Copy Link
Add to Bookmark
Report
Pure Bollocks Issue 22_052
---------------------------------------------------
* C O O K I N G * W I T H * J O L L Y * R O G E R *
---------------------------------------------------
A SPECTRUM OF BOXES!!!!
Blue Box courtesy of the Jolly Roger
To quote Karl Marx, blue boxing has always been the most noble form of
phreaking. As opposed to such things as using an MCI code to make a free
fone call, which is merely mindless pseudo-phreaking, blue boxing
is actual interaction with the Bell System toll network.
It is likewise advisable to be more cautious when blue boxing, but the
careful phreak will not be caught, regardless of what type of switching
system he is under.
In this part, I will explain how and why blue boxing works, as well as
where. In later parts, I will give more practical information for blue
boxing and routing information. To begin with, blue boxing is simply
communicating with trunks. Trunks must not be confused with subscriber
lines (or "customer loops") which are standard telefone lines. Trunks are
those lines that connect central offices. Now, when trunks are not in
use (i.e., idle or "on-hook" state) they have 2600Hz applied to them. If
they are two-way trunks, there is 2600Hz in both directions. When a trunk
IS in use (busy or "off-hook" state), the 2600Hz is removed from the side
that is off-hook. The 2600Hz is therefore known as a supervisory
signal, because it indicates the status of a trunk; on hook (tone) or
off-hook (no tone). Note also that 2600Hz denoted SF (single frequency)
signalling and is "in-band." This is very important. "In-band" means that
is within the band of frequencies that may be transmitted over normal
telefone lines. Other SF signals, such as 3700Hz are used also. However,
they cannot be carried over the telefone network normally (they are
"out-of-band" and are therefore not able to be taken advantage of as
2600Hz is. Back to trunks. Let's take a hypothetical phone call. You pick
up your fone and dial 1+806-258-1234 (your good friend in Amarillo, Texas).
For ease, we'll assume that you are on #5 Crossbar switching and not in the
806 area. Your central office (CO) would recognize that 806 is a foreign
NPA, so it would route the call to the toll centre that serves you.
[For the sake of accuracy here, and for the more experienced readers,
note that the CO in question is a class 5 with LAMA that uses out-of-band
SF supervisory signalling]. Depending on where you are in the country,
the call would leave your toll centre (on more trunks) to another toll
centre, or office of higher "rank". Then it would be routed to central
office 806-258 eventually and the call would be completed.
Illustration
A---CO1-------TC1------TC2----CO2----B
A.... you
CO1=your central office
TC1.. your toll office.
TC2.. toll office in Amarillo.
CO2.. 806-258 central office.
B.... your friend (806-258-1234)
In this situation it would be realistic to say that CO2 uses SF
in-band (2600Hz) signalling, while all the others use out-of-band signal-
ling (3700Hz). If you don't understand this, don't worry. I am pointing
this out merely for the sake of accuracy. The point is that while you
are connected to 806-258-1234, all those trunks from YOUR central office
(CO1) to the 806-258 central office (CO2) do *NOT* have 2600Hz on them,
indicating to the Bell equipment that a call is in progress and the trunks
are in use.
Now let's say you're tired of talking to your friend in Amarillo, so you
send a 2600Hz down the line. This tone travels down the line to your
friend's central office (CO2) where it is detected. However, that CO thinks
that the 2600Hz is originating from Bell equipment, indicating to it
that you've hung up, and thus the trunks are once again idle (with 2600Hz
present on them). But actually, you have not hung up, you have fooled the
equipment atyour friend's CO into thinking you have. Thus,it disconnects
him and resets the equipment to prepare for the next call. All this happens
very quickly (300-800ms for step-by-step equipment and 150-400ms for other
equipment). When you stop sending 2600Hz (after about a second), the
equipment thinks that another call is coming towards
--> on hook, no tone -->off hook.
Now that you've stopped sending 2600Hz, several things happen:
1) A trunk is seized.
2) A "wink" is sent to the CALLING end from the CALLED end indicating that
the CALLED end (trunk) is not ready to receive digits yet.
3) A register is found and attached to the CALLED end of the trunk within
about two seconds (max).
4) A start-dial signal is sent to the CALLING end from the CALLED end
indicating that the CALLED end is ready to receive digits.
Now, all of this is pretty much transparent to the blue boxer. All he
really hears when these four things happen is a <beep><kerchunk>. So,
seizure of a trunk would go something like this:
1> Send a 2600Hz
2> Terminate 2600Hz after 1-2 secs.
3> [beep][kerchunk]
Once this happens, you are connected to a tandem that is ready to obey your
every command. The next step is to send signalling information in order to
place your call. For this you must simulate the signalling used by
operators and automatic toll-dialing equipment for use on trunks. There are
mainly two systems, DP and MF. However, DP went out with the dinosaurs, so
I'll only discuss MF signalling. MF (multi-frequency) signalling is the
signalling used by the majority of the inter- and intra-lata network. It is
also used in international dialing known as the CCITT no.5 system.
MF signals consist of 7 frequecies, beginning with 700Hz and separated by
200Hz. A different set of two of the 7 frequencies represent the digits 0
thru 9, plus an additional 5 special keys. The frequencies and uses are as
follows:
Frequencies (Hz) Domestic Int'l
-------------------------------------
700+900 1 1
700+1100 2 2
900+1100 3 3
700+1300 4 4
900+1300 5 5
1100+1300 6 6
700+1500 7 7
900+1500 8 8
1100+1500 9 9
1300+1500 0 0
700+1700 ST3p Code 1
900+1700 STp Code 1
1100+1700 KP KP1
1300+1700 ST2p KP2
1500+1700 ST ST
The timing of all the MF signals is a nominal 60ms, except for KP, which
should have a duration of 100ms. There should also be a 60ms silent period
between digits. This is very flexible however, and most Bell equipment will
accept outrageous timings. In addition to the standard uses
listed above, MF pulsing also has expanded usages known as "expanded
inband signalling" that include such things as coin collect, coin return,
ringback, operator attached, and operator attached, and operator
released. KP2, code 11, and code 12 and the ST_ps (STart "primes" all have
special uses which will be mentioned only briefly here.
To complete a call using a blue box once seizure of a trunk has been
accomplished by sending 2600Hz and pausing for the <beep><kerchunk>, one
must first send a KP. This readies the register for the digits that follow.
