ࡱ>    !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~Root Entry FӾfWordDocument CompObj^ree phonecalls is breaking the LAW. The law is in this case the 'Wireless and Telegraphy Act 1949'. Amen. 2. Now for the proper advice. Don't try any of this stuff in the lovely be BT foneboxes. They have self running diagnostic tests that fone home if anythings wrong. The BT peeps would be there in a jiffy. What you want is a nice comfy backstreet cacky old fonecard fone, that you can spend a couple of hours in with your coupler and your laptop, foning all your mates. 3. Don't try sommit, then go home, then make sommit, then try it, then go home, then make sommit, then try it, then go home. What you wanna do is make about 10 different fone cards, bring them along and have a party. If anyone comes along, just talk into the fone :) 4. NEVER phreak from your own fone line or house. 5. Try not to mess with small companies, they are the ones that provide choices. Instead fuck up and rip off Bell Atlantic/Pacific/etc., AT&T, MCI, ESPECIALLY Sprint (their commercials piss me off...), and other huge monopolies. 6. Don't be afraid to use big weapons. Hell, if you set off a Blotto Box at 3 am, in a desserted alley, and you are and were wearing gloves during the purchase, set up, and operation of it, and then you run (or drive) away like hell, chances are no one will ever know it was you!!! Imagine how much fun that would be... 7. Don't have more than 4-5 people in your phreaking/hacking group. Be an individual. It also makes you that much harder to catch. 8. You know, hacking can greatly bring up your chances of phreaking good. Learn at least basic hacking skills, or have at least one hacker in your group. 9. There is nothing you can't do if you put your mind (blue box) to it. Keep on trying, don't let a security system stop you. 10. Never discuss your plans over your own fone lines. If possible, use loop lines from fortreses (public payfones). 11. Try not to phreak from the same fortres. The feds have been know to stake out fones for years if they find something wrong with it... 12. BE CREATIVE!!!!!!!!! THE PHONE PHREAK'S TEN COMMANDMENTS <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> I. BOX THOU NOT OVER THINE HOME TELEPHONE WIRES, FOR THOSE WHO DOEST MUST SURELY BRING THE WRATH OF THE CHIEF SPECIAL AGENT DOWN UPON THY HEADS. II. SPEAKEST THOU NOT OF IMPORTANT MATTERS OVER THINE HOME TELEPHONE WIRES, FOR TO DO SO IS TO RISK THINE RIGHT OF FREEDOM. III. USE NOT THINE OWN NAME WHEN SPEAKING TO OTHER PHREAKS, FOR THAT EVERY THIRD PHREAK IS AN FBI AGENT IS WELL KNOWN. IV. LET NOT OVERLY MANY PEOPLE KNOW THAT THY BE A PHREAK, AS TO DO SO IS TO USE THINE OWN SELF AS A SACRIFICIAL LAMB. V. IF THOU BE IN SCHOOL, STRIVE TO GET THIN SELF GOOD GRADES, FOR THE AUTHORITIES WELL KNOW THAT SCHOLARS NEVER BREAK THE LAW. VI. IF THOU WORKEST, TRY TO BE A EMPLOYEE, AND IMPRESSEST THINE BOSS WITH THINE ENTHUSIASM, FOR IMPORTANT EMPLOYEES ARE OFTEN SAVED BY THEIR OWN BOSSES. VII. STOREST THOU NOT THINE STOLEN GOODS IN THINE OWN HOME, FOR THOSE WHO DO ARE SURELY NON-BELIEVERS IN THE BELL SYSTEM SECURITY FORCES, AND ARE NOT LONG FOR THIS WORLD. VIII. ATTRACTEST THOU NOT THE ATTENTION OF THE AUTHORITIES, AS THE LESS NOTICEABLE THOU ART, THE BETTER. IX. MAKEST SURE THINE FRIENDS ARE INSTANT AMNESIACS AND WILL NOT REMEMBER THAT THOU HAVE CALLED ILLEGALLY, FOR THEIR COOPERATION WITH THE AUTHORITIES WILL SURELY LESSEN THINE TIME FOR FREEDOM ON THIS EARTH. X. SUPPORTEST THOU TAP, AS IT IS THINE NEWSLETTER, AND WITHOUT IT, THY WORK WILL BE FAR MORE LIMITED. ______________________________________________________________________________________ CHAPTER TWO FREE CALLS FROM A PHONE BOX ______________________________________________________________________________________ With those Rules Phreakin will be enjoyable and Fun.Right with that out of the way lets get on with the phun stuff where the shite hits the fan. Forgin Cards This is won for those old BT fone cards with the whitestrip on them.(know what i meanܥe#  XdMa,l,l  a(T3a MS Sans Serif Symbol0Courier NewTimes New RomanTimes New Roman------------------------------------------------------------------------ .............THE SHITEHOUSE PRODUCTIONS ................................ .................PRESENT TO YOU......................................... ...................UK PHONE PHREAKING. Version 1.1...................... .......................BY...ISP POLICE.................................. ------------------------------------------------------------------------ CONTENTS Chapter 1.1-Introduction 1.2-Phreking rules and safty tips 1.3-Phreakers 10 commandments Free calls from a fonebox 2.1-Making BT fone card 2.2-Getting free BT fone cards 2.3-Punching the phone 2.4-The wreakless way 2.5-Cocot Phones F.A.Q. 3.1-What are these noises i,m hearing? 3.2-Blue boxing and how does it works? 3.3-What VMB and how can (ab)use it? 3.4-How does pulse dialling work? 3.5-What is blind dialling? 3.6-What are DTMF and CCITT5 Hacking 4.1-Listening to conversations 4.2-Ansafone hacking 4.3-Norstar fone hacking How a phone works 5.1-The Phone Line 5.2-Speech network 5.3-Dial 5.4-The Ringer 5.5-The Conclusion About Pagers 6.1-Introduction 6.2-Page Reciever 6.3-Services History of British Phreaking 7.1-The History of it all Boxing 8.1-Beige Box 8.2-Blast Box 8.3-Blue Box 8.4-Brown Box 8.5-Bud Box 8.6-Crimson Box 8.7-Pearl Box 8.8-Red Box 8.9-Scarlet Box 8.10-Cheesebox 8.11-Charging Box 8.12-Rock Box Phone Number 9.1-Introduction to wardialling 9.2-Useful Phone Numbers 9.3-0800-000 numbers 9.4-0800-242 numbers 9.5-0800-412 numbers 9.6-International Codes 9.7-National Codes 9.8-Cost of Calls in UK Phreakers Mini Encyclopedia 10.1-Phreakers Mini Encyclopedia Other Stuff 11.1-Info on BT 11.2-Phreakin websites 11.3-Credits 11.4-About the author (me) 11.5-Special Word ______________________________________________________________________________________ CHAPTER 1 INTRODUCTION AND DO,S AND DON,TS [ Introduction ] Hi it,s the ISP POLICE tellin u internet junkies how to get phree fone calls from BT, not exactly hard. But before we get started let me tell what the hell phreaking is all about:- It all started earlier than you lot think, it was in the 60,s when it started and the blue box was introduced.(If you wanna see the full history of this go to the History of British Phreakin section of this book or file or u wanna cal it.Phreaking is for anyone who,s intrested in fones or pissing off BT, or u have an expensive fone bill. Through out the years many different technics of phreaking has and many have gone as Phone companies tighten the security on there boxs, but it still possible. There has many well known phreakers and some of them have been charged our even sentenced to prison for freaking, and as the saying goes a Good Phreaker is known Phreaker.There have been many different Phreaking Manuals before but they are outdated and one of them was done in 1987 with massive annoying gaps in it and all it goes waffling on about is the techincal side of fones and all that. Also when lookin up phreaking on the alot i stress alot of the text files are out of date, but rest assure this one will be up dated ever so often. I would like to apoligies that i hav,nt tried any of the boxes and don,t be surprised if they don,t work. If u do make one and it successful or not successful tell so i know weather to keep that certain box on there or not. Also Blueboxing still does work but it is hard so keep trying. When phreaking remember the easist way is the best way. You may also notice i have copy it word for word from some other text files, thats because it saves me time and i,m a lazy bastard. The Rules to Safe and Fun Phreaking!!! 1. All this crap is totally ILLEGAL. Anybody attempting or accomplishing f geezer??) They know longer make them, but their one or two (OK well more than one or two) boxes in the country. These except money old bt phone cards the new phone cards and credit card. If u live in Ipswich in England there is one of these boxes opposite the Odean, by the bus stop. I would like to point out check that there is one of these fone boxes near u to do this. Stuff u need: Old fone kard or piece of card Old video tape (preferably with a video of The Waltons:) Glue LEAD Pencil The chances are u won,t be able to have one of those really old BT fone cards, but u can easily buy one off on of those really sad people that collect fone cards for the picture on the front. I used my old charge card for this.This one everyone knew even BT knew but did nothin for many years. Get your card and look at it (go to the next bit if u are blind) & u will see a magnetic strip this is where all data is held about the card, well all the data is just how many units there is. Now what we need to do is to make some magnetic strip like the one on the fone card. Unfortunately I don't know how to write information properly, so instead I went for the totally opposite approach, give the fone reverse magnetism! So all u have to do is stick your tape on the card and make sure it,s nice and smooth (like me) and cut off the ends hangin from the card. Then get your lead pencil, or u are even sader u can use colouring pencils on it and draw and spend days on drawing a pic on the card, it makes up for havin no friends. Once u have done that u are now ready to use it. Make sure that the magnetic thingy isn,t lumpy or the fone will go a suspious and will spit it out at u and u will have to go back to square numero uno (number one just in case u did,nt know) It is now possible to Forge the new BT fone cards. I have got a winzip file on it. I did,nt put on this page as it,s very complicated and it,s a massive file. But don,t fear as u will be able to get it from my webpage GETTING FREE BT PHONE CARDS Go to a phone box and ring internatioal number, anyone will do but don,t make it up.This is so the Bt guy can check if u have been ringin that number and that u r not tellin porkys. Then ring the operator and say "Hay u stupid cow i have tried ringin a friend (which i don,t have) in the states whos on vaction there and and the phone has eaten my 2 (u can changed at how much u put but don,t say something like i put 30 in it). The very nice operator will say sorry for BT,s shit service and will give u some free BT phones cards. I suppose it makes up for BT being so mean. But the little thing is u have to wait for ages to get it through the post but u do get it PUNCHING THE FONE This way does,nt require any chainsaws bombs etc, it requires a nuclear bomb!! No NO just kiddin ignore the nuclear bomb bit. This is one that u can,t really blam BT for. This one is pritty simple and easy. METHOD :- 1 - Lift the mouthpiece from the phone and hold it. 2 - Insert a 20p or 10p coin into the coin slot. 3 - Wait until the credits are displayed and do the following ; PAYPHONE DIAGRAM :- ******************* * * * *** ........ * * * * : ==== : * * * * :......: * * * * ........ * * * * :[][][]: * * * * :[][][]: * * * * :[][][]: * * * * :[][][]: * * * * : : * * *** : <-------- HIT PAYPHONE HERE !!! * :......: * * ........ * * : COIN : * * :RETURN: * * * ******************* This requires alot of practise and patients, and it won,t always work but keep trying and trying u have nothin to lose (well maybe your 10p). If want to be really helpful u could put a sign saying hit here or carve it in to the fone. ---===[ The Wreckless Way ]===--- Now this way does require quite a bit of vadlism but it works damn well. So it best to try it in some backstreet You will need a: screwdriver Pair of Pliers Look at the phone and u will see the keypad, and beneath it u will see the coin resoir where your money comes back. The coin resoir is really a mistake just like everything with BT it won,t give your money back. Now get the screwdriver and ram it at the bottom of where it,s says coin return and lodge it out of place. It should look like the diagram below ____________ ______ (Fig-A) || (Fig-B) | | |*| COIN |*| | < coin return ||RETURN|| |----| slot ||______|| <----coin return door | | /^\ | | | | o\ screwdriver put in here |_____ \ =====(ooo) screwdriver Now get the pliers and hold of the thingy that says coin return pull it out with all your might and strength. Once out put your money into the fone. Now put your hand up the coin return thing and u should feel the ledge and your money, and take your money out and do it again, and u will have free unlimated fones calls and can go and dial up all those sex lines which u could,nt afford. The fone will except a maximum of 1.60 so wait for the credits to go down then put your money in again. Once u have done what u want to put it back on so it does,nt look suspious and can easily take it off when u next come back to the fone. That needs a lot of force, nerve and stupidity, this won,t work on the new boxes which except fone card and cash & cocot phones. COCOT PHONES Cocot phones are the phones u in hotels, resturants, swimming pools(no u fool not under the water next to the office), they are not the standard BT payfones and they are normally creme with a brown cord. The people who own the phone make a nice little profit from when everytime u use the phone (except if u dial 0800 numbers) this means u have to pay more for less. Good isn,t it?? Cocots also offer u bad service and quality and they don,t except in comming fone calls. Even better u pay more for worse. It is very easy to do a free phone call form these phones. Pick up the reciever and dial some 0800 number any one will do. When the person answers it all u have to do is say nothing Yep it,s that simple nothing. Then wait for him to hang up and u should hear the dialling tone, now quickly dial the number u want to dial and u should get through and pay nothing. There are many text files saying different ways of doing this, but the chances are they would,nt work, if u follow the ones above u will have the best chance. ______________________________________________________________________________________ CHAPTER THREE FAQ,s or also known as FREQUENTLY ASKED QUESTIONS ------------------------------------------------------------------------------------------------ WHAT ARE THOSE STRANGE NOISIES I,M HEARING ON THE PHONE?? Music/Voices: This is either a crossed line (Telcos fault) or you're using a portable phone and you're picking up a radio station. Cracks: A click or cracking noise. Can sometimes interfere with speech, or can just be irratating. Telcos fault. Whistles: Whistling, buzzes or anything like that. Doesn't normally interfere with speech. Telcos fault. Echoing: When you hear your own or the other parties voice a short time after you originally said/heard it Very annoying and off putting. Telcos fault. Clipping: When you're call is routed through a satellite, and you are not speaking, the line is used for someone else's voice. This saves money for the Telco. When you start speaking again, the exchange finds any empty line and your voice is sent. This takes a short amount of time, and so the start of each sentence is list (normally the first syllable). This also happens when someone answers their cellular phone, and they say 'Hello' twice. Telcos fault, and there's not much anyone can do. Hissing: Hissing is what you hear when someone is not speaking. When no sound is being transmitted, you hear the sound