6969#, and then hangs up.
Here's where the fun starts. This is all dependent on the coverage area of the
pager. The paging company receives the page from Ethel, and looks up the capcode of
the pager it is to be sent to. A capcode is somewhat akin to an ESN on a cellphone;
it identifies each specific pager on a given frequency. The paging company will then
send the data up to a satellite (usually), where it is rebroadcasted to all towers
that serve that particular paging network. Remember last year, when everyone's pagers
stopped working for a few days? It was the satellite that we are now discussing that
went out of orbit. The paging towers then transmit the page in all locations that
Joe's pager is serviceable in. In this case, let's say that Joe's pager has a coverage
area that consists of a chunk of the East Coast, going from Boston down to Washington
DC, and out to Philadelphia. The page intended for Joe is transmitted all throughout
that region. Since a pager is a one-way device, the network has no idea as to where the
pager is, what it's doing, etc., so it just transmits each page all over the coverage
area, every time. "So?", you may say, "what's that do for me?" Well, it means two
different things: first, that pagers can be cloned with no fear of detection, because
the network just sends out the pages, and any pager with that code on that frequency
will beep and receive the data. Second, it means that one can monitor pagers that are not
based in their area. Based on the example of Joe's pager, Joe might have bought his
pager in New York City. He also could live there. However, because the data is
transmitted all over the coverage area, monitoring systems in Boston, Washington DC, and
Philadelphia could all intercept Joe's pages in real time. Many paging customers are
unaware of their paging coverage areas, and usually do not denote the NPA (area code)
from which the page is being received. This can cause problems for the monitoring
individual, who must always remember that 7-digit pages shown on the decoder display
are not necessarily for their own NPA.
The Pager Decoding Setup
Paging networks aren't encrypted. They all transmit data in the clear, generally in one
of two formats. The older format is POCSAG; which stands for Post Office Code Standards
Advisory Group. POCSAG is easily identified by two separate tones, and then a burst of data.
POCSAG is fairly easy to decode. FLEX, on the other hand, is a bit more difficult, but not
impossible. FLEX signals have only a single tone preceding the data burst. Here's how to
take those annoying signals out of your scanner and onto your monitor. You will need:
1. A scanner or other receiver with a discriminator output. Info on this mod is available
on the net and it's fairly easy to perform. This will enable you to get a clean audio
signal out of the scanner, as opposed to the amplified crap out of the speaker or
headphone jack.
2. A computer.
3. You will need a Soundblaster compatible soundcard. This will let you snag POCSAG
traffic. Or, you can build a data slicer and decode FLEX traffic too. Or you can be
lazy and buy one from Texas 2-Way for about $80 or so. The Soundblaster method will
obviously tie up your computer decoding pages. Using the slicer will let you run
decoders on an old DOS box and will let you use your better computer for more
important stuff.
4. Antennas, cabling, etc. You will need an RCA cable (preferably shielded) to take the
discriminator output either into the soundcard or into the slicer. If using a slicer,
you will also need the cable to connect your slicer to your computer. As far as antennas
go, pager signals are VERY strong, so you won't need much of an antenna, I generally
use a rubber ducky with a right angle adapter, attached right to the back of the radio,
works fine. The signals are so damned strong that you might even be able to get away
with a paper clip shoved into the antenna jack.
Hook all of this stuff together, it should be obvious as to how it is assembled. Tune
yourself a nice, strong (they're all strong, really) paging signal. Where are they? Well, the
vast majority of numeric pagers are crystalled between 929 and 932mHz; try there. Or if you
want to try decoding some alphanumeric pagers, try 158.1mHz. Now, what about software, you
say? That is where things start to get kinda hairy. See, Motorola developed most of this stuff, and holds licenses to it. Any software that decodes POCSAG is some sort of copyright violation or something or other, hell, I don't know. So one day, the morons at Mot decided
that they didn't want that software floating around. So they looked up everyone who had copies
posted on the Web and told em that if they didn't knock it off, it was court time. The
threatened webmasters removed the offending copies, fearing a lawsuit from the well-heeled
Motorola with their gangs of lawyers. Ouch. After this, our good friends from the United
States Secret Service arrested Bill Cheek and Keith Knipschild for messing around with
decoding hardware and software - the SS appeared to want to make data slicers illegal. Of course, these arrests were ridiculous, but nobody wanted to get busted, so the vast majority
of resources on American websites disappeared. Checking around English or German sites may
yield some interesting results.