For a standard domestic call, the KP would be followed by either 7 digits
(if the call were in the same NPA as the seized trunk) or 10 digits (if the
call were not in the same NPA as the seized trunk). [Exactly like dialing
normal fone call]. Following either the KP and 7 or 10 digits, a STart is
sent to signify that no more digits follow. Example of a complete call:
1> Dial 1-806-258-1234
2> wait for a call-progress indication (such as ring,busy,recording,etc.)
3> Send 2600Hz for about 1 second.
4> Wait for about ll-progress indication (such as ring,busy,recording,etc.)
5> Send KP+305+994+9966+ST
The call will then connect if everything was done properly. Note that if a
call to an 806 number were being placed in the same situation, the are code
would be omitted and only KP + seven digits + ST would be sent.
Code 11 and code 12 are used in international calling to request
certain types of operators. KP2 is used in international calling to route a
call other than by way of the normal route, whether for economic or
equipment reasons. STp, ST2p, and ST3p (prime, two prime, and three prime)
are used in TSPS signalling to indicate calling type of call (such as
coin-direct dialing.
--------------------------------
Aqua Box Plans by Jolly Roger
Every true phreaker lives in fear of the dreadded F.B.I. 'Lock In Trace.'
For a long time, it was impossible to escape from the Lock In Trace.
This box does offer an escape route with simple directions to it.
This box is quite a simple concept, and almost any phreaker with basic
electronics knowledge can construct and use it.
The Lock In Trace
------------------
A lock in trace is a device used by the F.B.I. to lock into the phone
users location so that he can not hang up while a trace is in progress.
For those of you who are not familiar with the conecpt of 'locking in',
then here's a brief desciption. The F.B.I. can tap into a conversation,
sort of like a three-way call connection. Then, when they get there,
they can plug electricity into the phone line. All phone connections
are held open by a certain voltage of electricity.
That is why you sometimes get static and faint connections when you are
calling far away, because the electricity has trouble keeping the line
up. What the lock in trace does is cut into the line and generate that same
voltage straight into the lines. That way, when you try and hang up, voltage
is retained. Your phone will ring just like someone was calling you
even after you hang up. (If you have call waiting, you should understand
better about that, for call waiting intersepts the electricity and makes
a tone that means someone is going through your line. Then, it is a matter
of which voltage is higher. When you push down the receiver,then it see-saws
the electricity to the other side. When you have a person on each line
it is impossible to hang up unless one or both of them will hang up.
If you try to hang up, voltage is retained, and your phone will ring.
That should give you an understanding of how calling works. Also, when
electricity passes through a certain point on your phone, the electricity
causes a bell to ring, or on some newer phones an electronic ring to sound.)
So, in order to eliminate the trace, you somehow must lower the
voltage level on your phone line. You should know that every time
someone else picks up the phone line, then the voltage does decrease
a little. In the first steps of planning this out, Xerox suggested getting
about a hundred phones all hooked into the same line that could all
be taken off the hook at the same time. That would greatly decrease the
voltage level. That is also why most three-way connections that are using
the bell service three way calling (which is only $3 a month) become quite
faint after a while. By now, you should understand the basic idea. You
have to drain all of the power out of the line so the voltage can
not be kept up. Rather sudden draining of power could quickly short out
the F.B.I. voltage machine, because it was only built to sustain
the exact voltage nessecary to keep the voltage out. For now, imagine
this. One of the normal Radio Shack generators that you can go
pick up that one end of the cord that hooks into the central box has a
phone jack on it and the other has an electrical plug. This way, you
can "flash" voltage through the line, but cannot drain it. So, some
modifications have to be done.
Materials
----------
A BEOC (Basic Electrical Output Socket), like a small lamp-type
connection, where you just have a simple plug and wire that would plug
into a light bulb.
One of cords mentioned above, if you can't find one then construct your
own... Same voltage connection, but the restrainor must be built in (I.E.
The central box)
Two phone jacks (one for the modem, one for if you are being traced to
plug the aqua box into)
Some creativity and easy work.
*Notice: No phones have to be destroyed/modified to make this box, so
don't go out and buy a new phone for it!
Procedure
---------
All right, this is a very simple procedure. If you have the BEOC, it could
drain into anything: a radio, or whatever. The purpose of having
that is you are going to suck the voltage out from the phone line into
the electrical appliance so there would be no voltage left to lock
you in with.
1)Take the connection cord. Examine the plug at the end. It should have
only two prongs. If it has three, still, do not fear. Make sure the
electrical appliance is turned off unless you wanna become a crispy critter
while making this thing. Most plugs will have a hard plastic design on the
top of them to prevent you from getting in at the electrical wires inside.
Well, remove it. If you want to keep the plug (I don't see why...)
then just cut the top off. When you look inside, Lo and Behold,
you will see that at the base of the prongs there are a few wires
connecting in. Those wires conduct the power into the appliance.
So, you carefully unwrap those from the sides and pull them out until
they are about an inch ahead of the prongs. If you don't wanna keep the
jack, then just rip the prongs out. If you are, cover the prongs with
insultation tape so they will not connect with the wires when the power
is being drained from the line.
2)Do the same thing with the prongs on the other plug, so you have the
wires evenly connected. Now, wrap the end of the wires around each other.
If you happen to have the other end of the voltage cord hooked into the
phone, stop reading now, you're too fucking stupid to continue. After
you've wrapped the wires around each other, then cover the whole thing with
the plugs with insulating tape. Then, if you built your own control box
or if you bought one, then cram all the wires into it and reclose it.
That box is your ticket out of this.
3)Re-check everything to make sure it's all in place. This is a pretty
flimsy connection, but on later models when you get more experienced at
it then you can solder away at it and form the whole device into one
big box, with some kind of cheap mattel hand-held game inside to be
the power connector. In order to use it, just keep this box handy.
Plug it into the jack if you want, but it will slightly lower the
voltage so it isn't connected. When you plug it in, if you see sparks,
unplug it and restart the whole thing. But if it just seems fine then leave it.
Use
----
Now, so you have the whole thing plugged in and all... Do not use this
unless the situation is desperate! When the trace has gone on, don't
panic, unplug your phone, and turn on the appliance that it was hooked
to. It will need energy to turn itself on, and here's a great source...
The voltage to keep a phone line open is pretty small and a simple light
bulb should drain it all in and probably short the F.B.I. computer at
the same time.