of the line. In most cases, when the person speaks again, the hissing disappears. Delays: When calling internationally, delays are likely. This means that takes a noticeable amount of time for your voice to reach the other person, and vice versa. Noticeable if you are blue-boxing Can be off-putting. Delays of more than 2 seconds can cause you to interrupt each other, which was a common problem when we used to blue-box through China. What is a Blue Box and how does it work? A blue box is a small device which the 2600hz tone to access the trunks used in long distance and international calls. They were first used in the 1960s when Bell published information on how their long distance trunks worked. Using a blue box is quite simple. First you call a phone number, normally an 0800 89* *** one as these terminate outside of Britain. These phone numbers use trunks in different countries. From there you send 2600hz which fools the trunk into thinking that you have hung up.Straight after you send a mixture of 2600hz and 2400hz, after which you will hear a [beep, kerchink] sound from the earpiece (this is known as a wink). After this you can then tell the trunk where you want to call. The trunk is expecting your local exchange to handle the billing, of which there is none as you are calling through an 0800 number To dial a number, you use the CCITT 5 tones, and send KP + Country Code + Area Code + Number + ST. This translates as Key Pulse, the phone number you wish to call, then STart, which tells the trunk that no more digits are to come. When the other end picks up, you and them will both hear the beep you hear when you send or receive a normal international phone call. There may be some delay as you are calling internationally. When we used to dial through China a while back there was a two second delay, which is quite spooky when you are talking. Unfortunately, many countries don't let you manage to access their trunks as they have been trying to stop blue boxers. But, some countries can still be boxed through, just scan some 0800 89* *** numbers. I saw this article on the net. U can easily make it, even though it might not be that greatly useful. What is VMB and how can I (ab)use it? A VMB is a Voice Mail Box. These are basically a way for people in a company to keep in touch. The one I have used most is Meridian Mail on a mail system for British Telecom Engineers and Linesmen. Basically, you call the number of the system, and a voice will ask you for your mail box number. On Meridian Mail these are 6 digits long, and then a passcode, anything from 4 to 12 digits. After ten wrong passcode guesses in a row the box would be locked out, and only the system manager can re-enable them. When new boxes were created, they, by default, have a passcode which is the same as the box number. A way to break into the system is find unused boxes, or guess someone's predictable passcode. Once into the mail box, you hear messages that have been sent to that mailbox, and you can change some options and send messages to other people on the system. Sometimes in some mailboxes there is the option to dial out to any phone number you wish. On the VMB system I use, the special mail boxes which were allowed to do this were called the ' 06' boxes as that was the beginning of the number of the boxes. Unfortunately these boxes were locked out fairly soon as the system manager found they were being used by outsiders. If you find a VMB system and you get in, help is normally available, so give out-dialling a try. The Meridian Mail system I use is on 0800 318 716, so give it a try. How does pulse dialling work? Pulse dialling works by disconnecting and re-connecting the phone for a very short period of time. For the '1' digit, only one disconnection is signalled '2' for two and so on, up to '0' which uses ten. These disconnections are for less than a second, otherwise the phone is hung up! You can pulse dial on a phone which has a locked or damaged key pad, by tapping the phone hook very quickly, once for each digit. This way you can dial a phone number without having to use the key pad. What is blind dialling? As far as I know, blind dialling can mean one of three things. 1) Using the option on some payphones which speaks the number you have pressed. So when you press '5' you hear 'five' through the ear-piece. 2) Randomly dialling phone numbers, similar to scanning. Used in conjunction with 0800 numbers to find something interesting. 3) With a modem, blind dialling ignores the dial-tone, ring-tone and engaged-tone. Useful for calling countries which have strange dialling and ringing tones. What are DTMF and CCIT 5? DTMF tones are the tones that your hear on your normal touch-tone phone. They are made up of two tones, played at the same time. DTMF tones are much easier to use for dialling than pulse. A small program in C can used to generate the tones through your sound card, or you can use BlueBeep, by Onkel Dittymeyer, a brilliant phone program. Or, in the States, they use a radio shack pocket dialler, which also doubles as a silver box and a red box, with a few modifications. CCITT 5 tones are THE tones you want. They are used for signalling on long distance and international trunk lines. Many years back, (1968 I believe) Bell released a small leaflet called 'Signalling systems for control of telephone switching'. This was planned to go only to Bell employees, but they forgot that many colleges and universities were on their mailing list. This leaflet described how the CCITT 5 signalling system worked, and routing for long distance calls. So many young students found out how to blue box, and within a few hours of the leaflet being read, some students had simple blue boxes ready! What are some noticable things about British Payphones? Here are just a few facts you might find useful. After you have finished a call to someone, and they hang up, but you don't, you stay connected. If you don't hang up and they pick up the phone later, you can talk to each other, but of course you are still being billed all the while. This can be useful when you are changing phones in your house, as you can put one down and switch to another. Also, if you want to annoy someone, you could make a free call to them and not hang up, so they'd have to call BT from somewhere to get the call disconnected. I was pondering the idea of making a reverse charges call to someone, getting them to accept the charges and then never hanging up (from a payphone of course) and I wonder if they would charged a lot of money. Remember that reverse charging incurs a sur- charge and costs more per second than a normal call. If you are trying to get through to someone and you think they have taken the phone off the hook, you can actually get through. If you phone the operator and say I need to speak to Jim Smith at Derby 123456, and that you think the phone may be off the hook, the operator can check. Then she will say that she can send a tone down, so that Jim will hear it and hopefully pick up the phone. When this happened to me (I had knocked the phone off the hook) the operator came on after I heard the tone, and told me that a call was waiting. I then hung up, and a few seconds later my friend rang. I hope you find this useful, as I have sometimes. Also, it highlights the possibility of BT having phone tapping capabilities. U football fans may have noticed i mention Derbys manager ______________________________________________________________________________________ CHAPTER FOUR HACKING ______________________________________________________________________________________ Listening to Conversations I know of three methods of doing this i much prefer the third one: 1) On many new payphones, there is a facility for deaf/impaired hearing people to pick up the phone call with their hearing aid. The switch on the hearing aid is placed into the 'T' position, and then the hearing aid picks up what the other party is saying by radio waves. This eliminates all background noise for the person, which is a great help. You can spot these phone, as they have the deaf symbol on them (An ear with a line though it). These means that all phone conversations are transmitted from these phones into the air. All you have to do is wear a hearing aid and stand next to the phone, or use a radio receiver. The distance the speech is broadcast is not amazing, but you can normally stand on the phone next to the one in question with your receiver and listen in. 2) you could open the earpiece on a phone handset (remember that both sides of the conversation are relayed through the earpiece), and place a small RF transmitter inside. If you know a little about radio comms and electronics you'll know how easy this is. Could be useful for getting Credit Card numbers with a business or any info you want. 3) This one does work as i have tried it. U need a mobile phone, TV with sattelite preferably. Get the mobile phone and turn it on and off until the dial tone goes and u hear crackling and stuff. Bring the phone over to the TV. Now go to some empty channel and change the tuning of the channel, if u do while listening to the phone u will notice the sounds and crackling on phone changing. Keep doing this until u here a conversation. U can save the frequancy of the channel and call it "TALK TV". Its better to do it with sattelite because it has much frequancies. Ansafone hacking Another feature of the fone is the fact it can also be switched on remotely. After 20 rings the fone will be answered by the machine, regardless of whether it is switched on. It is worth remembering that some payfones do not allow an unanswered call to be connected that long. Also note it stops recording after a few seconds silence. Just a word on the 'security code'. It is a two digit number, so there are 10x10 combinations. BT isn't so daft as to put the same codes on each fone, or even make the machine kick you out if the first digit is entered incorrectly. Perseverance is the key, or a sneaky look at the code. There is an audible record of your intrusion - namely about half a second of the first security digit (if ou entered it correctly), but you ca Answerphone Hacking Not really phreaking, but fone related nevertheless. Again they can be found out of hours on many 0800/0500 numbers. All they are useful for are eavsdropping on messages. They come in two flavours digital and tape. A digital ansafone will generally allow you to interfere with the recorded message by hitting '#' or '*'. From here you can rewind or resume the message. These do offer the most functions, but tape ones are probably more easily hacked. They generally have one, two, three or four digit passcodes for remote message playback and simple finger hacking will get you through. Knowing what machine is at the other end is an advantage. You need to learn a few machines timings and default messages before you can do this. Some batches of machines have default passcodes (note this does not apply to BT ResponseXXX ansafones) and the easyiest way to learn lots of machines is to fone up manufacturers and claim to have bought the machine second hand, but the manual was misplaced - so could you have a copy? After playing back messages you can generally delete them, repeat them - digital ansafones offer more options. Here are the instructions for a Response 100 machine (tape) : Basically to access the R100 remotely you need a fone with TouchTone (tm) Telephone signalling or a DTMF pad, or failing that a new fone. The easiest way to (ab)use this machine is to get a peek at the 'security code'. The code is hidden under the lid of the machine covering the microcassette, and with this 2 digit knowledge you can command the fone remotely. To access messages on a machine you simply dial the telephone number. The time it takes to answer the fone indicates how many messages have been taken. If the fone answers after two rings messages have been taken. If it answers after four rings no messages have been taken. After the announcement, instead of leaving a message you need to enter the first digit of the security code (press and hold for at least three seconds). You should hear a single beep. Enter the second digit of the security code in the same manner and you should hear two beeps if the code is correct, four beeps if the code is wrong. You only get two attempts to try the code. If the code is entered correctly then the RESPONSE 100 gives a series of beeps whilst the tape rewinds. If no messages have been recorded then 4 beeps are given and the machine hangs up, otherwise messages are played automatically. Message replay stops every 2.5 minutes and you must press the 2 key for at least three seconds from your remote location in order to hear the remaining message. At the end of the messages you will hear three bleeps. You have three options: Press '2' to replay the messages again Press '6' to reset the messages (ie delete them) Hang up - this saves the messages and sets the machine to set calls. *BUT* you must remember to enter commands within 8 seconds of being prompted. n happily listen in on messages undetected - providing the owner is out. Just so you don't get caught on a 1471 trick, please remember to dial 141 before placing your call or use a fonebox. When entering the code i have had the most luck with these numbers:-"12", "34", "56", etc., and also "23", "45", "67", etc. One i found was 0800 890 150 call after bussiness hours and when u get the answer machine press 12 and u are there Norstar PBX's The following are the default codes for the Norstar PABX provided by BT. They are becoming more and more popular around the country and are popping up all over the place. (try new dept. stores, GAP have just bought a whole load for some of their stores and ODEON cinema's [the newer ones] all run on them) - an easy way to spot the fones that run on Norstar's net is that they have a nice big speaker along the top and have a little LCD screen which displays instructions and at the bottom of the 1-9 dial pad there is a volume bar. The four models in the family are the M7324, M7310, M7208, M7100 but the latter can't be programmed. hunt them out and enjoy. To enter the config set-up do the following; 1. press the key on the fone 2. key in **266344 3. prompted for password, key in **266344 4. you are then prompted through different settings using the little screen, these are; Line data, Line Access, Call Handling, Change Extensions. To enter the admin features, key in; 1. the key 2. **23646 3. prompted for password, key in **23646 4. this feeds you through all sorts of admin features, speed dialling, removing restrictions, permissions, clearing lines, call barring, overriding, changing passwords. You would be surprised how many offices, stores and business are now operating on Norstar's network, again if you want any specific information regarding these, feel free to get in contact with me or call the Norstar help line on 0800 378 822. ______________________________________________________________________________________ | CHAPTER FIVE | | HOW A PHONE WORKS | ____________|_____________________|____________________________________________________ Everybody has one, but what makes it work? Although telephones and telephone company practices may vary dramatically from one locality to another, the basic principles