The incredible Help Program for Blue Boxing --------------------------------------------- Presented by Keepermann also known as the "THE VIRUS" You can read downside the using of our little Program NOTE: a Modem link virus in the original program is removed... please check your "libs/icon.library" if the size is 6680 bytes, your library is infected.. What makes this a virus????? your modem connection to bbs's would end up with a lot of noise, and crap on the line(LOOKS LIKE CRAP), more about the virus is available in the original program for programmers! Skid Row -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Better Homes and Blue Boxing Part I Theory of Operation =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- To quote Karu Bluel Marx, blue boxing has always been the most able form of phreaking. As opposed to such things as using an MCI code to make a free fone call, which is merely mindless pseudo-phreaking, blue boxing is actual interaction with the Bell System toll network. It is likewise advisable to be more cautious when blue boxing, but the careful phreak will not be caught, regardless of what type of switching system he is under. In this part, I will explain how and why blue boxing works, as well as where. Ind h later parts, I will give more practical information for blue boxing and routing information. To begin with, blue boxing is simply communicating with trunks. Trunks must not be confused with subscriber lines (or "customer loops") which are standard telefone lines. Trunks are those lines that connect central offices. Now, when trunks are not in use (i.e., idle or "on-hook" state) they have 2600Hz applied to them. If they are two-way trunks, there is 2600Hz in both directions. When a trunk IS in use (busy or "off-hook" state"), the 2600Hz is removed from the side that is off-hook. The 2600Hz is therefore known as a supervisory signal, because it indicates the status of a trunk; on hook (tone) or off-hook (no tone). Note also that 2600Hz denoted SF (single frequency) signalling and is "in-band." This is very important. "In-band" means that is is within the band of frequencies that may be transmitted over normal telefone lines. Other SF signals, such as 3700Hz are used also. However, they cannot be carried over the telefone network normally (they are "out-of- band") and are therefore not able to be taken advantage of as 2600Hz is. Back to trunks. Let's take a hypothetical phone call. You pick up your fone and dial 1+806-258-1234 (your good friend in Armarillo, Texas). For ease, we'll assume that you are on #5 Crossbar switching and not in the 806 area. Your central office (CO) would recognize that 806 is a foreign NPA, so it would route the call to the toll centre that serves you. [For the sake of accuracy here, and for the more experienced readers, note that the CO in question is a class 5 with LAMA that uses out-of-band SF supervisory signalling]. Depending on where you are in the country, the call would leave yq iour toll centre (on more trunks) to another toll centre, or office of higher "rank". Then it would be routed to central office 806-258 eventually and the call would be completed. Illustration: A---CO1-------TC1------TC2----CO2----B A=you CO1=your central office TC1=your toll office. TC2=toll office in Amarillo. CO2=806-258 central office. B=your friend (806-258-1234) In this situation it would be realistic to say that CO2 uses SF in-band (2600Hz) signalling, while all the others use out-of-band signalling (3700Hz). If you don't understand this, don't worry too much. I am pointing this out merely for the eake of accuracy. The point is that while you are connected to 806-258- 1234, all those trunks from YOUR central office (CO1) to the 806-258 central office (CO2) do *NOT* have 2600Hz on them, indicating to the Bell equipment that a call is in progress and the trunks are in use. Now let's say you're tired of talking to your friend in Amarillo (806-258-1234) so you send 2600Hz down the line. This tone travels down the line to your friend's central office (CO2) where it is detected. However, a that CO thinks that the 2600Hz is originating from Bell equipment, indicating to it that you've hung up, and thus the trunks are once again idle (with 2600Hz present on them). But actually, you have not hung up, you have fooled the equipment at your friend's CO into thinking you have. Thus,it disconnects him and resets the equipment to prepare for the next call. All this happens very quickly (300-800ms for step-by-step equipment and 150-400ms for other equipment). When you stop sending 2600Hz (after about a second), the equipment thinks that another call is coming towards it (e.g. it thinks the far end has come "off-hook" since the tone has stopped. It could be thought of as a toggle switch: tone --> on hook, no tone -->off hook. Now that you've stopped sending 2600Hz, several things happen: 1) A trunk is seized. 2) A "wink" is sent to the CALLING end from the CALLED end indicating that the CALLED end (trunk) is not ready to receive digits yet. 3) A register is found and attached to the CALLED end of the trunk within about two seconds (max). 