Happy boxing and stay free!
---------------------------------------------------------------------
Black Box Plans by The Jolly Roger
Introduction:
------------
At any given time, the voltage running through your phone is about 20
Volts. When someone calls you, this voltage goes up to 48 Volts and rings
the bell. When you answer, the voltage goes down to about 10 Volts.
The phone company pays attention to this. When the voltage drops to 10,
they start billing the person who called you.
Function:
--------
The Black Box keeps the voltage going through your phone at 36 Volts,
so that it never reaches 10 Volts. The phone company is thus fooled
into thinking you never answered the phone and does not bill the caller.
However, after about a half hour the phone company will get suspicious
and disconnect your line for about 10 seconds.
Materials:
---------
1 1.8K 1/2 Watt Resistor
1 1.5V LED
1 SPST Switch
Procedure:
---------
(1) Open your phone by loosening the two screws on the bottom and
lifting the case off.
(2) There should be three wires: Red, Green, and Yellow. We'll be working
with the Red Wire.
(3) Connect the following in parallel:
A. The Resistor and LED.
B. The SPST Switch.
In other words, you should end up with this:
(Red Wire)
!---/\/\/\--O--!
(Line)-----! !-----(Phone)
!-----_/_------!
/\/\/\ = Resistor
O = LED
_/_ = SPST
Use:
---
The SPST Switch is the On/Off Switch of the Black Box. When the box is off,
your phone behaves normally. When the box is on and your phone rings,
the LED flashes. When you answer, the LED stays on and the voltage
is kept at 36V, so the calling party doesn't get charged. When the box
is on, you will not get a dial tone and thus cannot make calls.
Also remember that calls are limited to half an hour.
------------Jolly Roger
p.s. Due to new Fone Company switching systems & the like, this
may or may not work in your area. If you live in bumfuck Kentucky,
then try this out. I make no guarantees! (I never do...) ----JR
--------------------------------------------
Brown Box Plans by The Jolly Roger
This is a fairly simple mod that can be made to any phone. All it does
is allow you to take any two lines in your house and create a party
line. So far I have not heard of anyone who has any problems
with it. There is one thing that you will notice when you are
one of the two people who is called by a person with a brown box. The other
person will sound a little bit faint. I could overcome this with some
amplifiers but then there wouldn't be very many of these made [Why not?].
I think the convenience of having two people on the line at once will
make up for any minor volume loss.
Here is the diagram:
---------------------------------------
KEY:___________________________________
| PART | SYMBOL |
|---------------------------------|
| BLACK WIRE | * |
| YELLOW WIRE | = |
| RED WIRE | + |
| GREEN WIRE | - |
| SPDT SWITCH | _/_ |
| _/_ |
| VERTICAL WIRE | | |
| HORIZONTAL WIRE | _ |
-----------------------------------
* = - +
* = - +
* = - +
* = - +
* = - +
* ==_/_- +
*******_/_++++++
| |
| |
| |
| |
| |
| |
|_____PHONE____|
--------------------------------------------
The Infamous Blotto Box!!
(I bet that NOONE has the balls to build this one!)
Finally, it is here! What was first conceived as a joke to fool the innocent
phreakers around America has finally been conceived!
Well, for you people who are unenlightened about the Blotto Box,
here is a brief summery of a legend.
--*-=> The Blotto Box <=-*--
For years now every pirate has dreamed of the Blotto Box. It was at first
made as a joke to mock more ignorant people into thinking that
the function of it actually was possible. Well, if you are The Voltage
Master, it is possible. Originally conceived by King Blotto of much fame,
the Blotto Box is finally available to the public.
NOTE: Jolly Roger can not be responsible for the information disclosed
in the file! This file is strictly for informational purposes and
should not be actually built and used! Usage of this electronical impulse
machine could have the severe results listed below and could result in
high federal prosecution! Again, I TAKE NO RESPONSIBILITY!
All right, now that that is cleared up, here is the basis of the box
and it's function.
The Blotto Box is every phreaks dream... you could hold AT&T down on its
knee's with this device. Because, quite simply, it can turn off the phone
lines everywhere. Nothing. Blotto. No calls will be allowed out of an area
code, and no calls will be allowed in. No calls can be made inside it for
that matter. As long as the switching system stays the same, this box will
not stop at a mere area code. It will stop at nothing. The electrical
impulses that emit from this box will open every line. Every line will
ring and ring and ring... the voltage will never be cut off until the
box/generator is stopped. This is no 200 volt job, here.
We are talking GENERATOR. Every phone line will continue to ring, and people
close to the box may be electricuted if they pick up the phone.
But, the Blotto Box can be stopped by merely cutting of the line or generator.
If they are cut off then nothing will emit any longer. It will take
a while for the box to calm back down again, but that is merely a
superficial aftereffect. Once again: Construction and use of this box is
not advised! The Blotto Box will continue as long as there is
electricity to continue with.
OK, that is what it does, now, here are some interesting things for you
to do with it...
-*-=>Blotto Functions/Installin'<=-*-
Once you have installed your Blotto, there is no turning back. The
following are the instructions for construction and use of this box.
Please read and heed all warnings in the above section before you attempt
to construct this box.
Materials:
- A Honda portable generator or a main power outlet like in a
stadium or some such place.
- 400 volt rated coupler that splices a female plug into a
phone line jack.
- A meter of voltage to attach to the box itself.
- A green base (i.e. one of the nice boxes about 3' by 4' that
you see around in your neighborhood. They are the main switch
boards and would be a more effective line to start with.
or: A regular phone jack (not your own, and not in your area
code!
- A soldering iron and much solder.
- A remote control or long wooden pole.
Now. You must have guessed the construction from that. If not, here goes,
I will explain in detail. Take the Honda Portable Generator and all of
the other listed equiptment and go out and hunt for a green base. Make
sure it is one on the ground or hanging at head level from a pole,
not the huge ones at the top of telephone poles. Open it up with anything
convienent, if you are two feeble that fuck don't try this.
Take a look inside... you are hunting for color-coordinating lines of
green and red. Now, take out your radio shack cord and rip the meter thing
off. Replace it with the voltage meter about. A good level to set the
voltage to is about 1000 volts. Now, attach the voltage meter to the cord
and set the limit for one thousand. Plug the other end of the cord
into the generator. Take the phone jack and splice the jack part off.