underlying the way they work remain unchanged. Every telephone consists of three separate subassemblies, each capable of independent operation. These assemblies are the speech network, the dialing mechanism, and the ringer or bell. Together, these parts - as well as any additional devices such as modems, dialers, and answering machines - are attached to the phone line. The phone line A telephone is usually connected to the telephone exchange by about three miles (4.83 km) of a twisted pair of No.22 (AWG) or 0.5 mm copper wires, known by your phone company as "the loop". Although copper is a good conductor, it does have resistance. The resistance of No.22 AWG wire is 16.46 Ohms per thousand feet at 77 degrees F (25 degrees C). In the United States, wire resistance is measured in Ohms per thousand feet; telephone companies describe loop length in kilofeet (thousands of feet). In other parts of the world, wire resistance is usually expressed as Ohms per kilometer. Because telephone apparatus is generally considered to be current driven, all phone measurements refer to current consumption, not voltage. The length of the wire connecting the subscriber to the telephone exchange affects the total amount of current that can be drawn by anything attached at the subscriber's end of the line. In the United States, the voltage applied to the line to drive the telephone is 48 VDC; some countries use 50 VDC. Note that telephones are peculiar in that the signal line is also the power supply line. The voltage is supplied by lead acid cells, thus assuring a hum-free supply and complete independence from the electric company, which may be especially useful during power outages. At the telephone exchange the DC voltage and audio signal are separated by directing the audio signal through 2 uF capacitors and blocking the audio from the power supply with a 5- Henry choke in each line. Usually these two chokes are the coil windings of a relay that switches your phone line at the exchange; in the United States, this relay is known as the "A" relay (see fig.1). The resistance of each of these chokes is 200 Ohms. We can find out how well a phone line is operating by using Ohm's law and an ammeter. The DC resistance of any device attached to the phone line is often quoted in telephone company specifications as 200 Ohms; this will vary in practice from between 150 to 1,000 Ohms. You can measure the DC resistance of your phone with an Ohmmeter. Note this is DC resistance, not impedance. Using these figures you can estimate the distance between your telephone and the telephone exchange. In the United States, the telephone company guarantees you no lower current than 20 mA - or what is known to your phone company as a "long loop." A "short loop" will draw 50 to 70 mA, and an average loop, about 35 mA. Some countries will consider their maximum loop as low as 12 mA. In practice, United States telephones are usually capable of working at currents as low as 14 mA. Some exchanges will consider your phone in use and feed dial tone down the line with currents as low as 8 mA, even though the telephone may not be able to operate. Although the telephone company has supplied plenty of nice clean DC direct to your home, don't assume you have a free battery for your own circuits. The telephone company wants the DC resistance of your line to be about 10 megOhms when there's no apparatus in use ("on hook," in telephone company jargon); you can draw no more than 5 microamperes while the phone is in that state. When the phone is in use, or "off hook," you can draw current, but you will need that current to power your phone, any current you might draw for other purposes would tend to lower the signal level. The phone line has an impedance composed of distributed resistance, capacitance, and inductance. The impedance will vary according to the length of the loop, the type of insulation of the wire, and whether the wire is aerial cable, buried cable, or bare parallel wires strung on telephone poles. For calculation and specification purposes, the impedance is normally assumed to be 600 to 900 Ohms. If the instrument attached to the phone line should be of the wrong impedance, you would get a mismatch, or what telephone company personnel refer to as "return loss." (Radio Amateurs will recognize return loss as SWR.) A mismatch on telephone lines results in echo and whistling, which the phone company calls "singing" and owners of very cheap telephones may have come to expect. A mismatched device can, by the way, be matched to the phone line by placing resistors in parallel or series with the line to bring the impedance of the device to within the desired limits. This will cause some signal loss, of course, but will make the device usable. A phone line is balanced feed, with each side equally balanced to ground. Any imbalance will introduce hum and noise to the phone line and increase susceptibility to RFI. The balance of the phone line is known to your telephone company as "longitudinal balance." If both impedance match and balance to ground are kept in mind, any device attached to the phone line will perform well, just as the correct matching of transmission lines and devices will ensure good performance in radio practice. If you live in the United States, the two phone wires connected to your telephone should be red and green. (In other parts of the world they may be different colors.) The red wire is negative and the green wire is positive. Your telephone company calls the green wire "Tip" and the red wire "Ring". (In other parts of the world, these wires may be called "A" and "B".) Most installations have another pair of wires, yellow and black. These wires can be used for many different purposes, if they are used at all. Some party lines use the yellow wire as a ground; sometimes there's 6.8 VAC on this pair to light the dials of Princess type phones. If you have two separate phone lines (not extensions) in your home, you will find the yellow and black pair carrying a second telephone line. In this case, black is "Tip" and yellow is "Ring." The above description applies to a standard line with a DC connection between your end of the line and the telephone exchange. Most phone lines in the world are of this type, known as a "metallic line." In a metallic line, there may or may not be inductance devices placed in the line to alter the frequency response of the line; the devices used to do this are called "loading coils." (Note: if they impair the operation of your modem, your telephone company can remove them.) Other types of lines are party lines, which may be metallic lines but require special telephones to allow the telephone company to differentiate between subscribers. Very long lines may have amplifiers, sometimes called "loop extenders" on them. Some telephone companies use a system called "subscriber carrier," which is basically an RF system in which your telephone signal is heterodyned up to around 100 Khz and then sent along another subscriber's "twisted pair." If you have questions about your telephone line, you can call your telephone company; depending on the company and who you can reach, you may be able to obtain a wealth of information. The Speech Network The speech network - also known as the "hybrid" or the "two wire/four wire network" - takes the incoming signal and feeds it to the earpiece and takes the microphone output and feeds it down the line. The standard network used all over the world is an LC device with a carbon microphone; some newer phones use discrete transistors or ICs. One of the advantages of an LC network is that it has no semiconductors, is not voltage sensitive, and will work continuously as the voltage across the line is reduced. Many transistorized phones stop working as the voltage approaches 3 to 4 Volts. When a telephone is taken off the hook, the line voltage drops from 48 Volts to between 9 and 3 Volts, depending on the length of the loop. If another telephone in parallel is taken off the hook, the current consumption of the line will remain the same and the voltage across the terminals of both telephones will drop. Bell Telephone specifications state that three telephones should work in parallel on a 20 mA loop; transistorized phones tend not to pass this test, although some manufacturers use ICs that will pass. Although some European telephone companies claim that phones working in parallel is "technically impossible," and discourage attempts to make them work that way, some of their telephones will work in parallel. While low levels of audio may be difficult to hear, overly loud audio can be painful. Consequently, a well designed telephone will automatically adjust its transmit and receive levels to allow for the attenuation - or lack of it - caused by the length of the loop. This adjustment is called "loop compensation." In the United States, telephone manufacturers achieve this compensation with silicon carbide varistors that consume any excess current from a short loop (see fig. 2). Although some telephones using ICs have built-in loop compensation, many do not; the latter have been designed to provide adequate volume on the average loop, which means that they provide low volume on long loops, and are too loud on short loops. Various countries have different specifications for transmit and receive levels; some European countries require a higher transmit level than is standard in the United States so a domestically-manufactured telephone may suffer from low transmit level if used on European lines without modification. Because a telephone is a duplex device, both transmitting and receiving on the same pair of wires, the speech network must ensure that not too much of the caller's voice is fed back into his or her receiver. This function, called "sidetone," is achieved by phasing the signal so that some cancellation occurs in the speech network before the signal is fed to the receiver. Callers faced with no sidetone at all will consider the phone "dead." Too little sidetone will convince callers that they're not being heard and cause them to shout, "I can hear you. Can you hear ME?" Too much sidetone causes callers to lower their voices and not be heard well at the other end of the line. A telephone on a short loop with no loop compensation will appear to have too much sidetone, and callers will lower their voices. In this case, the percentage of sidetone is the same, but as the overall level is higher the sidetone level will also be higher. The Dial There are two types of dials in use around the world. The most common one is called pulse, loop disconnect, or rotary; the oldest form of dialing, it's been with us since the 1920's. The other dialing method, more modern and much loved by Radio Amateurs is called Touch-tone, Dual Tone Multi-Frequency (DTMF) or Multi-Frequency (MF) in Europe. In the U.S. MF means single tones used for system control. Pulse dialing is traditionally accomplished with a rotary dial, which is a speed governed wheel with a cam that opens and closes a switch in series with your phone and the line. It works by actually disconnecting or "hanging up" the telephone at specific intervals. The United States standard is one disconnect per digit, so if you dial a "1," your telephone is "disconnected" once. Dial a seven and you'll be "disconnected" seven times; dial a zero, and you'll "hang up " ten times. Some countries invert the system so "1" causes ten "disconnects" and 0, one disconnect. Some add a digit so that dialing a 5 would cause six disconnects and 0, eleven disconnects. There are even some systems in which dialing 0 results in one disconnect, and all other digits are plus one, making a 5 cause six disconnects and 9, ten disconnects. Although most exchanges are quite happy with rates of 6 to 15 Pulses Per Second (PPS), the phone company accepted standard is 8 to 10 PPS. Some modern digital exchanges, free of the mechanical inertia problems of older systems, will accept a PPS rate as high as 20. Besides the PPS rate, the dialing pulses have a make/break ratio, usually described as a percentage, but sometimes as a straight ratio. The North American standard is 60/40 percent; most of Europe accepts a standard of 63/37 percent. This is the pulse measured at the telephone, not at the exchange, where it's somewhat different, having traveled through the phone line with its distributed resistance, capacitance, and inductance. In practice, the make/break ratio does not seem to affect the performance of the dial when attached to a normal loop. Bear in mind that each pulse is a switch connect and disconnect across a complex impedance, so the switching transient often reaches 300 Volts. Try not to have your fingers across the line when dialing. Most pulse dialing phones produced today use a CMOS IC and a keyboard. Instead of pushing your finger round in circles, then removing your finger and waiting for the dial to return before dialing the next digit, you punch the button as fast as you want. The IC stores the number and pulses it out at the correct rate with the correct make/break ratio and the switching is done with a high-voltage switching transistor. Because the IC has already stored the dialed number in order to pulse it out at the correct rate, it's a simple matter for telephone designers to keep the memory "alive" and allow the telephone to store, recall, and redial the Last Number Dialed (LND). This feature enables you to redial by picking up the handset and pushing just one button. Because pulse dialing entails rapid connection and disconnection of the phone line, you can "dial" a telephone that has lost its dial, by hitting the hook-switch rapidly. It requires some practice to do this with consistent success, but it can be done. A more sophisticated approach is to place a Morse key in series with the line, wire it as normally closed and send strings of dots corresponding to the digits you wish to dial. Touch tone, the most modern form of dialing, is fast and less prone to error than pulse dialing. Compared to pulse, its major advantage is that its audio band signals can travel down phone lines further than pulse, which can travel only as far as your local exchange. Touch-tone can therefore send signals around the world via the telephone lines, and can be used to control phone answering machines and computers. Pulse dialing is to touch-tone as FSK or AFSK RTTY is to Switched Carrier RTTY, where mark and space are sent by the presence or absence of DC or unmodulated RF carrier. Most Radio Amateurs are familiar with DTMF for controlling repeaters and for accessing remote and auto phone patches. Bell Labs developed DTMF in order to have a dialing system that could travel across microwave links and work rapidly with computer controlled exchanges. Each transmitted digit consists of two separate audio tones that are mixed together (see fig.3). The four vertical columns on the keypad are known as the high group and the four horizontal rows as the low group; the digit 8 is composed of 1336 Hz and 852 Hz. The level of each tone is within 3 dB of the other, (the telephone company calls this "Twist"). A complete touch-tone pad has 16 digits, as opposed to ten on a pulse dial. Besides the numerals 0 to 9, a DTMF "dial" has *, #, A, B, C, and D. Although the letters are not normally found on consumer