4) A start-dial signal is sent to the CALLING end from the CALLED end indicating that the CALLED end is ready to receive digits. Now, all of this is pretty much transparent to the blue boxer. All he really hears when these four things happen is a . So, seizure of a trunk would go something like this: 1> Send a 2600Hz 2> Terminate 2600Hz after 1-2 secs. 3> [beep][kerchunk] Once this happens, you are connected to a tandem that is ready to obey your every command. The next step is to send signalling information in order to place your call. For this you must simulate the signalling used by operators and automatic toll-dialing equipment for use on trunks. There are mainly two systems, DP and MF. However, DP went out with the dinosaur , so I'll only discuss MF signalling. MF (multi-frequency) signalling is the signalling used by the majority of the inter- and intra-lata network. It is aO also used in international dialing known as the CCITT no.5 system. MF signalling consists of 7 frequen- cies, beginning with 700Hz and separated by 200Hz. A different set of two of the 7 frequencies represent the digits 0 thru 9, plus an additional 5 special keys. The frequencies and uses are as follows: Frequencies (Hz) Domestic Int'l -------------------------------------- 700+900 1 1 700+1100 2 2 900+1100 3 3 700+1300 4 4 900+1300 5 5 1100+1300 6 6 700+1500 7 7 900+1500 8 8 1100+1500 9 9 1300+1500 0 0 700+1700 SM Code 11 900+1700 STp Code 12 1100+1700 KP KP1 1300+1700 ST2p KP2 1500+1700 ST ST The timing of all the MF signals is a nominal 60ms, except for KP, which should have a duration of 100ms. There should also be a 60ms silent period between digits. This is very flexible, however, and most Bell equipment will accept outrageous timings. In addition to the standard uses listed above, MF pulsing also has expanded uses known as "expanded inband signalling" that include such things as coin collect, coin return, ringback, operator attached, and operator released. KP2, code 11, and code 12 and the ST (STart "primes") all have special uses which will be mentioned only briefly here. To complete a call using a blue box, once seizure of a trunk has been accomplished by sending 2600Hz and pausing for the , one must first send a KP. This readies the register for the digits that follow. For a standard domestic call, the KP would be followed by either 7 digits (if the call were in the same NPA as the seized trunk) or 10 digits (if the call were not in the same NPA as the seized trunk). [Exactly like dialing a normal fone call. Following either the KP and 7 or 10 digits, a STart is sent to signify that no more digits follow. Example of a complete call: 1> Dial 1-806-258-1234 2> wait for a call-progress indication (such as ring, busy, recording, etc.) 3> Send 2600Hz for about 1 second. 4> Wait for about 2 seconds while a trunk is seized. 5> Send KP+305+994+9966+ST The call will then connect if every- thing was done properly. Note that if a call to an 806 number were being placed in the same situation, the area code would be omitted and only KP+ seven digits+ST would be sent. Code 11 and code 12 are used in international calling to request certain types of operators. KP2 is used in international calling to route a call other than by way of the normal route, whether for economic or equipment reasons. STp, ST2p, and ST3p (prime, two prime, and three prime) are used in TSPS signalling to indicate calling type of call (such as coin-direct dialed). This has been Part I of Better Homes and Blue Boxing. I hope you enjoyed and learned from it. If you have any questions, comments, threats or insults, please fell free to drop me a line. If you have noticed any errors in this text (yes, it does happen), please let me know and perhaps a correction will be in order. Part II will deal mainly with more advanced principles of blue boxing, as well as routings and operators. Note 1: other highly trunkable areas include: 816,305,813,609,205. I personally have excellent luck boxing off of 609-953-0000. Try that if you have any trouble. Better Homes and Blue Boxing Part II Practical Applications =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= (It is assumed that the reader has read and understood Part i of this series). The essential purpose of blue boxing in the beginning was merely to receive toll services free of charge. Though this can still be done, blue boxing has essentially outlived its usefulness in this area. Modern day "extenders" and long distance services provide a safer and easier way to make free fone calls. However, you can do things with a blue box that just can't be done with any- thing else. For ordinary toll-fraud, a blue box is impractical for the following reasons: 1. Clumsy equipment required (blue box or equivalent) 2. Most boxed calls must be made through an extender. Not for safety reasons, but for reasons I'll explain later. 3. Connections are often sacrificed because considerable distances must be dialed to cross a seizable trunk, in addition to awkward routing. As stated in reason #2, boxed calls are usually made through an extender. This is for billing reasons. If you recall from Part i, 2600Hz is used as a "supervisory" signal. That is, it signals the status of a trunk-- "on-hook" or "off-hook." When you seize a trunk (by briefly sen+ ding 2600Hz), your end (the CALLING end) goes on hook for the duration of the 2600Hz and then goes off-hook once again when the 2600Hz is terminated. The CALLED end recognizes that a call is on the way and attaches a register, which inerprets the diE gits which are to be sent. Now, understand that even though your end has come off-hook (no 2600Hz present), the other end is till on-hook. You may wonder then, why, if the other end (the CALLED end) is still on-hook, there is no 2600Hz coming the other way on the trunk, when there should be. This is correct. 