Now you're ready. Fire up the software. Get that receiver on a nice, hot frequency. Look
at all of the pages streaming across the network. Give it a few hours. Getting bored yet?
Okay, now that you have a functional decoding setup, let's make use of it. Know someone's
pager that you want to monitor? Here's how to snag em. First you need the frequency; it's
usually inscribed on the back of the pager. Also, you can try to determine what paging company
they use and then social engineer the freq out of the company. www.perconcorp.com also has a
search function where you can locate all of the paging transmitters (and freqs) in your area,
listed by who owns em. Not bad. So you have the frequency, now what? Well, wait until you
have to actually talk to this person. Get your setup cranking on the frequency that this
person's pager is using. Now, page him. Pay close attention to the data coming across the
network. See your phone number there? See the capcode that your phone number is addressed to?
That's it. Some better decoding programs have provisions to log every single page to a certain
capcode to a logfile, this is a good thing. Get a data slicer, set everything up on a
dedicated 486, and have fun gathering data.
Satellite Systems: Reception
by Black Axe
Ever look up at the sky, and wonder what's up there? Ever watch someone's
satellite TV and wonder, "gee, maybe if I turned the dial and swung the dish around
a bit, I could see what else is up there.."? Hopefully, this article can help inform
the reader about the most common and easily intercepted forms of satellite communication.
Before we begin, there are a few important concepts, that we must cover. If you know
anything about satellites, this part should bore you. All satellites orbit the earth.
Some of those satellites orbiting the earth are put into such an orbit that they appear
motionless to an earth-based station; in layman's terms, they don't go anywhere. These
types of satellites are referred to as geosynchronous. Other satellites will orbit the
earth. Because they move in perspective to the earth-based observer, that observer must
keep track of where exactly the satellite is at any given time (usually for purposes of
antenna calibration). Keplerian Elements, readily available for most (non-spy) satellites,
can be entered into a variety of different freeware, shareware, and commercial programs to
track the satellites. Some programs can even orient your antennas or dishes for you, to
get the best possible signal as the satellite moves across the horizon.
These topics having been covered, let us delve deeper into what our dishes
and antennas can fish out of the cosmos.
-Amateur Radio Satellites
One of the easiest types of signals to receive from space is from amateur (Ham)
satellites. Most amateur satellites use uplinks and downlinks in the VHF and UHF bands,
making antenna requirements easy to fulfill. Most of the time, a properly oriented
telescoping whip is all that is needed. Operating modes vary; CW (Morse code) is often
used. Other operating modes include SSB (Single Sideband), various digital modes, and FM
voice (specifically, the AO-29 satellite). The interesting part about amateur satellites is
that not only does one have the ability to listen in, but also the ability to use these
satellites for their own communications. Some digital
satellites even house entire BBS systems.
-MIR and SAREX
One can also communicate with the Russian space station, MIR, and
(at certain times) the American Space Shuttle (SAREX). Cosmonauts aboard the space
station MIR operate voice and a packet (digital) system onboard in the 144-mHz
amateur band. The American Space Shuttle's SAREX (Space Amateur Radio Experiment)
is a more clandestine operation, consisting of a handheld radio and a window-mounted
antenna. FM voice is used on a number of different frequencies in the 144mHz band.
Amateur radio operators are EXTREMELY competitive in making a SAREX contact, usually
just for the nice postcard (QSL) that NASA sends.
-Inmarsat
Now we delve into more of a "grey area" of satellite monitoring. The Inmarsat
system consists of four geosynchronous satellites serving the entire surface of the
Earth with satellite telephone service. Ridiculously expensive, Inmarsat service
is generally only used by well-funded people and organizations. Some Inmarsat
traffic is digital. However, there is still an abundance of voice traffic to be
intercepted. Transmission mode is companded FM, meaning that signal strength
varies with the noise level (used to conserve power consumption); set your squelch
accordingly. To intercept Inmarsat traffic, a receiver capable of covering
1500mHz
is required, along with a dish and a directional antenna (Yagi). Orient the Yagi
(tuned for the band) towards the dish, and affix it to the dish's LNB. Find the
satellites in the sky (this will be left as an exercise for the reader); tune the
receiver to 1537mHz to find a constant signal transmitted by the satellites.