telephones, the IC in the phone is capable of generating them. The * sign is usually called "star" or "asterisk." The # sign, often referred to as the "pound sign." is actually called an octothorpe. Although many phone users have never used these digits - they are not, after all, ordinarily used in dialing phone numbers - they are used for control purposes, phone answering machines, bringing up remote bases, electronic banking, and repeater control. The one use of the octothorpe that may be familiar occurs in dialing international calls from phones in the United States. After dialing the complete number, dialing the octothorpe lets the exchange know you've finished dialing. It can now begin routing your call; without the octothorpe, it would wait and "time out" before switching your call. When DTMF dials first came out they had complicated cams and switches for selecting the digits and used a transistor oscillator with an LC tuning network to generate the tones. Modern dials use a matrix switch and a CMOS IC that synthesizes the tones from a 3.57MHz (TV color burst) crystal. This oscillator runs only during dialing, so it doesn't normally produce QRM. Standard DTMF dials will produce a tone as long as a key is depressed. No matter how long you press, the tone will be decoded as the appropriate digit. The shortest duration in which a digit can be sent and decoded is about 100 milliseconds (ms). It's pretty difficult to dial by hand at such a speed, but automatic dialers can do it. A twelve-digit long distance number can be dialed by an automatic dialer in a little more than a second - about as long as it takes a pulse dial to send a single 0 digit. The output level of DTMF tones from your telephone should be between 0 and -12 dBm. In telephones, 0 dB is 1 miliwatt over 600 Ohms. So 0 dB is 0.775 Volts. Because your telephone is considered a 600 Ohm load, placing a voltmeter across the line will enable you to measure the level of your tones. The Ringer Simply speaking this is a device that alerts you to an incoming call. It may be a bell, light, or warbling tone. The telephone company sends a ringing signal which is an AC waveform. Although the common frequency used in the United States is 20 HZ, it can be any frequency between 15 and 68 Hz. Most of the world uses frequencies between 20 and 40 Hz. The voltage at the subscribers end depends upon loop length and number of ringers attached to the line; it could be between 40 and 150 Volts. Note that ringing voltage can be hazardous; when you're working on a phone line, be sure at least one telephone on the line is off the hook (in use); if any are not, take high voltage precautions. The telephone company may or may not remove the 48 VDC during ringing; as far as you're concerned, this is not important. Don't take chances. The ringing cadence - the timing of ringing to pause - varies from company to company. In the United States the cadence is normally 2 seconds of ringing to 4 seconds of pause. An unanswered phone in the United States will keep ringing until the caller hangs up. But in some countries, the ringing will "time out" if the call is not answered. The most common ringing device is the gong ringer, a solenoid coil with a clapper that strikes either a single or double bell. A gong ringer is the loudest signaling device that is solely phone-line powered. Modern telephones tend to use warbling ringers, which are usually ICs powered by the rectified ringing signal. The audio transducer is either a piezoceramic disk or a small loudspeaker via a transformer. Ringers are isolated from the DC of the phone line by a capacitor. Gong ringers in the United States use a 0.47 uF capacitor. Warbling ringers in the United States generally use a 1.0 uF capacitor. Telephone companies in other parts of the world use capacitors between 0.2 and 2.0 uF. The paper capacitors of the past have been replaced almost exclusively with capacitors made of Mylar film. Their voltage rating is always 250 Volts. The capacitor and ringer coil, or Zeners in a warbling ringer, constitute a resonant circuit. When your phone is hung up ("on hook") the ringer is across the line; if you have turned off the ringer you have merely silenced the transducer, not removed the circuit from the line. When the telephone company uses the ringer to test the line, it sends a low-voltage, low frequency signal down the line (usually 2 Volts at 10 Hz) to test for continuity. The company keeps records of the expected signals on your line. This is how it can tell you have added equipment to your line. If your telephone has had its ringer disconnected, the telephone company cannot detect its presence on the line. Because there is only a certain amount of current available to drive ringers, if you keep adding ringers to your phone line you will reach a point at which either all ringers will cease to ring, some will cease to ring, or some ringers will ring weakly. In the United States the phone company will guarantee to ring five normal ringers. A normal ringer is defined as a standard gong ringer as supplied in a phone company standard desk telephone. Value given to this ringer is Ringer Equivalence Number (REN) 1. If you look at the FCC registration label of your telephone, modem, or other device to be connected to the phone line, you'll see the REN number. It can be as high as 3.2, which means that device consumes the equivalent power of 3.2 standard ringers, or 0.0, which means it consumes no current when subjected to a ringing signal. If you have problems with ringing, total up your RENs; if the total is greater than 5, disconnect ringers until your REN is at 5 or below. Other countries have various ways of expressing REN, and some systems will handle no more than three of their standard ringers. But whatever the system, if you add extra equipment and the phones stop ringing, or the phone answering machine won't pick up calls, the solution is disconnect ringers until the problem is resolved. Warbling ringers tend to draw less current than gong ringers, so changing from gong ringers to warbling ringers may help you spread the sound better. Frequency response is the second criterion by which a ringer is described. In the United States most gong ringers are electromechanically resonant. They are usually resonant at 20 and 30 Hz (+&- 3 Hz). The FCC refers to this as A so a normal gong ringer is described as REN 1.0A. The other common frequency response is known as type B. Type B ringers will respond to signals between 15.3 and 68.0 Hz. Warbling ringers are all type B and some United States gong ringers are type B. Outside the United States, gong ringers appear to be non-frequency selective, or type B. Because a ringer is supposed to respond to AC waveforms, it will tend to respond to transients (such as switching transients) when the phone is hung up, or when the rotary dial is used on an extension phone. This is called "bell tap" in the United States; in other countries, it's often called "bell tinkle." While European and Asian phones tend to bell tap, or tinkle, United States ringers that bell tap are considered defective. The bell tap is designed out of gong ringers and fine tuned with bias springs. Warbling ringers for use in the United States are designed not to respond to short transients; this is usually accomplished by rectifying the AC and filtering it before it powers the IC, then not switching on the output stage unless the voltage lasts long enough to charge a second capacitor. Conclusion This brief primer describing the working parts of a telephone is intended to provide a better understanding of phone equipment. Note that most telephone regulatory agencies, including the FCC, forbid modification of anything that has been previously approved or attached to phone lines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Fig 1. The Phone Line A RELAY 200 Ohms Telephone . Subscriber ------- Exchange . ------- . TIP + ------~~~~~~~--o----------------------o | 5 H | . | | . +| | . --- | . No 22 AWG wire --- 48V DC | . up to 10 Miles Long - | . --- A RELAY | . -| 200 Ohms | . | ------- | . | ------- | . RING - ------~~~~~~~--|---------o------------o 5 H | | . Audio 2uF | 2uF | . coupling 250V --- 250V --- Capacitors --- --- | | o----- \-------- | | A RELAY Contacts | | o----- \------------------ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Fig 2. Telephone Speech Network. Simplified U.S. Standard "425B". Component Values may vary between manufacturers. Connections for Dials, Ringers etc. not shown. |-------------------| ..|...................| . | .| Sidetone balancing. | 0.047uF 250V .| impedance & loop . | | | .| compensation. >>> . o----| |-------o .| . | | | | .| . | | .| . | |<| VR2 | .| . o----| |-------o---.| . | |>| |.| . | |.| . | 68 Ohms |.| . o---\/\/\/-----| |.| ..|..............|..|.| | | | | | . | | | -----)||(------|---------o (GN) 1)||(5 | | | | Loop )||( | | | | TIP Compensation 2)||(6 | | | | o------ \------o---------)||(------o | | RX O . | (RR) . || | | | | . | || 1.5uF | | | | . \ 180 || --- | | | . / Ohms || --- | |----o (R) . \ || 250V | | | . | || | | | . VR1 --- . || . | | | . ^ ^ ----)||(------o--- TX O . --- | 3)||(7 | . | | )||( | RING . | (C) | 4)||(8 22 Ohms | o----- \-------o---------)||(---o----/\/\/---o (B) | | ^ | | Hookswitch ------------ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Fig. 3. Standard DTMF pad and Frequencies (Low ____ ____ ____ ____ Group)| | | | | | | | 697Hz >| 1 | | 2 | | 3 | | A | |____| |____| |____| |____| ____ ____ ____ ____ | | | | | | | | 770Hz >| 4 | | 5 | | 6 | | B | |____| |____| |____| |____| ____ ____ ____ ____ | | | | | | | | 825Hz >| 7 | | 8 | | 9 | | C | |____| |____| |____| |____| ____ ____ ____ ____ | | | | | | | | 941Hz >| * | | 0 | | # | | D | |____| |____| |____| |____| ^ ^ ^ ^ 1209Hz 1336Hz 1477Hz 1633Hz (High Group) __________________________________________________________________________________ CHAPTER SIX ABOUT PAGERS _________________________________________________________________________________ Introduction about Pagers Screaming through the electromagnet swamp we live in are hundreds of thousands of messages of varying degrees of importance. Doctors, police, corporate executives, housewives and drug dealers all find themselves constantly trapped at the mercy of a teeny little box: the pager. Everyone has seen a pager; almost everyone has one. Over 20 million pagers are on the streets in the US alone, sorting out their particular chunk of the radio-spectrum. Another fifty-thousand more are put into service each day. But what the hell are these things really doing? What more can we do with them than be reminded to call mom, or to "pick up dry-cleaning?" Lots. The Paging Received Paging receivers come in hundreds of shapes and sizes, although the vast majority are manufactured by Motorola. Numeric pagers comprise over fifty percent all pagers in use. Alphanumeric comprises about thirty percent, with tone and voice pagers making up the remainder. Pagers are uniquely addressed by a capcode. The capcode is usually six to eight digits in length, and will be printed somewhere on the pager itself. Many pager companies assign customers PIN numbers, which are then cross-referenced to a given capcode in databases maintained by the service provider. PIN numbers have no other relationship to the capcode. Tone pagers are by far the most limited paging devices in use. When a specified number has been called, an address only message is broadcast, which causes the intended receiver to beep. Wow. Tone pagers usually have 4 capcodes, which can correspond to different locations to call back. Voice pagers are similar, except they allow the calling party to leave a 15 to 30 second message. The voice message is broadcast immediately after the capcode of the receiver, which unsquelches the device's audio. Numeric pagers, although seemingly limited by their lack of display options have proven otherwise by enterprising users. Most numeric data sent is obviously related to phone numbers, but numerous users have developed codes relating to various actions to be carried out by the party being paged. The most prolific users of this have been the Chinese who have one of the most active paging networks in the world. I suppose the next biggest users of code-style numeric paging would be drug dealers. (2112 0830 187 -- get to the fucking drop site by 8:30 or I'll bust a cap in your ass!) :) Alphanumeric pagers are most often contacted through a dedicated service that will manually enter in the message to be sent onto the paging terminal. One such service, NDC, offers its phone-answering and message typing services to various pager companies. Next time you are talking to a pager operator, ask him or her if they are at NDC. They probably are. In addition to the capcode, pagers will have an FCC ID number, a serial number, and most importantly, the frequency that the device has been crystaled for imprinted on the back of the device. Although technology exists that would allow pagers to listen on a number of frequencies by synthesizing the frequency rather than using a crystal, pager manufacturers stick to using crystals to "keep the unit cost down." Pagers may have multiple capcodes by which they can be addressed by. Multiple capcodes are most often used when a person has subscribed to various services offered by their provider, or when the subscriber is part of a group of individuals who will all need to receive the same page simultaneously (police, EMTs, etc.). Most low-cost pagers have their capcode stored on the circuit board in a PAL. Most paging companies will completely exchange pagers rather than remove and reprogram the PAL, so I don't think it's worth it for any experimenter to attempt. However, like most Motorola devices, many of their paging products can be reprogrammed with a special serial cable and software. Reprogramming software is usually limited to changing baud rates, and adding capcodes. Additionally, some units can be reprogrammed over the air by the service provider. Using a POCSAG feature known as OTP (over the air programming) the service provider can instruct the paging receiver to add capcodes, remove capcodes, or even shut itself down in the case of non-payment. Services With the growing popularity of alphanumeric pagers, many service providers have decided to branch out into the information business. The most common of these services is delivery of news headlines. Other services include stock quotes, airline flight information, voice mail and fax reception notification, and email. Of course, all of these services are available for a small additional monthly premium. Email is probably the single coolest thing to have sent to your alpha pager. (Unless you subscribe to about a zillion mailing lists) Companies like SkyTel and Radiomail give the user an email address that automatically forwards to your paging device. IE: PIN-NUMBER@skymail.com. Several packages exist for forwarding email from a UNIX system by sending stripping down the email to pertinent info such as FROM and SUBJECT lines, and executing a script to send the incoming mail out via a pager terminal data port. One such program is IXOBEEPER, which can be found with an archie query. Radiomail's founder, (and rather famous ex-hacker in his own right - go look at ancient ComputerWorld