Open it up and match the red and green wires with
the other red and green wires. NOTE: If you just had the generator on
and have done this in the correct order, you will be a crispy critter.
Keep the generator off until you plan to start it up. Now, solder those
lines together carefully. Wrap duck tape or insultation tape around all
of the wires. Now, place the remote control right on to the startup
of the generator. If you have the long pole, make sure it is very long
and stand back as far away as you can get and reach the pole over.
NOTICE: If you are going right along with this without reading the file
first, you still realize now that your area code is about to become
null! Then, getting back, twitch the pole/remote control and run for your
damn life. Anywhere, just get away from it. It will be generating
so much electricity that if you stand to close you will kill yourself.
The generator will smoke, etc. but will not stop. You are now killing your
area code, because all of that energy is spreading through all of the
phone lines around you in every direction.
Have a nice day!
--*-=>The Blotto Box: Aftermath<=-*--
Well, that is the plans for the most devastating and ultimately deadly
box ever created. My hat goes off to: King Blotto (for the original idea).
--------------------------------------------
Clear Box Plans by The Jolly Roger
The clear box is a new device which has just been invented that can be
used throughout Canada and rural United States. The clear box works on
"PostPay" payphones (fortress fones). Those are the payphones
that don't require payment until after the connection is established.
You pick up the fone, get a dial tone, dial your number, and then
insert your money after the person answers.
If you don't deposit the money then you can not speak to the person on
the other end because your mouth piece is cut off but not the ear-piece.
(obviously these phones are nice for free calls to weather or time or
other such recordings). All you must do is to go to your nearby Radio
Shack, or electronics store, and get a four-transistor amplifier and a
telephone suction cup induction pick-up. The induction pick-up would be
hooked up as it normally would to record a conversation, except
that it would be plugged into the output of the amplifier and a
microphone would be hooked to the input. So when the party
that is being called answers, the caller could speak through the little
microphone instead. His voice then goes through the amplifier and out
the induction coil, and into the back of the receiver where
it would then be broadcast through the phone lines and the other
partywould be able to hear the caller. The Clear Box thus
'clears up' the problem of not being heard. Luckily, the line will
not be cut-off after a certain amount of time because it will wait
forever for the coins to be put in.
The biggest advantage for all of us about this new clear box is the
fact that this type of payphone will most likely become very common.
Due to a few things: 1st, it is a cheap way of getting the DTF,
dial-tone-first service, 2nd, it doesn't require any special equipment,
(for the phone company) This payphone will work on any phone line.
Usually a payphone line is different, but this is a regular phone line
and it is set up so the phone does all the charging, not the company.
-----------------------------------
Red Box Plans by the Jolly Roger
Red boxing is simulating the tones produced by public payphones when you
drop your money in. The tones are beeps of 2200 Hz + 1700 Hz
Nickle = 1 beep for 66 milliseconds.
Dime = 2 beeps, each 66 milliseconds with a 66 millisecond pause between
beeps.
Quarter = 5 beeps, each 33 milliseconds with a 33 millisecond
pause between beeps.
There are two commonly used methods being used by Phreaks to make free calls.
1. An electronic hand-held device that is made from a pair of Wien-bridge
oscillators with the timing controlled by 555 timing chips.
2. A tape recording of the tones produced by a home computer. One of
the best computers to use would be an Atari ST. It is one of the easier
computers to use because the red box tones can be produced in basic with only
about 5 statments.
-----------------------------------
Green Box Plans by the Jolly Roger
Paying the initial rate in order to use a red box (on certain
fortresses) left a sour taste in many red boxers mouths, thus the
green box was invented. The green box generates useful tones such as
COIN COLLECT, COIN RETURN, AND RINGBACK. These are the tones that
ACTS or the TSPS operator would send to the CO when appropriate.
Unfortunately, the green box cannot be used at the fortress station but
must be used by the CALLED party.
Here are the tones:
COIN COLLECT 700+1100hz
COIN RETURN 1100+1700hz
RINGBACK 700+1700hz
Before the called party sends any of these tones, an operator realease
signal should be sent to alert the MF detectors at the CO.
This can be done by sending 900hz + 1500hz or a single 2600 wink (90 ms.)
Also do not forget that the initial rate is collected shortly before the
3 minute period is up. Incidentally, once the above MF
tones for collecting and returning coins reach the CO, they are
converted into an appropriate DC pulse (-130 volts for return and
+130 for collect). This pulse is then sent down the tip to the
fortress. This causes the coin relay to either return or collect the coins.
The alledged "T-network" takes advantage of this information.
When a pulse for coin collect (+130 VDC) is sent down the line,
it must be grounded somewhere. This is usually the yellow or black wire.
Thus, if the wires are exposed, these wires can be cut to prevent
the pulse from being grounded. When the three minute initial
period is almost up, make sure that the black and yellow wires are
severed, then hang up, wait about 15 seconds in case of a second
pulse, reconnect the wires, pick up the phone, and if all goes well,
it should be "JACKPOT" time.
----------------------------------
Scarlet Box Plans by the Jolly Roger
The purpose of a Scarlet box is to create a very bad conection,
it can be used to crash a BBS or just make life miserable for those you
seek to avenge.
Materials: 2 alligator clips, 3 inch wire, or a resister
(plain wire will create greatest amount of static)
(Resister will decrease the amount of static in porportion to
the resister you are using)
Step (1): Find the phone box at your victims house, and pop the cover off.
Step (2): Find the two prongs that the phone line you wish to box are
connected to.
Step (3): Hook your alligator clips to your (wire/resister).
Step (4): Find the lower middle prong and take off all wires connected to
it, i think this disables the ground and call waiting and shit like that.
Step (5): Now take one of the alligator clips and attach it to the upper
most prong, and take the other and attach it to the lower middle prong.
Step (6): Now put the cover back on the box and take off!!
** ######## **
** # #### # **
######## /
# #### # /
######## /
/
/
/
/
/
/
/
**/
**
**
**
**
**
(**)= prongs
**
(/) = (wire/resister)
(##)= some phone bullshit
-------------------------------
Silver Box Plans by the Jolly Roger
Introduction:
------------
First a bit of Phone Trivia. A standard telephone keypad has 12 buttons.
These buttons, when pushed, produce a combination of two tones. These tones
represent the row and column of the button you are pushing.