Modulation mode is Narrow FM; steps of 25kHz. Have a tape recorder ready; you never
know what you'll hear.
-TVRO
TVRO stands for TeleVision Receive Only. Basically, it is what is known as
satellite TV. Although many pay services are common nowadays, it is still possible
to intercept a great deal of analog video traffic from TVRO satellites. Basically,
what is required is a TV (of course), a satellite receiver, a dish with an LNB
(Low Noise Block converter), and rotors to spin the dish around. What's out there,
you say? Of course, there's regular network TV, and many other less-common broadcast
services. By far, the most interesting part of TVRO is "wild feeds", that is, live
video being transmitted from various locations to broadcast studios. For example,
during the conflict at Waco, there were four live and uncensored feeds coming out of
Waco, 24 hours a day. You'll get to see all the blood and guts that are edited out
of the network broadcast, along with reporters you'll recognize very well bitching
before a broadcast, smoking a quick cigarette, etc. The world of TVRO is vast
and ready for exploration.
The elusive Project Angel
by Mohawk
I first talked about Project Angel in OCPP Issue 3. I was really interested in
this revolutionary technology that planned to totally bypass Bell's switches and offer
better service at a cheaper price. Not only would this make local competition interesting
but this had some very unique implications for the phreaking scene. How would this change
the phreaking scene? I couldn't wait for the consumer rollout to see all the new phreaking
exploits that were spawned from Project Angel. Two years after Issue 3, I'm still waiting
and information about what happened to Project Angel is very scarce. Some of you are
probably hearing about this for the first time. This is probably the most complete
article you'll find on this topic. There so many different stories as to what's going on
it's hard to separate fact from fiction. I had to piece this story together with facts
that are spread out in various mediums over a period of several years. If you have any new
information, I screwed up on something, or left something out, please email me.
I've been researching project angel for about three years now and it first came into
the public eye in early 1997. However, this technology has been in the works for most of
the 90's. In early 1993, McCaw Cellular Communications tested a technology known internally
as "Project Dino". This wireless local loop technology eventually turned into Project Angel.
AT&T bought out McCaw later that year and it becomes part of AT&T's Wireless Services. At
the end of 1994 AT&T bid on 10-MHz wireless licenses in FCC auctions. For about an entire
year things got quiet again. In early 1996 AT&T sought local telephone certification in
all 50 states after the Telecommunications Act of 1996. The ironic thing here is that
AT&T is seeking to break into the local telephone monopoly that's held by the baby bells
who were all once part of AT&T's telecommunications monopoly that was broken up in 1984.
And to do that they have to come up with a new technology.
On February 25th 1997, John Walters reveals Project Angel to the world at the NARUC
gathering (see OCPP 3 for his speech). News releases detail how this new technology will
work. Central Offices will be replaced be Digital Switching Systems that are outfitted
with fiber optic cable. Blocks of 2000 homes are grouped together and share one antenna.
Each house will have a pizzabox sized radio transceiver box on the roof that will connect
it with the DSS by converting voice and data transmission into digital information and
sending it through the air over the 10-MHz radio spectrum to an antenna and then on to the
DSS. Each home will get four phonelines and one 128 kb/s data line. AT&T claims that
this new technology will provide quality and security at a cheap price. Beta testing is
announced for Chicago in the summer of 97 and a full consumer roll out in 1999. The
media has a frenzy with all this information and some people predict the end of CO's if
everything goes right. This sounds really cool huh? Four phone lines, a fast data
connection, a cool new technology to play with, and cheaper then the typical babybell
service. Things looked like they were gonna get very interesting.
Flash forward two years later. What the hell happened? It's almost impossible to
find any news coverage as to the updates on angel. I'm not gonna bore you with corporate
details about who went where but it's important to keep in mind that AT&T juggled around
executives for the past couple years and each time a new person comes and go's the emphasis
of the company shifts. The Chicago beta test didn't begin until December of 1997, months
after it was supposed to take place. This was kept under raps by AT&T for the most
part and for good reason. It turns out that the big beta test that would determine the
public's opinion of Project Angel was only given out to a few customers (between 5 and 10,
an exact number wasn't determined). However, AT&T did say that it was pleased with the
Chicago test and the some of the people working on it wore shirts that said "we deliver"
which was in reference to the boxes on the houses looking like pizza boxes. A lot of
people in the industry saw this as a failure due to the lack of information about the
Chicago trial.