headlines), Geoff Goodfellow had devised such a method back in the late 70's. His program watched for incoming email, parsed the mail headers, and redirected the FROM and SUBJECT lines to his alphanumeric pager. Obviously, not many people had alphanumeric pagers at all, much less email addresses on ARPANET back in the 70's, so Geoff's email pager idea didn't see much wide-spread use until much later. There are now computer programs u can download that punt pagers just like what u can do on AOL ______________________________________________________________________________________ CHAPTER SEVEN THE HISTORY OF BRITISH PHREAKING ______________________________________________________________________________________ The History of British Phreaking In Britain, phreaking goes back to the early fifties, when the technique of 'toll a drop back' was discovered. Toll a was an exchange near St. Pauls which routed calls between London and nearby non-London exchanges. The trick was to dial an unallocated number, and then depress the receiver-rest for 1/2 second. This flashing initiated the 'clear forward' signal, leaving the caller with an open line into the toll exchange. They could then dial 018, which forwarded him to the trunk exchange at that time, the first long distance exchange in Britain and follow it with the code for the distant exchange to which he would be connected at no extra charge. The signals needed to control the UK network today were published in the "institution of post office engineers journal" and reprinted in the Sunday Times (15 Oct. 1972). The signalling system they use: signalling system no. 3 uses pairs of frequencies selected from 6 tones separated by 120hz. With that info, the phreaks made "bleepers" or as they are called here in the US. "blue box", but they do utilise different mf tones then the US. Thus, your US.Blue box that you smuggled into the UK will not work, unless you change the frequencies. In the early seventies, a simpler system based on different numbers of pulses with the same frequency (2280hz) was used. For more info on that, try to get a hold of: atkinson's "telephony and systems technology". In the early days of British phreaking, the Cambridge university titan computer was used to record and circulate numbers found by the exhaustive dialling of local networks. These numbers were used to create a chain of links from local exchange to local exchange across the country, bypassing the trunk circuits. Because the internal routing codes in the UK network are not the same as those dialled by the caller, the phreaks had to discover them by 'probe and listen' techniques or more commonly known in the US-- Scanning. What they did was put in likely signals and listened to find out if they succeeded. The results of scanning were circulated to other phreaks. Discovering each other took time at first, but eventually the phreaks became organised. The "map" of Britain was called "undercurrents" which enabled British phreaks to share the info on new numbers, equipment etc. To understand what the British phreaks did, think of the phone network in three layers of lines: local, trunk, and international. In the UK, subscriber trunk dialling (std), is the mechanism which takes a call from the local lines and (legitimately) elevates it to a trunk or international level.The UK phreaks figured that a call at trunk level can be routed through any number of exchanges, provided that the right routing codes were found and used correctly. They also had to discover how to get from local to trunk level either without being charged (which they did with a bleeper box) or without using (std). Chaining has already been mentioned but it requires long strings of digits and speech gets more and more faint as the chain grows, just like it does when you stack trunks back and forth across the U.S. The way the security reps snagged the phreaks was to put a simple 'printermeter' or as we call it: a pen register on the suspects line, which shows every digit dialed from the subscribers line. The British prefer to get onto the trunks rather than chaining. One way was to discover where local calls use the trunks between neighbouring exchanges, start a call and stay on the trunk instead of returning to the local level on reaching the distant switch. This again required exhaustive dialing and made more work for titan; it also revealed 'fiddles', which were inserted by post office engineers. What fiddling means is that the engineers rewired the exchanges for their own benefit. The equipment is modified to give access to a trunk with out being charged, an operation which is pretty easy in step by step (sxs) electromechanical exchanges, which were installed in Britain even in thes (note: I know of a back door into the Canadian system on a 4aco., So if you are on sxs or a 4a, try scanning 3 digit exchanges, i.e.:dial 999, 998,997 etc. and listen for the beep-kerchink, if there are no 3 digit codes which allow direct access to a tandem in your local exchange and bypasses the ama so you won't be billed, not have to blast 2600 everytime you wish to box a call. A famous British 'fiddler' revealed in the early 1970s worked by dialling 173. The caller then added the trunk code of 1 and the subscribers local number. At that time, most engineering test services began with 17x, so the engineers could hide their fiddles in the nest of service wires. When security reps started searching, the fiddles were concealed by tones signalling: 'number unobtainable' or 'equipment engaged' which switched off after a delay. The necessary relays are small and easily hidden. There was another side to phreaking in the UK in the sixties. Before std was widespread, many 'ordinary' people were driven to occasional phreaking from sheer frustration at the inefficient operator controlled trunk system. This came to a head during a strike about 1961 when operators could not be reached. Nothing complicated was needed. Many operators had been in the habit of repeating the codes as they dialled the requested numbers so people soon learnt the numbers they called frequently. The only trick' was to know which exchanges could be dialled through to pass on the trunk number. Callers also needed a pretty quiet place to do it, since timing relative to clicks was important. The most famous trial of British phreaks was called the old bailey trial. Which started on 3 Oct. 1973. What the phreaks did was to dial a spare number at a local call rate but involving a trunk to another exchange then they send a 'clear forward' to their local exchange, indicating to it that thecall is finished; but the distant exchange doesn't realise because the caller's phone is still off the hook. They now have an open line into the distant trunk exchange and sends to it a 'seize' signal: '1' which puts him onto its outgoing lines. Now, if they know the codes, the world is open to them. All other exchanges trust his local exchange to handle the billing; they just interpret the tones they hear. Meanwhile, the local exchange collects only for a local call. The investigators discovered the phreaks holding a conference somewhere in England surrounded by various phone equipment and bleeper boxes, also printouts listing 'secret' post office codes. (they probably got them from trashing?) The judge said: "some take to heroin, some take to telephones". For them phone phreaking was not a crime but a hobby to be shared with fellow enthusiasts and discussed with the post office openly over dinner and by mail. Their approach and attitude to the worlds largest computer, the global telephone system, was that of scientists conducting experiments or programmers and engineers testing programs and systems. The judge appeared to agree, and even asked them for phreaking codes to use from his local exchange!!! BOXING There are many differant boxes around and they are all named after different colours. Some of them no longer, or some of them don,t work in the UK. Here are the one that should work in the UK ------------------------------------------------------------------------------------------------------------------------------- Beige Box The construction is very simple. First, you must understand the concept of the device. In a modular jack, there are four wires. These are red, green, yellow, and black. For a single line telefone, however, only two matter: the red (ring) add green (tip). The yellow and black are not neces- sary for this project. A lineman's handset only has two clips on it: the ring and the tip. You will need a fone (we recommend a touch-tone) with a modular plug, a modular jack, and two large alligator clips (preferably red and green, respec- tively). Take the modular jack and look at the bottom of its casing. There should be a gray jack with four wires (red, green, yellow, and black) leading out of it. To the end of the red wire attach a red alligator clip. To the end of the green wire attach a green alligator clip. The yellow and black wires can be removed, although I would only set them aside so that you can use the modular jack in future projects. Now insert your telefone's modular plug into the modular jack. That's it. This particular model is nice because it can be inexpensive, uses common parts that are readily available, is small, is lightweight, and does not re- quire the destruction of a fone. There are many uses for the Beige Box. However, before you can use it, you must know how to attach it to its output device. This device can be any of several Bell switching apparatus that include terminal sets (i.e., remote switching centers, bridging heads, cans, etc.) To open most Bell Telefone switching apparatus, you must have a 7/16 inch hex driver. This piece of equipment can be picked up at your local hardware store. With your 7/16 hex driver, turn the security bolt(s) approximately 1/8 of an inch counter-clock- wise and open. If your output device is locked, then you must have some knowledge of destroying and/or picking locks. However, we have never encoun- tered a locked output device. Once you have opened your output device, you should see a mass of wires connected to terminals. On most of your output devices, the terminals should be labeled "T" (Tip -- if not labeled, it is usually on the left) and "R" (Ring -- if not labeled, it is usually on the right). Remember: Ring - red - right. The "Three R's" -- a simple way to remember which is which. Now you must attach the red alligator clip (ring) to the "R" (ring) termi- nal. Attach the green alligator clip (tip) to the "T" (tip) terminal. NOTE: If instead of a dial tone you hear nothing, re-adjust the alligator clips so that they are not touching each other or other terminals. Also make sure that they are firmly attached. By this time you should hear a dial tone. Dial ANI and find out the number that you are using (you wouldn't want to use your own). Here are some practical applications: o Eavesdropping o Long distance, static-free fone calls to phriends o Dialing direct to Alliance Conferencing (also static free) o Phucking people over o Bothering the operator at little risk to yourself o Blue Boxing with a greatly reduced chance of getting caught o Anything at all that you want, since you are an extension on that line Eavesdropping: To be most effective, first attach the Beige Box and then your fone. This eliminates static caused by connecting the Box, therefore reducing the potential suspicion of your victim. When eavesdropping, it is always best to be neither seen nor heard. If you hear someone dialing out, do not panic; but rather hang up, wait, and pick up the receiver again. The person will either have hung up or tried to complete their call again. If the latter is true, then listen in, and perhaps you will find information worthy of blackmail! If you would like to know who you are listening to, after dialing ANI, pull a CN/A on the number. Dialing Long Distance: This section is self-explanatory, but don't forget to dial a "1" before the NPA. Dialing Direct to Alliance Conferencing: Simply dial 1-700-456-1000 and you will get instructions from there. I prefer this method over PBXs, since PBXs often have poor reception and are more difficult to come by. Phucking People Over: This is a very large topic for discussion. Just by using the other functions described, you can create a large fone bill for the person (they will not have to pay it, but it is a hassle for them). In addition, since you are an extension of the person's line, leave your fone off hook, and they will not be able to make or receive calls. This can be extremely nasty be- cause no one would suspect the cause of the problem. Bothering the Operator: This is also self-explanatory and can provide hours of entertainment. Simply ask or say things to her that are offensive and you would not like traced to your line. This also corresponds with the previous described section, Phucking People Over. After all, guess who's line it gets traced to? He he he... ------------------------------------------------------------------------------------------------------------------------------- Blue Box This is most well know box there is around.In 60,s 70,s and 80,s it was very easy but now people have tighten security with blue box which makes it harder but it is still possible to do it. Ahh, in the beginning, there was the 2280Hz tone - this was the UK equivalent of the magic 2600Hz tone and was used in the same way with a separate bunch of MF tones, now alas the only place that you can use that lot with is in hicksville when you are on a non digital exchange and even then there are nasty filters blocking the magic tone soooo.....you start to look elsewhere. Now, we have what is called 0800 numbers which are the UK equivalent of 1-800 numbers and some of(especially ones starting 0800 89 XXXX) lead you overseas to new and exciting lands which means new and exciting fone systems. Here are some listed below, go hunting for others; o AT&T USA Direct 0800 890 211 o Australia direct 0800 890 061 o Austria direct 0800 890 043 o Bahamas direct 0800 890 135 o Bahrain direct 0800 890 973 o Belgium direct 0800 890 032 o Bermuda direct 0800 890 123 o Bolivia direct 0800 890 059 o Brazil direct 0800 890 055 o Brunei direct 0800 890 673 o Canada direct 0800 890 016 o Chile direct 0800 890 056 o Colombia direct 0800 890 057 o Denmark direct 0800 890 045 o Finland direct 0800 890 358 o France direct 0800 890 033 o Gabon direct 0800 890 241 o Germany Direct 0800 890 049 o Greece Direct 0800 890 030 o Hawaii direct 0800 890 808 o Hong Kong direct 0800 890 852 o Hungary direct 0800 890 036 o Iceland direct 0800 890 354 o Indonesia direct 0800 890 062 o Ireland direct 0800 890 353 o Italy direct 0800 890 039 o Japan direct (KDD) 0800 890 081 o Japan straight (IDC) 0800 890 080 o Jamaica Direct 0800 890 526 o Korea South direct 0800 890 082 o Korea South (DACOM) 0800 890 820 o Luxembourg direct 0800 890 352 o Macao direct 0800 890 853 o Malaysia direct 0800 890 060 o Netherlands direct 0800 890 031 o New Zealand direct 0800 890 064 o New Zealand (C COMMS) 0800 890 640 o Norway direct 0800 890 047 o Paraguay direct 0800 890 595 o Philipines direct 0800 890 063 o Philipines (PHILICOM) 0800 890 633 o Portugal direct 0800 890 351 o Singapore direct 0800 890 065 o South Africa direct 0800 890 027 o Spain direct 0800 890 034 o Sweden direct 0800 890 046 o Switzerland direct 0800 890 041 o Taiwan direct 0800 890 886 o Thailand direct 0800 890 082 o Turkey direct 0800 890 090 o U.A.E direct 0800 890 971 o Uraguay direct 0800 890 598 o Venezuela direct 0800 890 058 Right, sift through those (no I'm not telling you which ones) and find one that is a CCITT5 line (nice beep when they answer) and grab a copy of Bluebeep (courtesy of Mr. Dittmeyer) and do the following... 