2600Hz *IS* present on the trunk when you seize it and afterwards, but you cannot hear it because of a Band Elimination Filter (BEF) at your central office. Back to the problem. Remember that when you seize a trunk, 2600Hz is indeed coming the other way on the trunk because the CALLED end is still on-hook, but you don't actually hear it because of a filter. However, the Bell equipment knows it's there (they can "hear" it). The presence of the 2600Hz is telling the billing equip- ment that your call has not yet been completed (i.e., the CALLED end is still on-hook). When finally you do connect with your boxed call, the 2600Hz from the called end terminates. This tells the billing equipment that someone picked up the fone at the CALLED end and you should begin to be billed. So you do start to get billed, but for the call to the trunk, NOT the boxed call. Your billing equipment thinks that you've connected with the number you used to seize the trunk. Illustration: 1. You call 1+806-258-2222 (directly) 2. Status of trunks: <---- you -------------------------------> (You) 806-258-2222 No 2600Hz-------> <------------2600Hz When you seize a trunk (before the number you called answers) there is no affect on your billing equipment. It simply thinks that you're still waiting for the call to complete (the CALLED end is still on-hook; it is ringing, busy, going to recorder or intercepts operator. Now, let's say that you've sezied a trunk (806-258-2222) and for example, KP+314+949+1705+ST. The call is routed from the tandem you seized to: 314-949-1705. Illustration: <------------------>O<---------------> (You) 806 314-949 tandem No 2600Hz----------> <----------2600Hz Note that the entire path towards the right (the CALLED end) has no 2600Hz present and is therefore "off- hook." The entire path towards the left (the CALLING end) does have 2600Hz present on it, indicating that the CALLED end has not picked up (or come "off-hook"). When 314-949-1705 answers, "answer supervision" is given and the 2600Hz towards the left (the CALLING end) terminates. This tells your billing ! nequipment, which thinks that you're still waiting to be connected with 806-258-2222, that you've finally connected. Billing then begins to 806-258-2222. Not exactly an auspicious beginning for an aspiring young phone phreak. To avoid this, several actions may be taken. As previously mentioned, one may avoid being charged for the number called to seize a trunk by using an extender (in which case the extender will get billed). In some areas, boxing may be accomplished using an 800 number, generally in the format of 800-858-xxxx (many Amarillo numbers) or 800-NN2-xxxx (special intra-state class in-WATS numbers). However, boxing off of 800 numbers is impossible in many areas. In my area, Denver, I am served by #1A ESS and it is impossible for me to box off of any 800 number. Years ago, in the early days of blue boxing (before my time), phreaks often used directory assistance to box off of because they were "free" long distance calls. However, because of competetive long distance con mpanies, directory assistance surcharges are now $0.50 in many areas. It is additionally advised that directory assistance numbers not be used to box from because of the following: Average DA calls last under 2 minutes. When you box a call, chances are that it will last considerably longer. Thus, the Bell billing equip- ment will make a note of calls to directory assistance that last a long time. A call to a directory assistant lasting for 4 hours and 17 minutes may appear somewhat suspicious. Although the date, time, and length of a DA call do not appear on the bill, it is recorded on AMA tape and will trip a strouble report if it were to last too long. This is how most phreaks were discovered in the old days. Also, sometimes too many calls lasting too long to one 800 number may raise a few eyebrows at the local security office. Assuming you can complete a blue box call, the following are listed routings for various Bell internal operators. These are in the format of KP+NPA+ special routing+1X1+ST, which I will explain later. The 1X1 is the actual operator routing, and NPA and NPA+ special routing are used for out-of- area code calls and out-of-area code calls requiring special routing, respectively. KP+101+ST ...... a toll test board KP+121+ST ...... inward op KP+131+ST ...... directory assistance KP+141+ST ...... was rate & route. Now only works in 312, 815, 717, and a few others. It has been replaced with a univer- sal rate & route number, 800+141+1212. KP+151+ST ...... overseas completion operator (inbound). Works only in certain NPAs, such as 303. KP+181+ST ...... in some areas, toll station for small towns Thus, if you seize a trunk 806 NPA and wanted an inward (in 806), then you would dial KP+121+ST. If you wanted a 312 inward and were dialing on an 806 trunk, an area code would be required. Thus, you would dial KP+312+121+ST. Finally, some places in the network require special routing, in addition to an area code. An example is Franklin Park, Ill. It requires a special routing of 032. For this, you would dial KP+312+032+121+ST for a Franklin Park inward operator. Special routings are in the format of 0XX. They are used primarily for load balance, so that traffic flow may be evenly distributed. About half of the exchanges in the network require special routing. Note that special routings are NEVER EVER EVER used to dial normal telephone numbers, only operators. Operator fu