In early 1998 AT&T acquired Teleport Communications and most people thought that
this signaled the end of Project Angel because Teleport was a local telephone company and
this would give AT&T all they needed for local competition. AT&T announced that PA was
alive and that it isn't dead and that Teleport would assist with the project. However,
at the same time Project Angel shifted from a "Babybell monopoly killer" to just one of
the options that AT&T can use to enter the local market. Many people left the project
because they felt that they needed to get out why they could. I talked to several people
who were involved with the project and they said that the cost of a roll out alone was far
higher then originally expected and it was not profitable and therefore had no future.
Cost has been an issue since John Walters speech. It was ordered that the cost must be drastically reduced.
For a while, the was just no news on Angel but in May 1999 things were looking up
again for this ill-fated technology. The company announced that it would begin testing in
Dallas Texas and that it has been testing it out with employees for months. The tests
would be free to certain customers and then it will be tested with paying customers this
summer. The company reduced it costs from $1149 per customer to $750 still short of the
under $500 target that most analysts see as the minimum competitive price. At the same
time, AT&T announced that is has started voice over cable service with paying customers in
Fremont, California.
And that brings us to now and is spurs the question, What's the future of Project
Angel? I just don't see Project Angel becoming this huge thing that just shuts down CO's
across the US. AT&T's main emphasis has been on cable and they will most likely use Angel
or a version of it to reach it's customers where cable can't. I've heard some rumors that
a similar technology is being developed by other companies for the US and Asia. Companies
are looking into merging cable, phone, and internet access and becoming your one stop shop
for these services. If Angel becomes part of this convergence or just gets filed under the
spoke to soon pile remains to be seen. Of course, we'll bring you updates when and IF they
come.
Zine Writing Suggestions
by the Phone Punx Staff
Remember a few years ago when having your own group was the k-rad thing to do? How
about when your own domain was a sign that you were 31337? Well the new underground
status symbol appears to be having your own h/p zine. Sit down, shoot your mouth off,
insert some info from a coffee stained printout you found at the CO and you're ready to
rock. Simple, no? After watching a host of start-up zines start up and then fall on their
faces, the staff here at Phone Punx has decided to lay a little of our hard-earned zine
production wisdom out for all of you considering your own publication.
Don't even THINK of releasing your first issue until you have enough material for your
first 3 issues. There are few things more sad than seeing a new zine release one issue
and then cop out.
Don't try and run the whole thing yourself. We have 2 editors and a handful of stupidly
hard working writers who still struggle to meet deadlines.
Proof-read all issues. They call you an 'editor' for a reason.
Spellcheck!!! Nothing looks worse than glaring typos.
Don't include IRC logs. We don't care how cleverly you tormented that poor bastard
on #rock. Same goes for prank call logs.
Ask yourself: do you think your readers REALLY care what you thought of a con or
what you did there? And if you do put some con reviews and the like in an issue,
don't make it the ENTIRE issue.
Keep the fancy graphics to a minimum. Most zine readers aren't astounded by your
command of Photoshop nor do they have cable modems to download your graphics with.
Try and act like an adult. A lot of curse words, 31337 spelling, etc. just make
you look childish and people will take you less seriously.
We've all seen that same damn list of telco acronyms. Don't publish it again.
Are you planning on including a schematic in your zine? Include it as a graphic, not
an ASCII. Circuit diagrams get all kinds of screwed up when they're put up in ASCII
pictures.
Sacrifice release dates for completeness. Having an intro and 2 articles every month
is nothing compared to a quarterly with lots of good info in it.
Set up a mailing list for readers and a separate one for your staff. Keep your readers
informed with releases of new issues and other updates. As for the staff list, keeping
them informed as to what's going on will make them feel more involved and in return you'll
get a better product. Also, you and your staff can kick ideas back and forth and learn a
thing or two from each other.
If you reprint a manual make sure you label it as such. Plagiarizing a manual and passing
it off as yours won't really impress people. You'll look pretty damn stupid and even more
so when somebody asks you to elaborate on something you "wrote" and you have no clue what
you're talking about.
Think long and hard about printing numbers. The fastest way to kill a number is to print
it where anyone with an Internet connection can get the number and abuse the hell out of
it.
If you want to write an editorial don't just bitch about something. Provide reasons for
your opinion and how to fix the problem.