1. dial your 0800 number (It must be a CCITT5 line) 2. send down 2600/2400Hz together, then 2400Hz on it's own. The length of the tones and the delay between them varies with different lines,experiment boy. 3. dial the number you are calling as follows... KP2-CountryCode-AreaCode-Number-ST (you can't use KP on country direct lines, but you can on others) 4. as if by magic.... (There is an excellent article on blue boxing in the 20th century in CoTNO 4 which goes into this whole topic much clearer and better than I do - go check it out.) Note, don't give up if it doesn't work, you have to experiment and play around, all things come to those who work....now despite what anybody tells you this works, BT have just removed one global route as I type this, so get going and find others. ------------------------------------------------------------------------------------------------------------------------------- Brown Box Plans (((> Introduction <))) This is a fairly simple modification that can be made to any phone. All it does is allow you to take any 2 lines in your house and create a party line. So far I have not heard of any problems with it from my friends that have set one up and I have not had any either. There is one thing that you will notice when you are one of the two people who is called by a person with this box. The other person will sound a little bit faint. I could overcome this with some amplifiers but then there wouldn't be very many of these boxes made. I think that the convenience of having two people on line at any one time will make up for the minor volume loss. (> Phone Modification Instructions <) Here is the diagram: KEY:___________________________________ ! PART ! SYMBOL ! ----------------------------------- !BLACK WIRE ! * ! !YELLOW WIRE ! = ! !RED WIRE ! + ! !GREEN WIRE ! - ! !SPDT SWITCH ! _/_ ! ! _/_ ! !VERTICAL WIRE ! | ! !HORIZONTAL WIRE ! _ ! ----------------------------------- * = - + * = - + * = - + * = - + * = - + * ==_/_- + *******_/_++++++ | | | | | | |_____PHONE____| In some houses the black and yellow are already wired in others you will have to go out to your box and rewire it. A good way to figure out which line is which is to take the phone you are looking for off the hook. Then you only need to take the red and green wires entering your phone and hook them to the different pairs of red and green going into the house. You can't hurt any- thing in the phone or telephone by probing. When you find the pair that you want take the black from your line and attach it to the red of the other line then take the yellow and attach it to the green line. Now you are all set to go. For people with rotary phones you can have one person call you then place the second call out to the other person. Though not a phreakers tool, the brown box can be phun. ---------------------------------------------------------------------------------- This Box is quite similar to a Beige Box, except this is a portable unit. It is extremely handy for free voice calls and tapping a nearby house's line. It's really easy to make so don't worry about it (unlike a Blue Box!). MATERIALS: >-:->> Two alligator clips __________ >-:->> One-piece fone or normal fone (one piece is easier!) >-:->> Soldering iron and some solder >-:->> Some good wire PROCEDURE: __________ [1> Cut the wire that connects the fone to the wall. Inside there should be 4 colored wires. Yellow, red, green, and black. If the wires are not colored, no need to get worried. The two in the middle are red & green. Those are the 2 you need. [2> Make sure to keep about 1-2 feet of this wire connected to the fone unless you want to use the other wire listed above. Now solder one alligator clip to the green wire, and one the red. [3> If you're using the other wire, strip the ends and solder one end to of each to the red and green on the fone, and one end to an alligator clip. [4> Go to a nearby house and locate the little gray box. It's simple to find, look by the gas meter. It should have the BELL logo on it. [5> To open this thing, put your hand underneath it and hit upward. You should get contact with the bottom edge of it. [6> Now it should come open nice and easy. Look inside and you will see five screws in this pattern: * * * * * [7> The screw in the middle and the two on the left do nothing. (Actually, you may want to check the two on the left, as some people have a second line hooked up to these two). All you need to worry about are the two on the right. The one in the top right-hand corner is usually the green, and the one in the bottom right-hand corner is usually the red. [8> Clip an alligator clip to the corresponding terminals (red to red, green to green.) You should get a dial tone. If you don't, switch the alligator clips around. If you still don't get a dial tone (or someone's conversation!) then the line has probably been disconnected or the fone is off the hook. Cheese Box A Cheese Box (named for the type of Box the first one was found in) is a type of Box which will, in effect, make your telephone a Pay-Phone.....This is a simple, modernized, and easy way of doing it.... Inside Info: These were first used by bookies many years ago as a way of making calls to people without being called by the cops or having their numbers traced and/or tapped...... How To Make A Modern Cheese Box MATERIALS: >-:->> Call Forwarding service on the line >-:->> Set of Red Box Tones >-:->> The number to your prefix's Intercept operator (do some scanning for this one) PROCEDURE After you find the number to the intercept operator in your prefix, use your call-forwarding and forward all calls to her... this will make your phone stay off the hook (actually, now it waits for a quarter to be dropped in)... you now have a Cheese Box... In order to call out on this line: you must use your Red Box tones and generate the quarter dropping in...then, you can make phone calls to people...as far as I know, this is fairly safe, and they do not check much... ---------------------------------------------------------------------------------- Crimson Box The Crimson Box is very simple device that will allow you to put someone on hold or make your fone busy with a large amount of ease. You flip a switch and the person can't hear you talking. Flip it back and everything is peachy. MATERIALS: >-:->> 100 ohm or less resistor >-:->> SPDT toggle switch, On-Off >-:->> Solder and soldering iron >-:->> 3 feet of good wire >-:->> Wire cutters CONSTRUCTION & SCHEMATIC First I will give you the schematic and then I will explain what the hell is going on. -----------black wire on line--------- --------+ red wire on line +------ --------:--+/\/\/-green wire---:------ --------:--:-yellow wire-------:------ : : : +--:------+ : +----+ : +----------+ : : : 1 2 3 Ok. The '/\/\/' is the resistor. And '1 2 3' is the switch where the numbers are the poles on the switch. Notice you leave the black and yellow wires alone. You DO NOT cut them! Strip the red and green wires so you've got about an inch of bare wire. Solder some of the extra wire and follow the schematic. You should have the resistor on the green wire with an extra piece of wire coming from one leg of it. The other leg goes to the other end of the green wire. You should solder the green wire to the left pole of the switch and the red to the middle and the other end of the red to the right pole. Now, lift up the fone. If all you get is an annoying buzz then throw the switch and you should get a dial tone. If not, don't worry and just follow the instructions and schematic again. ---------------------------------------------------------------------------------- Pearl Box The Pearl Box: Definition - This is a box that may substitute for many boxes which produce tones in hertz. The Pearl Box when operated correctly can produce tones from 1-9999hz. As you can see, 2600, 1633, 1336 and other cru- cial tones are obviously in its sound spectrum. MATERIALS: C1, C2::::::::.5mf or .5uf ceramic disk capacitors Q1::::::::::::NPN transistor (2N2222 works best) S1::::::::::::Normally open momentary SPST switch S2::::::::::::SPST toggle switch B1::::::::::::Standard 9-Volt battery R1::::::::::::Single turn, 50k potentiometer R2:::::::::::: " " 100k potentiometer R3:::::::::::: " " 500k potentiometer R4:::::::::::: " " 1meg potentiometer SPKR::::::::::Standard 8-ohm speaker T1::::::::::::Mini transformer (8-ohm works best) Misc.:::::::::Wire, solder, soldering iron, PC board or perfboard box to contain the completed unit, battery clip PROCEDURE Since the instruction are EXTREMELY difficult to explain in words, you will be given a schematic instead. It will be quite difficult to follow but try it any way. There is also a Hi-Res picture you can get that shows the schematic in great detail. Schematic for The Pearl Box +-------------+------------+---------+ ! ! \ +--S1---- C1 C2 \ SPKR ! ! + +-------- + + ----+T1 + !\ +---------------+------+ ! b c-------! ! Q1 ! ! e-----S2---+ ! ! ! ! ! B1 ! ! ! ! ! +-------+ !R1 R2 R3 R4! /\/\ /\/\ /\/\ /\/\ +--+ +--+ +--+ Now that you are probably thoroughly confused, let me explain a few minor details. The potentiometer area is rigged so that the left pole is connected to the center pole of the potentiometer next to it. The middle terminal of T1 is connected to the piece of wire that runs down to the end of the battery. You may want to get some dry-transfer decals at Radio Shack to make this job a lot easier. Also, some knobs for the tops of the potentiometers may be useful too. Use the decals to calibrate the knobs. R1 is the knob for the ones place, R2 is for the tens place, R3 if for the hundreds place and R4 is for the thousands place. S1 is for producing the all the tones and S2 is for power. Step 1: Turn on the power and adjust the knobs for the desired tone. (Example: For 2600 hz - R1 = 0: R2 = 0: R3 = 6: R4 = 2) Step 2: Hit the push-button switch and VOILA! You have the tone. If you don't have a tone recheck all connections and schematic. ------------------------------------------------------------------------------------------------------------------------------- Red Box Okay. First, the basics, for the people who don't know what Red Box tones are. A Red Box is a device that generates 10p 20p 50p tones so the operator thinks that coins have been dropped in the slots. For a Quarter there are 5 beeps that are outpulsed at 12-17 pulses, for the dime there are 2 beeps that are outpulsed at 5-8.5 PPS and for a nickle one beep outpulsed the same as a dime. Now each beep consists of 2 tones which are 2200hz and 1700hz. Below is a way to get these tones without having to actually build a Red Box. Here's what you do: Materials needed: )-:->> Trusted friend (HA HA HA....AHHHH.......) )-:->> Micro cassette recorder (preferably) )-:->> Telefone pickup from your local Radio Shack Now go down to the fortress fones. Do it at night, as it's not advisable to do in the day-time when people can see you. Look for two fortress fone booths connected together. This will make the job a lot easier if you are alone. Now, connect the telefone pickup to the receiver of the handset of one of the telefones. (And don't forget to connect it to your cassette recorder). You might have to tape the telefone pick-up to the receiver. Now put the fone on hook and go to the neighbouring fone booth. From here make a telefone call to the first booth. Leave your handset hanging and quickly go to the other fone booth where the telefone pickup is hooked up. Press the recording button. Then pick up the handset and LEAVE IT OFF HOOK (remember the recording is still going on). Now go to the second telefone booth where you made the call, drop a couple of quarters, dimes and nickles. You are done!!!!!!! When you play back the cassette you will hear the tones of the coins you put in. This procedures may also work from home, whereby you'll have the telefone pick-up connected at home, and someone calls you and drops in the coins. This method should work in most countries ------------------------------------------------------------------------------------------------------------------------------ Scarlet Box The purpose of a Scarlet box is to create a very bad conection, it can be used to crash a BBS or just make life miserable for those you seek to avenge. materials: 2 aligator clips, 3 inch wire, or a resister (plan wire will create greatest amount of static) (Resister will decrease the amount of static in porportion to the resister you are useing) Step (1): Find the phone box at your victims house, and pop the cover off. Step (2): Find the two prongs that the phone line you wish to box are connected too. Step (3): Hook your aligator clips to your (wire/resister). Step (4): Find the lower middle prong and take off all wires connected to it, i think this disables the gound and call waiting and shit like that. Step (5): Now take one of the aligator clips and attach it to the upper most prong, and take the other and attach it to the lower middle prong. Step (6): Now put the cover back on the box and take off!! ** ######## ** ** # #### # ** ######## / # #### # / ######## / / / / / / / / **/ ** ** ** ** ** (**)= prongs ** (/) = (wire/resister) (##)= some phone bullshit ---------------------------------------------------------------------------------- -=> Making your fone <=- -=> into a Cheesebox <=- A Cheese Box (named for the type of Box the first one was found in) is a type of Box which will, in effect, make your telephone a Pay-Phone.....This is a simple, modernized, and easy way of doing it.... Inside Info: These were first used by bookies many years ago as a way of making calls to people without being called by the cops or having their numbers traced and/or tapped...... How To Make A Modern Cheese Box MATERIALS: >-:->> Call Forwarding service on the line >-:->> Set of Red Box Tones >-:->> The number to your prefix's Intercept operator (do some scanning for this one) PROCEDURE After you find the number to the intercept operator in your prefix, use your call-forwarding and forward all calls to her... this will make your phone stay off the hook (actually, now it waits for a quarter to be dropped in)... you now have a Cheese Box... In order to call out on this line: you must use your Red Box tones and generate the quarter dropping in...then, you can make phone calls to people...as far as I know, this is fairly safe, and they do not check much... ---------------------------------------------------------------------------------- The Charging Box ---------------- What it does: The Charging Box is used to indicate when a call is being charged for and when it is not. Once installed, the box has two lights, a green and a red. Green means free and red shows that you are being stung by BT! Components: 1 x green LED 1 x circuit board 1 x red LED 2 x 10K ohm (1/4 watt) resistors 2 x short lengths of wire 2 x small bulldog clips Circuit Diagram: | Line | | (50v) | |------ ------| | | |-----[]------O------| | | |-----[]------O------| Where [] is a resistor and O is an LED. NB. IMPORTANT! One LED should have it's anode towards the resistor and the other should have it's cathode towards the resistor. Connection: Build that onto the board and connect the two points marked line to the wire, with the bulldog clips at the end. The box should now be connected to the line in parallel with the phone. Operation: When the line is opened (Ie. the phone lifted) the green LED will light (if the read one does then just reverse the polarity of the box). Dialling numbers (by pulse) will cause the green LED to flicker but while you are making free calls it should never go out and the red LED will not light. As soon as the exchange starts charging for your call, the green LED will go out and the red LED glow. How it works: As the LEDs are in opposite directions, only one can light depending on the polarity of the current supply. This is exploited when the exchange begins charging as the polarity of the line is reversed. --------------------------------------------------------------------------- -=-=-=-=-=-=-=-= | The Rock Box | -=-=-=-=-=-=-=-= INTRODUCTION ------------ And now for all you basement engineers... Here's the ROCK BOX! Basicly what the Rock Box does is channel the music from the stereo out to the phone line via the headphone output. There are two models to this Box, the Basic Box and Advanced Box. I would recommend the Advanced Box for better sound quality, although the Basic one get's the job done. Well... Enough for the formalities, now for the Advanced Box! Identification Materials Specification -------------- --------- ------------- A 1 Resistor (Brown-Black-Red-Silver) B 1 Resistor (Orange-Orange-Orange-Gold) C 1 Resistor (Gold-Red-Red-Grey) D 1 Resistor (L.Green-D.Green-Brown-Gold) E 1 Resistor (Brown-Red-Red-Gold) F 3 Condensators (1070 (50v)) G 4 Condensators (1002 (40v)) H 1 Condensator (1060 (16v)) <*> (Also S) 2 Switches (2-Channel) ^#^ (Also K) 1 Transformer (LUN5250B) ~o~ 1 LED Light (Optional) J Junction Wiring Diagram -Advanced Switch for Volume Hi/Lo Switch for Power On/Off _______________________________________________________________ | +---------+ | | +-----------+ C-B-A +-------+ J J +--------+ | | | S-S-S-O | | +-S-S | S--------+ +---------> > | IN | | | | | +-S+ O +-------------> >-+ | >+ | | >-+ | FROM |<| +----+ F H | STEREO>| | < | F-----------O-----KKK KKK | | +------D--E-+ ^#^ K ^#^ | |_______________________________________________________________| Wiring Diagram -Basic ___________________________________ | | | <------+ F--KKK--H +---> | | | | ^#^ | +----> | OUT IN | <------*----+ +------* | | STEREO>| <------+ +---> | |___________________________________| Now some of the Benifits of this wonderful little device is that you can record conversations, at whatever volume you want, without those bothersome beeps the answering machines make. Or another fun thing is call up a Rodent Bridge and blast this thing with your stereo at full... Wala! The bridge will most likely be clear, even they won't sit through that shit. It is a good idea to hit Radio Shack for a project box and soderless curcuit board, because this can be messy and a project box can easily make you look like a pro. One more use for it is if your computer can generate tones to match a Box of some sort, this makes a GREAT amplifier for it, with almost no loss in clearity. If you have any problems with a humm or it intercepting radio transmittions, then call up good-old Bell and get a line static clearer dealy and splice that into the box via the outgoing line, which SHOULD clear it up. If that does not seem to help, try putting a 9v battery (you know, the square ones) on the red and green phone lines, because this will make up for the power the box drains from the line. ---===[Useful BT Numbers ]===--- Some of them numbers are meant for BT employees only, such as the BT news line, but everyone uses it anyway... hehehe. OK folks, here they are... 141 number Withhold Number When Dialling Out 1471 Gives Details of Last Number to You 14713 Call The Last Number To Call You 1470 Un-withhold your number 150 BT Customer Services 151 BT Fault Reporting 155 International Operator 153 International Directory Enquiries 192 UK Direcroty Enquiries 112 An alternative to 999 *21* Divert All Calls *#21# Check Divert (Hightone=ON, Lowtone=OFF) #21# Cancel Divert *261# Bars All Incoming Calls *#261# Check Incoming Call Barring #261# Cancel Incoming Call Barring *34x# Switch ON Call Barring (x=option number) *#34x# Check Call Barring #34x*PIN# Cancel Call Barring Option #34*PIN# Cancel All Call Bars Call Bar Options: 1-bar all calls (except 999/151) 2-bars calls starting with '0' 3-bars international calls 4-bars calls starting with 1 except 151 5-bars calls using * 6-bars premium rate (0898) 7-bars premium rate (0891) *41# Switch Call Waiting ON #43# Switch Call Waiting OFF *#43# Check Call *52# Details of Last Outgoing Call (Gives Number) #52# Delete Information of Last Outgoing Call #54# Redail Last Outgoing Call *61* Divert if no Reply *#61# Check Diverting #61# Cancel Divert on no Reply *67* Divert if Busy *#67# Check Divert #67# Cancel Divert on Busy 17070 BT line tester thingy *55*|TIME|# Alarm clock this one is a personal fav u *#55# Check time could use it at a mates house and let it go #55# cancel off at 3am 0800 800 150 Residential General Enquiries 0800 800 151 Residential Fault Reports 0800 800 152 Business General Enquiries 0800 800 154 Business Fault Reports 0800 666 700 Recorded Advice Line 0800 663 388 Welsh Language Advice Line 0800 661 441 Reporting Malicious Calls 0800 212 950 General BT Enquiries 0800 500 005 BT News Line 0800 800 850 BT FaxBack Line 0500 123 113 BT SECURITY!!!!!!!! 0500 123 412 BT answering service 123 420 - Answerphone 0800 000 891 BT Value Call 0800 321 145 BT select services info line. 0800 321 140 BT's remote update facility enter service code. 0800 321 107 The no. for BT's remote update access has changed. 0800 321 101 Welcome to BT's remote update facility enter service code. 0800 321 104 BT's download facility enter service code. 0800 282 298 BTs Telegram service WARDIALLING Wardialing in the UK, for me, is a very interesting subject. Although a lot of the modern c0de kiddies consider it "old-sk00l" and see it as no use today, Wardialing is actually, in my opinion, one of the greatest Hacking related things to do. Hacking a Webpage is fun yes but an isolated carrier provides much more entertainment and excitement, and via wardialing we aim to find these carriers along with lots of other cool things which will provide the phun. All the time, I am approached and people ask me HOW TO wardial in the UK, I always tell people its the same as in the UK, but people act so confused about the whole idea of UK Wardialing. Basically the little Windoze kiddies see some old wardialer, try it out and find that the area code to enter is only allowed to be up to 3 numbers long, therefore a US area code, with this they panic and cry out for help. Or they download a version of ToneLoc and PANIC because they do not understand the program, which CAN be used for UK wardialing and its the one I always use. This is where this help file is intended to come in useful, it will guide you through the basics of wardialing in the UK, and what you will find on your journey and it will also guide you with using Toneloc succesfully to scan loads of numbers and gain interesting results infinding carriers, VMBs, PBXs, unpassworded TeleConference lines and numerous other interesting things. ############## Where to start ############## Wardialing is the process of scanning a large range of numbers and finding interesting things, as I have already stated. There are literally thousands of Carrier Tones in England which all perform different tasks and are owned by different companies. For example - Banks (yes BANKS, hehe), Libraries (delete those excess fines) Local Government (piss off your council) ..and loads more big companies and organisations. It may sound like a little movie-style picture of hacking (WARGAMES comes to mind) but its REAL, it does exist and people do mess with this sort of thing, hehe. Certain Carrier tones can also be abused and be setup so that you can connect perfectly to the Internet which will result, if the carrier is located within a FREE CALL netw0rks, in an 0800 dialup. People tend to mainly wardial for carrier tones but VMBs and PBXs can be found by Wardialing as well, so wardialing provides a great use for Phreaks who are interestedin these things. Although I personally haven't found an PBX while wardialing for about 6 months but, someone, somewhere will no doubt be finding one and abusing one as I type. VMBs are common findings while wardialing, especially on FREE CALL netw0rks and I have great phun with these. The 0800/0500 Service Network numbers, which are of course FREE, are the best place to start wardialing due to the LARGE percentage of businesses who have carriers, VMBs, PBXs etc. located on them, to transfer data or talk from area to area at low cost (only rental and cost of 0800 number). It is also a lot safer to wardial than normal area codes because you will not be dialing peoples houses, so you can dial 0800/0500 numbers at night and not be waking people up (not that I care, its just that they might report the wardialing call to BT as a nuisance call). These are phone which are great for a laugh so try them. U can ..... direct for blue boxing ________________ |0500 123 numbers| |________________| 0500 123 000 - answerphone 0500 123 001 - hmmmm weird rings once, picks up then nowt. 0500 123 123 - Vodafone information centre 0500 123 126 - Answer phone Newlife sales line 0500 123 200 - Rank Xerox 0500 123 246 - Sum guy picks up "HELLO!" 0500 123 258 - Engaged - Try later. 0500 123 300 - The number you have dialed has not been recognised, please try again. 0500 123 312 - Axin telecom asks for card number and pin!!! 0500 123 333 - guy says hello summit service, could be card service!" 0500 123 345 - Security print 123 369 - rings 123 400 - Mercury! 0500 123 423 - Rings 123 424 - Best Events (answerphone) 0500 123 433 - Static security services (answerphone) 0500 123 434 - Seaboard Home Designs (answerphone) 0500 123 438 - Britanic Security Systems (answerphone) 0500 123 439 - Someone Finance 0500 123 444 - err muffled Miss Speaker! 0500 123 450 - Murphys (could be the beer!!) 0500 123 454 - Someones Morgan shop 0500 123 455 - hello Clark i think 0500 123 486 - Carerra Technology sales * for next menu not sure. 0500 123 505 - Paradise Cars 0500 123 534 - Breakaway 0500 123 567 - United taxis 0500 123 579 - health place?? When press anything message stops playing. get a high pitched 0500 123 626 - Transit/Transfer? beep at start. VMB?? 0500 123 636 - Cordif moor?!!?!?! 0500 123 646 - CCL express (answer phone) 0500 123 663 - Mobility express (answerphone) 0500 123 666 - Freelys 0500 123 684 - Royal Insurance 0500 123 700 - Sum health place. Weird though, changes ringing sounds! 0500 123 786 - Trade Systems (answer phone) 0500 123 828 - Seaboard Elictricity (Answerphone) ________________ |0800-000 numbers| |________________| 0800 000-000 Pretential 0800 000-010 Dynas International 0800 000-013 Pampers-Get Free Pampers 0800 000-017 Pampers-Get a free pampers video 0800 000-024 Some VMB 0800 000-030 National Somthin 0800 000-045 Liverpool Victoria 0800 000-077 Dialfone 0800 000-080 Phone Providence?? 0800 000-111 Greenflag Add 12 to the end of it 0800 000-123 GM Card 0800 000-222 Predencal 0800 000-321 Predencal 0800 000-333 Abbey National 0800 000-365 Co Op Bank 0800 000-400 Compuserve help line 0800 000-500 Q9 Brochure Line?? 0800 000-505 SOS 0800 000-555 Soomethin weird 0800 000-600 Somethin to with Mastercard 0800 000-777 Somthin Independent 0800 000-800 VMB - Press # to stop recording, then 68 0800 000-929 Barclays Mortgages 0800 000-999 Dyna Services ________________ |0800 282 numbers| |________________| 0800 282-015 Some Thick as Shit cow 0800 282-022 Littlewoods 0800 282-039 Liverpool Victoria 0800 282-141 Contintal Reservations 0800 282-171 Intagra (??) 0800 282-177 Pontra and Gamble (they own ARIEL) 0800 282-193 Employies for somethin 0800 282-203 Pokta Number Skoty?? 0800 282-308 Morton Security 0800 282-345 Abbey National 0800 282-460 A Security company 0800 282-543 Bupa Roading 0800 282-568 TNT Parcel Carriers 0800 282-591 Daily Mail Newsdesk 0800 282-611 Somethin Cars 0800 282-652 NSU 0800 282-664 Shroders 0800 282-699 Something Internatioal Services 0800 282-709 Buepa 0800 282-717 AE Music company 0800 282-726 VMB 0800 282-727 VMB - BT! 0800 282-737 BBC News 0800 321 144 - Some resturant that tells u the menu This was a bunch of numbers i was given i cannot be bothered to check them all 413-000-Korean Airlines 413-002-Lifeline 413-003-A wiered answering machine 413-010-Somthin Helpline then it ends with MOTZART 413-021-Press 12 and u enter VMB 413-026-Acedamy 413-031 ??? Transport 413-037 Tells u to redial 413-044 Direct Line Glass Line 413-065 Alganic Somethin 413-068 Central Control 413-072 Did,nt catch the name 413-073 John Heath 413-094 The number has changed 413-108 Yellow Page 413-112 Watson Personal Finance Limited 413-135 Somethin Traders 413-140 TTC European Headquarters 413-144 Some Office 413-157 I did a brill hoax call on these guys 413-166 Costal Services 413-168 ??? 413-172 Sergicial Supplies 413-186 Pep Direct or somethin like that 413-187 Bob,s Cab 413-190 Bob,s Cars ?? 413-193 Somethin district council 413-200 Livetot or somethin like that 413-215 Some Spanish Person 413-243 Personal Advisory 413-244 Some Deaf wanka 413-250 Starline 413-252 Deluxe Drink 413-253 Simons Cabs 413-262 Drive Protect 413-264 Amedis is not there! 