1 1 1
2 3 4
0 3 7
9 6 7
697 (1) (2) (3)
770 (4) (5) (6)
851 (7) (8) (9)
941 (*) (0) (#)
So (1) produces a tone of 697+1209, (2) produces a tone of 697+1336, etc.
Function:
--------
What the Silver Box does is just creates another column of buttons,
with the new tone of 1633. These buttons are called A, B, C, and D.
Usefulness:
----------
Anyone who knows anything about phreaking should know that in the
old days of phreaking, phreaks used hardware to have fun instead of other
people's Sprint and MCI codes. The most famous (and useful) was the good
ol' Blue Box. However, Ma Bell decided to fight back and now most phone systems
have protections against tone-emitting boxes. This makes boxing just
about futile in most areas of the United States (ie those areas with Crossbar
or Step-By-Step). If you live in or near a good-sized city, then your phone
system is probably up-to-date (ESS) and this box (and most others)
will be useless. However, if you live in the middle of nowhere (no offense
intended), you may find a use for this and other boxes.
Materials:
---------
1 Foot of Blue Wire
1 Foot of Grey Wire
1 Foot of Brown Wire
1 Small SPDT Switch (*)
1 Standard Ma Bell Phone
(*) SPDT = Single Pole/Double Throw
Tools:
-----
1 Soldering Iron
1 Flat-Tip Screwdriver
Procedure:
---------
(1) Loosen the two screws on the bottom of the phone and take the casinf off.
(2) Loosen the screws on the side of the keypad and remove the keypad from
the mounting bracket.
(3) Remove the plastic cover from the keypad.
(4) Turn the keypad so that *0# is facing you. Turn the keypad over. You'll see
a bunch of wires, contacts, two Black Coils, etc.
(5) Look at the Coil on the left. It will have five (5) Solder Contacts
facing you. Solder the Grey Wire to the fourth Contact Pole from the left.
(6) Solder the other end of the Grey Wire to the Left Pole of the SPDT Switch.
(7) Find the Three (3) Gold-Plated Contacts on the bottom edge of the keypad.
On the Left Contact, gently seperate the two touching Connectors (they're
soldered together) and spread them apart.
(8) Solder the Brown Wire to the Contact farthest from you, and solder the
other end to the Right Pole of the SPDT Switch.
(9) Solder the Blue Wire to the Closest Contact, and the other end to the
Center Pole of the SPDT Switch.(10) Put the phone back together.
Using The Silver Box:
--------------------
What you have just done was installed a switch that will change
the 369# column into an ABCD column. For example, to dial a 'B', switch
to Silver Box Tones and hit '6'.
Noone is sure of the A, B, and C uses. However, in an area with an
old phone system, the 'D' button has an interesting effect. Dial Directory
Assistance and hold down 'D'. The phone will ring, and you
should get a pulsing tone. If you get a pissed-off operator, you have a
newer phone system with defenses against Silver Boxes.
At the pulsing tone, dial a 6 or 7. These are loop ends.
----------------------------------
White Box Plans by the Jolly Roger
Introduction:
------------
The White Box is simply a portable Touch-Tone keypad. For more
information on Touch-Tone, see my Silver Box Plans.
Materials:
---------
1 Touch-Tone Keypad
1 Miniature 1000 to 8 Ohm Transformer
(Radio Shack # 273-1380)
1 Standard 8 Ohm Speaker
2 9V Batteries
2 9V Battery Clips
Procedure:
---------
(1) Connect the Red Wire from the Transformer to either terminal on the
Speaker.
(2) Connect the White Wire from the Transformer to the other terminal on
the Speaker.
(3) Connect the Red Wire from one Battery Clip to the Black Wire from the other
Battery Clip.
(4) Connect the Red Wire from the second Battery Clip to the Green Wire
from the Keypad.
(5) Connect the Blue Wire from the Keypad to the Orange/Black Wire from
the Keypad.
(6) Connect the Black Wire from the first Battery Clip to the two above
wires (Blue and Black/Orange).
(7) Connect the Black Wire from the Keypad to the Blue Wire from the
Transformer.
(8) Connect the Red/Green Wire from the Keypad to the Green Wire from the
Transformer.
(9) Make sure the Black Wire from the Transformer and the remaining wires
from the Keypad are free.
(10) Hook up the Batteries.
Optional:
--------
(1) Put it all in a case.
(2) Add a Silver Box to it.
Use:
---
Just use it like a normal keypad, except put the speaker next to the
receiver of the phone you're using.
----------------------------------
The BLAST Box Courtesy of the Jolly Roger
Ever want to really make yourself be heard? Ever talk to someone on the phone
who just doesn't shut up? Or just call the operator and pop her eardrum? Well,
up until recently it has been impossible for you to do these things. That is,
unless of course you've got a blast box. All a blast box is, is a really cheap
amplifier, (around 5 watts or so) connected in place of the microphone on your
telephone. It works best on model 500 AT&T Phones, and if constructed small
enough, can be placed inside the phone.
Construction:
Construction is not really important. Well it is, but since I'm letting you make
your own amp, I really don't have to include this.
Usage:
Once you've built your blast box, simply connect a microphone (or use the
microphone from the phone) to the input of the amplifier, and presto. There it
is. Now, believe it or not, this device actually works. (At least on crossbar.)
It seems that Illinois bell switching systems allow quite alot of current to
pass right through the switching office, and out to whoever you're calling. When
you talk in the phone, it comes out of the other phone (again it works best if
the phone that you're calling has the standard western electric earpiece)
incredibly loud. This device is especially good for PBS Subscription drives.
Have "Phun", and don't get caught!
-------------------------
Cheesebox Plans Courtesy of The Jolly Roger
A Cheesebox (named for the type of box the first one was
found in) is a type of box which will, in effect, make your
telephone a Pay-Phone.....This is a simple,modernized, and easy
way of doing it....
Inside Info:These were first used by bookies many years ago
as a way of making calls to people without being called by the
cops or having their numbers traced and/or tapped......
How To Make A Modern Cheese Box
Ingredients:
------------
1 Call Forwarding service on the line
1 Set of Red Box Tones
The number to your prefix's Intercept operator (do some scanning
for this one)
How To:
-------
After you find the number to the intercept operator in
your prefix, use your call-forwarding and forward all calls to
her...this will make your phone stay off the hook(actually, now
it waits for a quarter to be dropped in)...you now have a cheese
box... In Order To Call Out On This Line:You must use your Red
Box tones and generate the quarter dropping in...then,you can
make phone calls to people...as far as I know, this is fairly
safe, and they do not check much...Although I am not sure, I
think you can even make credit-card calls from a cheesebox
phone and not get traced...