Don't publish an enemies list. Prank calls to random people only amuse the simple
minded.
If you post archives of old textfiles, try not to make a huge list of them. A handful of
GOOD files, along with a few comments on why you selected them is a better idea.
Be prepared to go the distance. Most people quit zines because of a lack of
readership/support and because they can't handle everything else that goes along with
writing a quality zine. There is a lot to deal with when writing a zine. If your zine
does become the new authority of the H/P zine, are you prepared to handle that
responsibility? Also, you shouldn't expect everyone to just worship you from the start.
There are so many zines that come and go within an issue or two that not too many people
really care. You might have to release several issues before anyone notices you. Now I
know your thinking, "what about zine XXXXX that got really huge from issue 1 and they
really sucked". Well you have to look at who is backing them. Some zines are backed by
groups that have a well known reputation and have a loyal fan base. If a higher up from
that group proclaims that some crappy zine is the best thing ever, then so it will be
without a second thought. Of course there are a few zines that are good right from the
start, but they are far and few.
Last and probably most important, ask yourself why you're doing this in the first place.
Most of us with PPM do this because we feel what we are doing is both needed and wanted.
In my opinion, writing a zine for just the hell of it, to be k-rad, or just because it's
the cool thing to do at the moment is just wrong. However, writing for a zine to get
chics is totally acceptable.
Cyberpunk Culture
by Mohawk
I have changed the Cyber Culture section to the Cyberpunk culture section.
This will also take the place of the news section. There are plenty of places these days
to get the latest news on hackers and Net issues. So I am going to cover various issues that
interest and effect those involved in the H/P community. My main focus is going to be on issues that aren't really talked about. Because of this, I'm gonna be playing the Devil's
Advocate with some of these issues so that way it sparks your interest and gets you thinking.
-Cyber Speak Candy
It was bound to happen, Computer-related candy. Made by Necco (http://www.necco.com),
they are floppy disk shaped candy that have computer sayings like "Let's Chat", "Email Me",
and my reason for writing this article, "Cyber Punk". Cool huh? They're similar to candy
hearts that they sell for Valentines day. Candy for nerds and hackers. Kick ass. Actually
no. You know those candy wafers that no one ever eats and they just sit in the store for
years on end? Well that's what there made out of. They taste pretty bad. They should of
at least made them taste like Valentine's Day hearts, they taste a little better. But you
should get them though. You could tile your wall with crazy computer sayings. The box is
kinda cool looking too. Let's hope the next kind of computer-related candy that comes out
actually tastes good.
-Review of "Pirates of Silicon Valley"
The made for TV movie "Pirates of Silicon Valley" recently debuted on TNT to some
great reviews. The movie which is based on a true story follows the story of Bill Gates, founder of Microsoft and Steve Jobs, founder of Apple Computer and how they started out.
Their lives parallel and they eventually cross paths. This is one of the first movies
about computers that doesn't involve dramatic plots about hackers or the government. And
the surprising fact is that it is a very good movie. Who ever though that a movie about
a couple nerds starting computer companies and screwing people over would make a good
movie without any crazy plot twists? I love the movie, just can't watch it enough.
However, not everyone in the H/P community shares my opinion. I saw a lot of negative
comments about the movies, saying that the movie wasn't true and that they don't like
Gates to begin with, etc. First of all, this was "based on a true story", it's not a documentary. The producers took dramatic license on various points in the story. This
is where they take a story and change things to make it more dramatic. The general public
is gonna get bored out of their mind watching a documentary about Apple and Microsoft.
These people should win an award for making the movie interesting. You should also try to
put aside your opinions about Jobs and Gates and just enjoy the movie. If it bothers
you that much, pretend like it's a complete fiction and just try to enjoy it. Hopefully
we'll see more movies about computer-related stories.
- 7-11: the 24-hour hacker target
Next month the roll out for 7-11's technological make over will be finished. They
are just one of the latest stores joining the move to get computerized. 7-11 is the
largest convenience-store chain but each store only makes a little over a million a year.
Because of this information technology has never been a major concern but computer costs
are down and the move will increase sales in the long run.
The new system will improve inventory management, sales data, and it position with
suppliers. The system includes new software and hardware for each stores checkout counter
and back office. At the checkout counter they'll have a scanner and touch screen driver
system running DOS on NCR Corps. 7450 and 7453 PC cash registers. Clerk will use wireless
handhelds to receive guidance about what product belongs where and it will also aid in
ordering products. In the back office, applications for data reporting and analysis,
pricing, accounting, and other store functions on Windows NT. The servers which are
connected via ISDN are 233-MHz Intel Pentium II machines also from NCR.
