DnA 4-9: CCITT Phreaking
British Phreaking in 1993
In Britain we cant really phreak, we used to be able to on the old analogue exchange but now in the era of the digital networks our tones no longer bring us the much needed free calls.
Recently though we have learned how to box to different countries, using various tones, the main one is America.
This is how a phreak from Britain would call back into Britain
He would first call a toll free operator to a country that uses the MCI satelite using the DTMF (dual-tone multi-frequency) tones, then he would wait until he heard a slight change in the background noise and fire 2 tones made of two different frequencies, normally 2400hz and 2600hz tones mixed together and played for 150ms and then 2400hz and another 2400hz tone played for 100ms. He would now be in control of the line now he would call his PBX in the US, he would dial, using CCITT-5 this time, KP2-10-xxx-xxx-xxxx-ST. KP2 is Key Pulse 2 and is used for International calls, the 10 is for USA you can try other numbers but it wont get you very far, the xxx's are the number you are dialing including area code and ST is to start the connection although it isn't really required these days its better to use it "just in case" you would now be connected to the number you wanted, unless it was engaged or it was faulty. To dial back into Britain he would call his PBX and when the number was connected he would switch back into DTMF mode and dial his barrier code and the number he wanted in the Uk. So as example :
+------+---------------+----------------------------------------+
| Type | Number/Tones | Action |
+------+---------------+----------------------------------------+
| DTMF | 0800-890-1234 | Dials toll-free operator |
| | | Pause 3 Seconds |
| | 2400/2600 | Break Tone |
| | 2400/2400 | Seize Tone |
| | KP2-10 | International call to America |
|CCITT5| 818-123-4567 | Number of the PBX in America |
| | ST | Start connection |
| | | It would dial and give the dialtone |
| DTMF | 1234 | Barrier Code |
| | 9 011 44 | External line/International call to UK |
| | 081-123-4567 | The number in the UK you want to call |
+------+---------------+----------------------------------------+The way I do it is to log onto my COMMS program (ProComm Plus) and type in "ATX3D" which means go on-line and wait for the other modem to connect. I don't press enter, and I shell to DOS (ALT-F4) and run a BATCH file called DIAL.BAT
(DIAL.BAT)
(CD\BLUEBEEP)
(BLUEBEEP /A)
(CD\PCPLUS)
(EXIT)This loads up BlueBEEP, my box program for the SoundBlaster. I go to the top of the action mode list of numbers and choose a random 0800 toll free number. I pick up my phone which is connected along with the modem to an extention cable, the phone has a in-ear-phone stuck on the mouthpiece. I dial the 0800 using BlueBEEP (I never use the keypad on the phone) and wait for the change in background noise, I seize the line with the [+] key and go to a BBS number and press ENTER, it dials for me the number including all the KP2 and ST stuff, if the dial was ok it will ring and I quickly press F10 to exit from BlueBEEP (that finishes my BAT file that drops me back in ProComm +) and I hit ENTER, the modem goes on-line and everything is Ok. I nearly always get a 14.4k line (99.9%) and no line noise, I also get a good CPS rate of about 1550/1600cps in ZMODEM.
I hope this text helps you budding phreakers in Britain !
-/- Z-N0TE -\-
-/- OTAKU SC0TLAND -\-
-\- MiDNiTE LEGi0N -/-
-/- DnA -\-
-\- NuP -/-