------------------------
Gold Box Plans by The Jolly Roger
HOW TO BUILD IT
_______________
You will need the following:
Two 10K OHM and three 1.4K OHM resistors
Two 2N3904 transistors
Two Photo Cells
Two Red LED'S (The more light produced the better)
A box that will not let light in
Red and Green Wire
Light from the #1 LED must shine directly on the photocell #1. The gold
box I made needed the top of the LED's to touch the photo cell for it to
work.
The same applies to the #2 photo cell and LED.
1
:-PHOTOCELL--:
: :
: :BASE
: 1 TTTTT
: +LED- TRANSISTOR
: TTTTT
: : :
: -I(-- : :COLLECTOR
RED1--< >:--: :-------:-----GREEN2
-I(-- : ----------:
: :
2 :-/+/+/-/+/+/-/+/+/-/+/+/
LED 10K 10K 1.4K 1.4K
RESISTORES
2
-PHOTOCELL-----------------
: :
:BASE :
TTTTT :
TRANSISTOR :
TTTTT :
: :EMITTER :
GREEN1- --------------------------RED2
: :
/+/+/
1.4K
The 1.4K resistor is variable and if the second part of the gold box is
skipped it will still work but when someone picks up the phone they will
hear a faint dial tone in the background and might report it to the
Gestapo er...(AT&T).
1.4K will give you good reception with little risk of a Gestapo agent at
your door.
Now that you have built it take two green wires of the same length and
strip the ends, twist two ends together and connect them to green1 and
place a piece of tape on it with "line #1" writing on it.
Continue the process with red1 only use red wire. Repeat with red2 and
green2 but change to line #2.
HOW TO INSTALL
______________
You will need to find two phone lines that are close together. Label one of
teh phone lines "Line #1". Cut the phone lines and take the outer coating
off it. Tere should be 4 wires. Cut the yellow and black wires off and
strip the red and green wires for both lines.
Line #1 should be in two pieces. Take the green wire of one end and connect
it to one of the green wires on the gold box. Take the other half of line
#1 and hook the free green wire to the green wire on the phone line. Repeat
the process with red1 and the other line.
All you need to do now is to write down the phone numbers of the place you
hooked it up at and go home and call it. You should get a dial tone!!!
If not, try changing the emittor with the collector.
Have a great time with this!
---------------------
The Lunch Box Courtesy of the Jolly Roger
Introduction
===========
The Lunch Box is a VERY simple transmitter which can be handy for all sorts of
things. It is quite small and can easily be put in a number of places. I have
successfully used it for tapping fones, getting inside info, blackmail and
other such things. The possibilities are endless. I will also include the plans
or an equally small receiver for your newly made toy. Use it for just about
anything. You can also make the transmitter and receiver together in one box
and use it as a walkie talkie.
Materials you will need
======================
(1) 9 volt battery with battery clip
(1) 25-mfd, 15 volt electrolytic capacitor
(2) .0047 mfd capacitors
(1) .022 mfd capacitor
(1) 51 pf capacitor
(1) 365 pf variable capacitor
(1) Transistor antenna coil
(1) 2N366 transistor
(1) 2N464 transistor
(1) 100k resistor
(1) 5.6k resistor
(1) 10k resistor
(1) 2meg potentiometer with SPST switch
Some good wire, solder, soldering iron, board to put it on, box (optional)
Schematic for The Lunch Box
===========================
This may get a tad confusing but just print it out and pay attention.
[!]
!
51 pf
!
---+---- ------------base collector
! )( 2N366 +----+------/\/\/----GND
365 pf () emitter !
! )( ! !
+-------- ---+---- ! !
! ! ! ! !
GND / .022mfd ! !
10k\ ! ! !
/ GND +------------------------emitter
! ! ! 2N464
/ .0047 ! base collector
2meg \----+ ! ! +--------+ !
/ ! GND ! ! !
GND ! ! !
+-------------+.0047+--------------------+ ! !
! +--25mfd-----+
-----------------------------------------+ ! !
microphone +--/\/\/-----+
---------------------------------------------+ 100k !
!
GND---->/<---------------------!+!+!+---------------+
switch Battery
from 2meg pot.
Notes about the schematic
=========================
1. GND means ground
2. The GND near the switch and the GND by the 2meg potentiometer should be
connected.
3. Where you see: )(
()
)( it is the transistor antenna coil with 15 turns of
regular hook-up wire around it.
4. The middle of the loop on the left side (the left of "()") you should run
a wire down to the "+" which has nothing attached to it. There is a .0047
capacitor on the correct piece of wire.
5. For the microphone use a magnetic earphone (1k to 2k).
6. Where you see "[!]" is the antenna. Use about 8 feet of wire to broadcast
approx 300ft. Part 15 of the FCC rules and regulation says you can't
broadcast over 300 feet without a license. (Hahaha). Use more wire for an
antenna for longer distances. (Attach it to the black wire on the fone
line for about a 250 foot antenna!)
Operation of the Lunch Box
==========================
This transmitter will send the signals over the AM radio band. You use the
variable capacitor to adjust what freq. you want to use. Find a good unused
freq. down at the lower end of the scale and you're set. Use the 2 meg pot. to
adjust gain. Just fuck with it until you get what sounds good. The switch on
the 2meg is for turning the Lunch Box on and off. When everything is adjusted,
turn on an AM radio adjust it to where you think the signal is. Have a friend
lay some shit thru the Box and tune in to it. That's all there is to it. The
plans for a simple receiver are shown below:
The Lunch Box receiver
======================
(1) 9 volt battery with battery clip
(1) 365 pf variable capacitor
(1) 51 pf capacitor
(1) 1N38B diode
(1) Transistor antenna coil
(1) 2N366 transistor
(1) SPST toggle switch
(1) 1k to 2k magnetic earphone
Schematic for receiver
======================
[!]
!
51 pf
!
+----+----+
! !
) 365 pf
(----+ !
) ! !
+---------+---GND
!
+---*>!----base collector-----
diode 2N366 earphone
emitter +-----
! !
GND !