At the corporate headquarters, they run a massive Oracle Corp. data warehouse on
Hewlett-Packard Unix Servers. I don't know what kind of security they run but it's probably
something like disabling certain functions. That's usually the norm in small stores running
NT. All of this technology present a huge target for hackers. Many hackers work at convenience stores some time in their hacking lives and employees are often left alone in
the store. The store managers are usually clueless about computers and they probably won't
consider hacker employees. Add that in with the fact that a majority of computer attacks
come from disgruntled employees and convenience stores are full of them. Also, the newly
released Back Orifice 2000 adds one more security issue in the mix. All together, this
presents a prime opportunity for hackers to really screw up 7-11. With over 95,000 stores
I expect we'll be hearing about some interesting 7-11 computer hacks.
-Review of ZDTV's Defcon Coverage
ZDTV, the 24-hour computer channel advertised extensive coverage of DefCon for more
then a week before the start of the con. I didn't go to DefCon so I though I'd get to see
what was goin on. They local news and CNN usually has poor coverage where the bash hackers
for thirty seconds. My Internet connection sucks so I couldn't watch it over the net. Well
I watched ZDTV all weekend, waiting for that Defcon coverage they advertised so much. I told
a lot of people about it and they too were waiting. They barely even mentioned DefCon until
late Sunday. Then they had a five part story about Defcon throughout the week and Silicon
Spin also talked about it. However, most of their coverage was focused on just BO2K. They
should of showed more of the con and everything that went on. They did show a small part
of spot the fed and they interviewed a couple people such as Dildog, Wels Pond, Count Zero,
and Gail Thackery. The way they did it though, it seemed that BO2K was the whole thing.
They should of had a best of DefCon show or something similar to demystify the con to the
general public. I was kinda pissed that they advertised coverage all weekend starting on
Friday and they barely said anything until Sunday. I try to be a nice guy and not judge
people by their looks but I saw a couple nasty people at DefCon from the coverage they do
show. Ok, so not everyone is the coolest looking person in the world, I understand but I
wonder if some of you people even own a friggin mirror. I'm talking about straight out of
"Revenge of the Nerds". Stop having your mother dress you. Anyway, sorry about that.
Someone has to do it.
Despite all of this, ZDTV is still a great channel. Hell, there the only computer
channel, that I get anyway, and I hope they learn how to handle things better in the future.
One thing I like is that they let both sides talk, they let the hackers give their side,
and they let the people against it give theirs. However, I have to take issue with hackers
and the media. The message needs to get out more that not all hackers are evil and that
were as diverse as any other culture. If anyone reading this ever gets on camera, try to
slip that in there somewhere. In my opinion, getting this message out should be top
priority and not a program but maybe that's just me.
-Free Internet Access & it's problems
It seems that everything will eventually wind up being free as long as you sit
through advertisements to get at it. The latest free service is Internet Access.
However, this brings about a range of issues.
Alta Vista will start offering free net access starting in September. All they ask
in return is that you view ads and enter information about yourself. They can then sell
that information to direct marketers. When something like this happens with the Internet,
more companies will come out with their own free access. Banks and department stores will
be the one of the first companies to join the bandwagon. Of course their ads will be
geared towards them. They'll be handing out free CD based login software at the stores
when you buy something. They will also be able to track what websites you visit and for
how long.
While this may seem like a good idea to some, there are just so many issues that this
raises. Cost is a major factor. How are they going to handle the insane amount of people?
It turns out that they still don't really know. Remember when AOL switched to $20 a month
for unlimited use? It was crazy. You were lucky if you could even get a busy signal. All
the calls practically shut down a switch by me. A Bell tech I talked to said He never saw
anything like it in his life. If it's even halfway decent access, a lot of people will want
to use it even if it's just for screwing around.
Some people will also be concerned with privacy. I've heard this concern about other
free services. If you're that freaked out about it, then don't do anything "sensitive" when
your on it.
Another major concern is hackers. This is take anywhere, anonymous access. We've
all free had access through one way or another, whether it be the library or hacking into
someone's account. However, the difference with this is it "could" be completely untraceable.