-
+
- battery
+
GND------>/<------------+
switch
Closing statement
=================
This two devices can be built for under a total of $10.00. Not too bad. Using
these devices in illegal ways is your option. If you get caught, I accept NO
responsibility for your actions. This can be a lot of fun if used correctly.
Hook it up to the red wire on the phone line and it will send the
conversation over the air waves.
Enjoy!
--------------------------------
Olive Box Plans Courtesy of the Jolly Roger
This is a relatively new box, and all it basically does is serve as a phone
ringer. You have two choices for ringers, a piezoelectric transducer (ringer),
or a standard 8 ohm speaker. The speaker has a more pleasant tone to it, but
either will do fine. This circuit can also be used in conjunction with a rust
box to control an external something or other when the phone rings. Just connect
the 8 ohm speaker output to the inputs on the rust box, and control the pot to
tune it to light the light (which can be replaced by a relay for external
controlling) when the phone rings.
______________
| | ^
NC --|-- 5 4 --|-----/\/\/------->G
| | / R2
G<----)|----|-- 6 3 --|-- NC
| C3 | U1 |
-------|-- 7 2 --|---------- --- -- - > TO RINGER
| |
----|-- 8 1 --|--
| |______________| |
| ---/\/\/----|(----- L1
| R1 C1
------------------------------------------ L2
a. Main ringer TTL circuit
(>::::::::::::::::::::::::::::::::::::::::::::::::::::::::<)
_
FROM PIN 2 < - -- --- ----------| |_| |------------->G
P1
b. Peizoelectric transducer
(>::::::::::::::::::::::::::::::::::::::::::::::::::::::::<)
__ /|
FROM PIN 2 < - -- --- ---------|(---------. .-------| |/ |
>||< |S1| |
>||< --| | |
>||< | |__|\ |
G<---------.>||<.--- \|
T1
c. Elctro magnetic transducer
Parts List
----------
U1 - Texas Instruments TCM1506
T1 - 4000:8 ohm audio transfomer
S1 - 8 ohm speaker
R1 - 2.2k resistor
R2 - External variable resistor; adjusts timing frequency
C1 - .47uF capacitor
C2 - .1uF capacitor
C3 - 10uF capacitor
L1 - Tip
L2 - Ring
L1 and L2 are the phone line.
Shift Rate:
-----------
This is the formula for determining the shift rate:
1 1
SR = --------------------- = ------------ = 6.25 Hz
(DSR(1/f1)+DSR(1/f2)) 128 128
---- + ----
1714 1500
DSR = Shift Devider Rate ratio = 128
f1 = High Output Frequency = 1714
f2 = Low Output Frequency = 1500
--------------------------------
The Tron Box Written by The GREAT Captain Crunch!!
Courtesy of the Jolly Roger
------------------R-----F----
I I I I
I I I I-
(C) (C) (C)
I I I I-
I I I I
-----------------------------
(C)=CAPACITOR
F =FUSE
R =RESISTOR
I,- ARE WIRE
PARTS LIST:
(3) ELECTROLYTIC CAPACITORS RATED AT 50V(LOWEST) .47UF
(1) 20-30OHM 1/2 WATT RESISTOR
(1) 120VOLT FUSE (AMP RATING BEST TO USE AT LEAST HALF OF TOTAL
HOUSE CURRENT OR EVEN LESS IT KEEPS YOU FROM BLOWING YOUR
BREAKER JUST IN CASE...)
(1) POWER CORD (CUT UP AN EXTENSTION CORD. NEED PLUG PART AND WIRE)
(1) ELECTRICALLY INSULATED BOX
REST OF SIF YOUR DONT FILL COMFORTABLE ABOUT ELECTRICITY THEN DONT
PLAY WITH THIS THERE IS VOLTAGE PRESENT THAT WILL
***KILL*** YOU......................
THE THING WORKS WHEN THE LOAD IN YOUR HOUSE IS LOW LIKE AT NIGHT TIME. IT
WILL PUT A REVERSE PHASE SIGNAL ON THE LINE AND CANCEL OUT THE OTHER PHASE
AND PUT A REVERSE PHASE RUNNING EVERYTHING IN THE HOUSE. WELL IF YOU HAVE
EVER SWITCHED THE POWER LEADS ON A D.C. (BATTERY POWERED) MOTOR YOU
WILL SEE THAT IT RUNS BACKWARDS WELL YOUR ELECTRIC METER SORT OF WORKS
THIS WAY...SO REVERSE PHASE MAKES THE METER SLOW DOWN AND IF YOUR
LUCKY IT WILL GO BACKWARDS. ANYWAY IT MEANS A CHEAPER ELECTRIC BILL.
-------------------
High Tech Revenge: The Beigebox rev.2 by The Jolly Roger
-------------Introduction-------------
Have you ever wanted a lineman's handset? Surely every phreak has at
least once considered the phun that he could have with one. After searching
unlocked phone company trucks for months, we had an idea. We could build
one. We did, and named it the "Beige Box" simply because that is the color
of ours.
The beigebox is simply a consumer lineman's handset, which is a
phone that can be attached to the outside of a person's house. To
fabricate a beigebox, follow along.
---------Construction and Use---------
The construction is very simple. First you must understand the concept of
the device. In a modular jack, there are four wires. These are red, green,
yellow, and black. For a single line telephone, however, only two matter:
the red (ring) and green (tip). The yellow and the black are not neccessary
for this project. A lineman's handset has two clips on it: the ring and
the tip. Take a modular jack and look at the bottom of it's casing. There
should be a grey jack with four wires (red, green, yellow & black)
leading out of it. To the end of the red wire attach a red aligator clip.
To the end of the green wire attatch a green aligator clip. The yellow
and black wires can be removed, although I would only set them aside so
that you can use the modular jack in future projects. Now insert your
telephone's modular plug into the modular jack. That's it. This particular
model is nice because it is can be easily made, is inexpensive, uses
common parts that are readily available, is small, is lightweight,
and does not require the destruction of a phone.
------------Beige Box Uses------------
There are many uses for a Beige Box. However, before you can use it,
you must know how to attach it to the output device. This device can be
of any of Bell switching apparatus that include germinal sets (i.e.
remote switching centers, bridgin heads, cans, etc.). To open most Bell
Telephone switching apparatus, you must have a 7/16 inch hex driver
(or a good pair of needle nose pliers work also).
This piece of equipment can be picked up at your local hardware store.
With your hex driver (or pliers), turn the security bolt(s) approximately
1/8 of an inch counter-clockwise and open. If your output device is locked,
then you must have some knowledge of destroying and/or picking locks.
However, we have never encountered a locked output device. Once you have
opened your output device, you should see a mass of wires connected to
terminals. On most output devices, the terminals should be labeled "T"
(Tip -- if not labeled, it is usually on the left) and "R" (Ring -- if
not labeled, usually on the right).
Remember: Ring - red - right. The "Three R's" -- a simple way to
remember which is which. Now you must attach all the red alligator clip
(Ring) to the "R" (Ring) terminal.
Attach the green alligator clip (Tip) to the "T" (Tip) terminal.
Note: If instead of a dial tone you hear nothing, adjust the alligator
clips so that they are not touching each other terminals. Also make sure
they are firmly attached. By this time you should hear a dial tone.
Dial ANI to find out the number you are using (you wouldn't want to use
your own). Here are some practicle aplications:
> Eavesdropping
> Long distance, static free free fone calls to phriends
> Dialing direct to Alliance Teleconferencing (also no static)
> Phucking people over
> Bothering the operator at little risk to yourself
> Blue Boxing with greatly reduced chance of getting caught
> Anything at all you want, since you are on an extension of that line.
Eavesdropping
-------------
To be most effective, first attach the Beige Box then your phone. This
eliminates the static caused by connecting the box, therefore
reducing the potential suspicion of your victim. When eavesdropping,
it is allways best to be neither seen nor heard. If you hear someone
dialing out, do not panic; but rather hang up, wait, and pick up the
receiver again. The person will either have hung up or tried to complete
their call again. If the latter is true, then listen in, and perhaps you
will find information worthy of blackmail! If you would like to know who
you are listening to, after dialing ANI, pull a CN/A on the number.
Dialing Long Distance
---------------------
This section is self explanitory, but don't forget to dial a "1" before
the NPA.
Dialing Direct to Aliance Teleconferencing
------------------------------------------
Simply dial 0-700-456-1000 and you will get instructions from there.
I prefer this method over PBX's, since PBX's often have poor reception
and are more dificult to come by.
Phucking People Over
--------------------
This is a very large topic of discussion. Just by using the other topics
described, you can create a large phone bill for the person (they will
not have to pay for it, but it will be a big hassle for them). In addition,
since you are an extension of the person's line, you can leave your
phone off the hook, and they will not be able to make or receive calls.
This can be extremely nasty because no one would expect the cause
of the problem.
Bothering the Operator
----------------------
This is also self explanitary and can provide hours of entertainment.
Simply ask her things that are offensive or you would not like traced
to your line. This also corresponds to the previously described section,
Phucking People Over. After all, guess who's line it gets traced to?
He he he...
Blue Boxing
-----------
See a file on Blue Boxing for more details. This is an especially nice
feature if you live in an ESS-equiped prefix, since the calls are, once
again, not traced to your line...
---POTENTIAL RISKS OF BEIGE BOXING----
Overuse of the Beige Box may cause suspicians within the Gestapo,
and result in legal problems. Therefor, I would recomend you:
> Choose a secluded spot to do your Beige Boxing,
> Use more than one output device
> Keep a low profile (i.e., do not post under your real
name on a public BBS concering your occomplishments)
> In order to make sure the enemy has not been inside your output
device, I recomend you place a piece of transparent tape over
the opening of your output device. Therefor, if it is
opened in your abscence, the tapqe will be displaced and
you will be aware of the fact that someone has intruded
on your teritory.
Now, imagine the possibilities: a $2000 dollar phone bill for
that special person, 976 numbers galore, even harassing the
operator at no risk to you! Think of it as walking into an
enemies house, and using their phone to your heart's content.
-------------------
Pearl Box Plans by the Jolly Roger
The Pearl Box:Definition - This is a box that may substitute for many boxes
which produce tones in hertz. The Pearl Box when operated correctly can
produce tones from 1-9999hz. As you can see, 2600, 1633, 1336 and other
crucial tones are obviously in its sound spectrum.
Materials you will need in order to build The Pearl Box:
========================================================
C1, C2:.5mf or .5uf ceramic disk
capacitors
Q1.....NPN transistor (2N2222 works
best)
S1.....Normally open momentary SPST
switch
S2.....SPST toggle switch
B1.....Standard 9-Volt battery
R1.....Single turn, 50k potentiometer
R2..... " " 100k potentiometer
R3..... " " 500k potentiometer
R4..... " " 1meg potentiometer
SPKR...Standard 8-ohm speaker
T1.....Mini transformer (8-ohm works
best)
Misc...Wire, solder, soldering iron, PC
board or perfboard, box to
contain the completed unit,
battery clip
Instructions for building Pearl Box:
======================================
Since the instruction are EXTREMELY difficult to explain in words, you will
be given a schematic instead. It will be quite difficult to follow but try
it any way.
(Schematic for The Pearl Box)
+---+------------+---------+
! ! \
C1 C2 \
! ! +
+ + -----+T1
!\ +------------+-+
! b c-------! +
! Q1 ! +-S1-
! e-----S2---+ ! SPKR
! ! ! +----
! B1 !
! ! !
! +-------+
!R1 R2 R3 R4!
/\/\ /\/\ /\/\ /\/\
+--+ +--+ +--+
Now that you are probably thoroughly confused, let me explain a few
minor details. The potentiometer area is rigged so that the left pole is
connected to the center pole of the potentiometer next to it.
The middle terminal of T1 is connected to the piece of wire that runs down
to the end of the battery.
Correct operation of The Pearl Box:
===================================
You may want to get some dry-transfer decals at Radio Shack to make this
job a lot easier. Also, some knobs for the tops of the potentiometers
may be useful too. Use the decals to calibrate the knobs. R1 is the knob
for the ones place, R2 is for the tens place, R3 if for the hundreds
place and R4 is for the thousands place. S1 is for producing the all the
tones and S2 is for power.
Step 1: Turn on the power and adjust the knobs for the desired tone.
(Example: For 2600 hz-
R1=0:R2=0:R3=6:R4=2)
Step 2: Hit the pushbutton switch and VIOLA! You have the tone. If
you don't have a tone recheck all connections and schematic.
-------------------
Jolly Roger