How will they know if you enter in the wrong information? Having someone enter in a credit
card would cut down on this but you that would be strange since it's free. Besides,
this would cut out a lot of people. I haven't heard a thing about security with free net
access. Since it hasn't been raised yet, it's probably not a big concern to Alta Vista.
Therefore, they probably have no security measures. Spammers would also have a field day
with this. They'll have to come up with a way to verify your information.
Another issue is how will a flood of new people effect the net. Other ISPs will have
to lower their prices and improve service to stay competitive. Could certain websites handle
so much extra traffic? We've seen plenty of examples in the past of websites shutting down
because they couldn't handle everyone.
There are other issues that could be raised but the main concern with you should be
security issues. There going to have a hard time keeping up with the cost of all the
people that want the service so I doubt that they spent more then 5 cents on security. Besides, I doubt anyone would use this service for anything bad anyway.
Letters
We will print your letters. If you would like to make a comment, ask a question,
or whatever, send them in and we will publish them. If you don't want your letter
published, just let us know. All email address will not be published unless you
tell us otherwise.
From JD
Hey ,
I was just on your interesting and eye opening web site and I was wondering
if you have any information on spanish phone lines or could put me in
touch with someone who would know about them,
thanx in advance
JD
>Try to get in touch with phreaks in the UK and Germany, they might have
info on the rest of Europe.
From: Mark
hi there.what is the best newsgroup to find out about phreaks,cards, emulators
etcetc???
many thanks
>Well the best NG for phreaking is alt.phreaking of course however, keep
cards, emulators, etc. out of there. You'll have to find that info elsewhere.
From: Spcbytch
HEY I NEEN INFO ABOUT MAKING BOXES U KNOW LIKE BLACK ONES AND I CAN
FIND IT ANYWHERE IF U COULD HELP OUT I WOULD APPRECIATE IT. PEACE SPCBYTCH
>Hooked on Phonics, get it, please. If you want boxes try a search engine.
There is so much more to phreaking then just boxes, I suggest you forget about
them. At least explore the other areas of phreaking. There is so much out
there but everyone is concerned with boxes that stopped working years
ago.
From: hevnsnit
Hey, I am holding a Who's got the worlds best beige contest going, and I
was wondering if I could get a link to it, or any kind of other help with it..
Basically I just want to spread the word..
Thanks,
-hevnsnit
http://listen.to/att
>Done, mentioned in the newsletter and right here. If anyone has anything
else like this that they'd like to promote, feel free to send it over.
From: Port Error
ocpp,
Hey whatz up, im a local NJ phreaker/hacker, i'm from south jersey, cherry hill
area, thats all ill say, i'm pretty happy to see...someone has taken charge of
the NJ h/p peeps...I was just wondering if yah would exept any articals i have
written about certain systems i have worked w/ and certain hardware like cisco
routers. I can just say one thing from experience, if yah ever go beige boxin,
were gloves, and never ever ever, put your finger on the metal part of the
aligator clips when yah hook it up to a TNI or can....hehe.....you get
zaped...haha....but that was when i was learnin, but anywayz, i gtg, email me
back w/ some information, thanxs
>You could send us your articles, but please word them better
then you did your letter. We haven't taken charge of any "peeps".
I use to get them around Easter time but I would just chuck em. I'm
not much of a marshmallow person. We don't have much to do with NJ
anymore really. Most of us don't even live there. Touching metal
while hooking it up to another piece of metal that is hooked up to
electricity is never a good idea.
From: Mercury Gear
A few questions for the OCPP:
A: Do u need anyone to write? Seems like a pretty cool mag.
B: Different parts of Jersey, eh? Got any members located in the
Woodbury (Glassboro Township) area? We need phreaks here! There are
aprroximately 1.5 (besides myself) that I know of.Mmm, that's it.later
>We could always use more writers. We have a great staff now but the more writers
we have, the more faster we could crank out issues. We're not really NJ based
anymore, that was the OCPP. We're spread out all over the US.
Copyright 1999 Phone Punx Network. Feel free to distribute this issue however,
do not modify this file in any way. All issues are free and are not allowed to
be sold in any form. If you are selling issues you can only charge what it cost
to reproduce them. Keep the information free. All works are owned by the PPN
and/or the authors of the article. If you feel that you own the copyright to a
work printed in this issue and have not given the permission of the author to
republish it, please email us. 