413-279 Somethin dunno what 413-280 ANSWERING MACHINE 413-287 ANSWERING MACHINE 413-290 VOICE 413-300 Someguys Ansafone and u can hear the messages 413-307 Some stupid girl 413-313 To Rank Service Technical number 413-332 There was no answer 413-346 Services Direct 413-353 AA There is some 3 digit code u need to enter somethin 413-358 CNA Motoring Services 413-365 TTC Health Care 413-381 Birminghams Traders Association 413-390 Hasting Direct 413-428 Some Very queer idiot 413-431 The Insurance Service-When i foned the office was evacuated due to an emergency HAHAHAHA 413-434 Some answerin machine with a slow talka 413-435 T.N.T. 413-437 ANSWERING MACHINE 413-444 ANSWERING MACHINE 413-445 ANSWERING MACHINE 413-450 ANSWERING MACHINE 413-453 ANSWERING MACHINE 413-462 ANSWERING MACHINE 413-468 ANSWERING MACHINE 413-476 VOICE 413-478 ANSWERING MACHINE 413-480 ANSWERING MACHINE 413-485 ANSWERING MACHINE 413-488 ANSWERING MACHINE 413-494 VMB 413-496 VOICE 413-497 ANSWERING MACHINE 413-503 ANSWERING MACHINE 413-509 VOICE 413-510 ANSWERING MACHINE 413-512 ANSWERING MACHINE 413-514 VOICE 413-518 ANSWERING MACHINE 413-521 VOICE 413-523 ANSWERING MACHINE 413-526 VOICE 413-527 ANSWERING MACHINE 413-528 ANSWERING MACHINE 413-530 ANSWERING MACHINE 413-532 ANSWERING MACHINE 413-538 ANSWERING MACHINE 413-539 ANSWERING MACHINE 413-543 ANSWERING MACHINE 413-546 ANSWERING MACHINE 413-555 VOICE 413-557 ANSWERING MACHINE 413-558 ANSWERING MACHINE 413-563 VOICE 413-565 ANSWERING MACHINE 413-567 ANSWERING MACHINE 413-568 ANSWERING MACHINE 413-571 VOICE 413-572 VOICE 413-573 VOICE 413-577 ANSWERING MACHINE 413-590 ANSWERING MACHINE 413-598 ANSWERING MACHINE 413-600 ANSWERING MACHINE 413-605 ANSWERING MACHINE 413-606 ANSWERING MACHINE 413-610 VOICE 413-612 ANSWERING MACHINE 413-616 VOICE 413-617 VOICE 413-618 NEW NUMBER 413-619 VOICE 413-623 VOICE 413-626 VOICE 413-627 ANSWERING MACHINE 413-628 VOICE 413-634 ANSWERING MACHINE 413-635 ANSWERING MACHINE 413-638 ANSWERING MACHINE 413-647 VOICE 413-649 ANSWERING MACHINE 413-650 VOICE 413-651 ANSWERING MACHINE 413-652 ANSWERING MACHINE 413-668 ANSWERING MACHINE 413-669 ANSWERING MACHINE 413-673 VOICE 413-682 VOICE 413-683 ANSWERING MACHINE 413-686 ANSWERING MACHINE 413-691 ANSWERING MACHINE 413-693 ANSWERING MACHINE 413-694 VOICE 413-695 ANSWERING MACHINE 413-698 ANSWERING MACHINE 413-700 ANSWERING MACHINE 413-701 VOICE 413-702 ANSWERING MACHINE 413-703 VOICE 413-708 ANSWERING MACHINE 413-710 VOICE 413-714 VOICE 413-715 ANSWERING MACHINE - "Please enter your security code" 5 Digits 413-718 ANSWERING MACHINE 413-719 VOICE 413-725 VOICE 413-727 VOICE 413-728 VOICE 413-730 ANSWERING MACHINE 413-735 ANSWERING MACHINE 413-736 VOICE 413-739 ANSWERING MACHINE 413-740 VOICE 413-743 VOICE 413-750 ANSWERING MACHINE 413-751 ANSWERING MACHINE 413-753 ANSWERING MACHINE 413-754 ANSWERING MACHINE - Wierd tones 413-755 ANSWERING MACHINE 413-759 ANSWERING MACHINE 413-761 VOICE 413-763 ANSWERING MACHINE 413-764 VOICE 413-767 VOICE 413-768 VOICE 413-771 ANSWERING MACHINE 413-774 ANSWERING MACHINE 413-778 VOICE 413-781 ANSWERING MACHINE 413-787 ANSWERING MACHINE 413-793 ANSWERING MACHINE 413-794 VOICE 413-795 VOICE 413-796 VOICE 413-797 ANSWERING MACHINE 413-800 NEW NUMBER 413-801 ANSWERING MACHINE 413-804 VOICE 413-810 VOICE 413-812 VOICE 413-815 ANSWERING MACHINE 413-816 VOICE 413-824 ANSWERING MACHINE 413-827 VOICE 413-829 VOICE 413-830 VOICE 413-834 VOICE 413-838 ANSWERING MACHINE 413-843 VOICE 413-845 VOICE 413-846 VOICE 413-848 VOICE 413-850 ANSWERING MACHINE 413-859 VOICE 413-860 VOICE 413-862 ANSWERING MACHINE 413-863 ANSWERING MACHINE 413-864 VOICE 413-865 VMB 413-867 ANSWERING MACHINE 413-871 ANSWERING MACHINE 413-874 VOICE 413-875 ANSWERING MACHINE 413-876 VOICE 413-877 ANSWERING MACHINE 413-879 VOICE 413-880 ANSWERING MACHINE 413-881 voice 413-887 VOICE 413-888 ANSWERING MACHINE 413-891 VOICE 413-892 ANSWERING MACHINE 413-895 VOICE 413-896 ANSWERING MACHINE 413-901 ANSWERING MACHINE 413-904 VOICE 413-906 VOICE 413-907 ANSWERING MACHINE 413-912 VOICE 413-914 ANSWERING MACHINE 413-916 ANSWERING MACHINE 413-921 VOICE 413-922 ANSWERING MACHINE 413-924 VOICE 413-927 ANSWERING MACHINE 413-933 ANSWERING MACHINE 413-935 ANSWERING MACHINE 413-938 ANSWERING MACHINE 413-944 ANSWERING MACHINE 413-951 ANSWERING MACHINE 413-952 VOICE 413-961 VOICE 413-966 ANSWERING MACHINE 413-968 Limo Service 413-990 Some stupid thick twat 413-998 Some selfish cow If you are lookin for country direct in this section u will find them in Blue Boxing section 0800 890 043 In german goes on about operator 0800 890 178 u speak to some freaky guy 0800 890 066 i think it some thailand company 0800 890 051 Some Spanish Phone Company 0800 890 056 A good intro and a spanish women talkin in a sexy voice 0800 890 052 Another spanish speakin company 0800 890 048 Some weired foreign person 0800 890 150 Some company, call outside bussiness hours u get some machine dial 12 and wait for some phun 0800 890 055 Portugese company, speak in English it will tell u to fone your local operator 0800 890 027 Voice (?) (Used to be South Africa direct ?) 0800 890 038 Voice (?) 0800 890 042 Voice (?) 0800 890 100 Voice (Japan?) 0800 890 268 Voice (???) 0800 890 357 Operator of something 0800 890 443 Door Bell - Then message. 0800 890 448 Guard House (?) 0800 890 456 Phone USA TRT 0800 890 598 Voice (Wierd) 0800 890 633 Voice (?) 0800 890 640 K radio assistance (?) 0800 890 650 Singapore Telecom Service. 0800 890 802 GTE Hawaia 0800 890 820 Voice (?) 0800 890 877 USA Sprint Express 0800 890 972 Voice (French) Ok heres a list of numbers that u can check out your self. You have to dial 0800 in front of the number. I got them from some site. Try them 0800 456-600 ANSWERING MACHINE - Monkey World! (Theme Park) 0800 456-345 VOICE - BT! 0800 456-000 VOICE - Auto Windscreens 0800 456-100 ANSWERING MACHINE - BT Number Translation Services! 0800 567-100 ANSWERING MACHINE 0800 567-123 VOICE - National AIDS Helpline 0800 567-247 VMB - Press ##81 0800 567-283 VMB - Press 0#81 (# stops recording) 0800 567-287 VOICE 0800 567-567 VOICE 0800 567-568 VOICE - Premium Search Quote Line, puts you on hold 0800 567-686 VOICE - Answering machine during the day 0800 567-777 ANSWERING MACHINE 0800 567-800 VOICE - Prospero Direct 0800 567-899 ANSWERING MACHINE - RESPONDS TO KEYPRESSES 0800 567-900 VOICE - "Can I take your order please?" <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< COUNTRY | CODE | ------- |---- | | ALGERIA | 213 ------------------ AM. SAMOA | 684 ------------------ ANDORRA | 33 ------------------ ARGENTINA | 54 ------------------ ATLANTIC OC. | 871 ------------------ AUSTRALIA | 61 ------------------ AUSTRIA | 43 ------------------ BAHRAIN | 873 ------------------ BELGIUM | 32 ------------------ BELIZE | 501 ------------------ BOLIVIA | 591 ------------------ BRAZIL | 55 ------------------ CAMEROON | 237 ------------------ CHILE | 56 ------------------ COLUMBIA | 57 ------------------ COSTA RICA | 506 ------------------ CYPRUS | 357 ------------------ CZECHOSLOVAKIA 42 ------------------ DENMARK | 45 ------------------ ECUADOR | 593 ------------------ EGYPT | 20 ------------------ EL SALVADOR | 503 ------------------ ETHIOPIA | 251 ------------------ FIJI | 679 ------------------ FINLAND | 358 ------------------ FRANCE | 33 ------------------ GABON | 241 ------------------ GERMANY | 49 ------------------ GREECE | 30 ------------------ GUAM | 671 ------------------ GUATEMALA | 502 ------------------ GUYANA | 592 ------------------ HAITI | 509 ------------------ HONDURAS | 504 ------------------ HONG KONG | 852 ------------------ HUNGARY | 36 ------------------ ICELAND | 354 ------------------ INDIA | 91 ------------------ INDIAN OC. | 873 ------------------ INDONESIA | 62 ------------------ IRAN | 98 ------------------ IRAQ | 964 ------------------ IRELAND | 353 ------------------ ISRAEL | 972 ------------------ ITALY | 39 ------------------ IVORY COAST | 225 ------------------ JAPAN | 81 ------------------ JORDAN | 962 ------------------ KENYA | 254 ------------------ KOREA | 82 ------------------ KUWAIT | 965 ------------------ LIBERIA | 231 ------------------ LIBYA | 218 ------------------ LIECHTENSTEIN| 41 ------------------ LUXEMBOURG | 352 ------------------ MALAWI | 265 ------------------ MALAYSIA | 60 ------------------ MEXICO | 522 ------------------ MONACO | 33 ------------------ MOROCCO | 212 ------------------ NAMIBIA | 264 ------------------ NETHERLANDS | 31 ------------------       !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~NEW | 687 ------------------ NEW ZEALAND | 64 ------------------ NICARAGUA | 505 ------------------ NIGERIA | 234 ------------------ NORWAY | 47 ------------------ OMAN | 968 ------------------ PACIFIC OC. | 872 ------------------ PANAMA | 507 ------------------ PAKISTAN | 92 ------------------ PAPUA NEW | GUINEA | 675 ------------------ PARAGUAY | 595 ------------------ PERU | 51 ------------------ PHILIPPINES | 63 ------------------ POLAND | 48 ------------------ PORTUGAL | 351 ------------------- QATAR | 974 ------------------ ROMANIA | 40 ------------------ SAIPAN | 670 ------------------ SAN MARINO | 39 ----------------- SAUDI ARABIA | 966 ----------------- SENEGAL | 221 ----------------- SINGAPORE | 65 ---------------- SOUTH AFRICA | 27 ---------------- SPAIN | 34 ---------------- SRI LANKA | 94 ---------------- SURINAME | 597 ---------------- SWEDEN | 46 ---------------- SWITZERLAND | 41 ---------------- TAIWAN | 886 ---------------- THAILAND | 66 ---------------- TUNISIA | 216 ---------------- TURKEY | 90 ---------------- UNITED ARAB | EMIRATES | 971 ---------------- UNITED | KINGDOM | 44 ---------------- URUGUAY | 598 ---------------- VATICAN CITY | 39 ---------------- VENEZUELA | 58 ---------------- YEMEN (AR) | 967 ---------------- YUGOSLAVIA | 38 ---------------- Dialcodes of the U.K. Right here are another set of codes but for the UK +44 UK0 0113 Leeds 0114 Sheffield 0115 Nottingham 0116 Leicester 0117 Bristol 0118 Reading 01200 Clitheroe 01202 Bournemouth 01203 CoventryNuneaton 01204 Bolton 01205 Boston 01206 Colchester 01207 Co. Durham 01208 Bodmin 01209 Cornwall 0121 Birmingham 01222 Cardiff 01223 Cambridge 01224 Aberdeen 01225 Bath 01227 Canterbury 01228 Carlisle 01229 Barrow in Furness 01232 Greater Belfast 01233 Ashford (Kent) 01234 Bedford 01235 Abingdon 01236 CoatbridgeAirdrie 01237 Devon 01238 Co.Down Saintfield Downpatrick 01239 Cardigan 01241 Angus 01242 Cheltenham 01243 Chichester 01244 Chester 01245 Chelmsford 01246 Chesterfield 01247 Bangor 01248 Bangor 01249 Chippenham 01250 Blairgowrie 01252 Aldershot 01253 Blackpool 01254 Blackburn 01255 Clacton-on-SeaHarwich 01256 Basingstoke 01257 Chorley 01258 Dorset 01259 Clackmannanshire 01260 Congleton 01261 Banff 01262 Bridlington 01263 Cromer 01264 Andover 01265 Coleraine 01266 Ballymena 01267 Carmarthen 01268 Basildon 01269 Ammanford 01270 Crewe 01271 BarnstapleIlfracombe 01273 Brighton 01274 Bradford 01275 North Somerset 01276 Camberley 01277 Brentwood 01278 Bridgwater 01279 Bishops StortfordHarlow, Stansted 01280 Buckingham 01282 Burnley 01283 Burton-upon-Trent 01284 Bury St Edmunds 01285 Cirencester 01286 Caernarfon 01287 Cleveland 01288 Bude 01289 Berwick-on-Tweed 01290 East Ayrshire 01291 Chepstow 01292 Ayr 01293 CrawleyGatwick 01294 North Ayrshire 01295 Banbury 01296 Aylesbury 01297 Axminster 01298 Buxton 01299 Worcestershire 01300 Dorset 01301 Argyll 01302 Doncaster 01303 Folkestone 01304 Dover 01305 DorchesterWeymouth 01306 Dorking 01307 Forfar 01308 Dorset 01309 Moray 0131 Edinburgh 01320 Highland 01322 Dartford 01323 Eastbourne 01324 Falkirk 01325 Darlington 01326 Falmouth 01327 Daventry 01328 Norfolk 01329 Hampshire 01330 Deeside 01332 Derby 01333 Fife 01334 Fife 01335 Derbyshire 01337 Fife 01339 Deeside 01340 Moray 01341 Barmouth 01342 East Grinstead 01343 Elgin 01344 BracknellAscot 01346 Aberdeenshire 01347 North Yorkshire 01348 Fishguard 01349 Highland 01350 Perth & Kinross 01352 Flintshire 01353 Cambridgeshire 01354 Cambridgeshire 01355 East Kilbride 01356 Angus 01357 South Lanarkshire 01358 Aberdeenshire 01359 West Suffolk 01360 Stirling/East Dunbartonshire 01361 Scottish Borders 01362 Norfolk 01363 Devon 01364 Devon 01365 Enniskillen 01366 Norfolk 01367 Faringdon 01368 East Lothian 01369 Dunoon 01371 Essex 01372 Esher 01373 Frome 01375 Essex 01376 Braintree 01377 East Yorkshire 01379 Diss 01380 Devizes 01381 Highland 01382 Dundee 01383 Dunfermline 01384 Dudley 01386 Evesham 01387 Dumfries 01388 Bishop Auckland 01389 Dumbarton 01392 Exeter 01394 Felixstowe 01395 Exmouth 01396 Downpatrick Ballynahinch 01397 Fort William 01398 Devon/Somerset 01399 UK$$ 01400 Lincolnshire 01403 Horsham 01404 Devon 01405 Goole 01406 Lincolnshire 01407 Holyhead 01408 Highland 01409 Devon 0141 Glasgow 01420 Hampshire 01422 Halifax 01423 Harrogate 01424 Hastings 01425 Hampshire 01427 Gainsborough 01428 Haslemere 01429 Hartlepool 01430 East Yorkshire 01431 Highland 01432 Hereford 01433 Derbyshire 01434 Hexham 01435 East Sussex 01436 Helensburgh 01437 Haverfordwest 01438 Stevenage 01439 North Yorkshire 01440 West Suffolk 01442 Hemel Hempstead 01443 Pontypridd 01444 Haywards Heath 01445 Highland 01446 Vale of Glamorgan 01449 East Suffolk 01450 Hawick 01451 Gloucestershire 01452 Gloucester 01453 Gloucestershire 01454 Bristol 01455 Hinckley 01456 Highland 01457 Glossop 01458 Glastonbury 01459 UK$$ 01460 Somerset 01461 Dumfries & Galloway 01462 HitchinLetchworth 01463 Inverness 01464 Aberdeenshire 01465 South Ayrshire 01466 Aberdeenshire 01467 Aberdeenshire 01469 North Lincolnshire 01470 Isle of Skye 01471 Isle of Skye 01472 Grimsby 01473 Ipswich 01474 Gravesend 01475 GreenockPort Glasgow, Isle of Cumbrae 01476 Grantham 01477 Cheshire 01478 Isle of Skye 01479 Grantown-on-SpeyAviemore 01480 Huntingdon 01481 GUERNSEY 0148182 Alderney 0148183 Sark 01482 Hull 01483 Guildford 01484 Huddersfield 01485 Norfolk 01487 Cambridgeshire 01488 Hungerford 01489 Southampton 01490 Denbighshire 01491 Henley-on-Thames 01492 Colwyn BayLlandudno 01493 Great Yarmouth 01496 Isle of IslayIsle of Jura 01497 Hay on Wye 01499 Inveraray 01501 West Lothian/Lanarkshire 01502 Lowestoft 01503 Looe 01504 Londonderry 01505 Johnstone 01506 Bathgate 01507 Louth 01508 Norfolk 01509 Loughborough 0151 Liverpool 01520 Highland 01522 Lincoln 01523 UK$$ 01524 LancasterMorecambe 01525 Leighton Buzzard 01526 Lincolnshire 01527 RedditchBromsgrove 01528 Highland 01529 Sleaford 01531 Malvern Hills 01534 JERSEY 01535 Keighley 01536 KetteringCorby 01538 Leek 01539 Kendal 015394 Windermere 01540 Highland 01542 Moray 01543 Lichfield 01544 Kington (Herefordshire) 01545 Aberaeron 01546 Argyll 01547 Knighton (Powys) 01548 DevonLairg 01550 Carmarthenshire 01553 King's Lynn 01554 Llanelli 01555 Lanark 01556 Dumfries & Galloway 01557 Dumfries & Galloway 01558 Carmarthenshire 01559 Carmarthenshire 01560 East Ayrshire 01561 Aberdeenshire 01562 Kidderminster 01563 Kilmarnock 01565 Knutsford 01566 Launceston 01567 Stirling 01568 Leominster 01569 Aberdeenshire 01570 Lampeter 01571 Highland 01572 Oakham 01573 Scottish Borders 01574 Larne 01575 Angus 01576 Dumfries & Galloway 01577 Kinross 01578 Scottish Borders 01579 Cornwall 01580 East Sussex/Kent 01581 Dumfries & Galloway 01582 Luton 01583 Kintyre 01584 Ludlow 01586 Kintyre 01588 Shropshire 01590 Hampshire 01591 Powys 01592 Kirkcaldy 01593 Highland 01594 Gloucestershire 01595 Shetland 01597 Llandrindod Wells 01598 Devon 01599 Kyle of Lochalsh 01600 Monmouth 01603 Norwich 01604 Northampton 01606 Northwich 01608 Cotswolds 01609 North Yorkshire 0161 Manchester 016162 Oldham 01620 East Lothian 01621 Essex 01622 Maidstone 01623 Mansfield 01624 ISLE OF MAN 016246 Douglas 01625 Macclesfield 01626 Newton Abbot 01628 Maidenhead 01629 Matlock 01630 Shropshire 01631 Oban 01633 Newport (Gwent)Cwmbran 01634 Medway (Kent)Chatham 01635 Newbury 01636 Newark 01637 Newquay 01638 Newmarket 01639 NeathPort Talbot 01641 Highland 01642 Middlesbrough 01643 Minehead 01644 Dumfries & Galloway 01646 Milford Haven 01647 Devon 01648 Magherafelt 01650 Machynlleth 01651 Aberdeenshire 01652 North Lincolnshire 01653 North Yorkshire 01654 Machynlleth 01655 South Ayrshire 01656 Bridgend 01659 Dumfries & Galloway 01661 Northumberland 01662 Omagh 01663 Derbyshire 01664 Melton Mowbray 01665 Northumberland 01666 Malmesbury 01667 Nairn 01668 Northumberland 01669 Northumberland 01670 Northumberland 01671 Dumfries & Galloway 01672 Marlborough 01673 Lincolnshire 01674 Montrose 01675 Birmingham 01676 Coventry 01677 North Yorkshire 01678 Bala 01680 Isle of Mull 01681 Isle of MullIona 01683 Dumfries & Galloway 01684 Great Malvern 01685 Merthyr Tydfil 01686 Newtown 01687 Mallaig 01688 Isle of Mull 01689 Orpington 01690 Betws-y-Coed 01691 Oswestry 01692 Norfolk 01693 Newry 01694 Shropshire 01695 Ormskirk 01697 Cumbria 01698 MotherwellHamilton 01700 Isle of Bute 01702 Southend-on-Sea 01703 Southampton 01704 Southport 01705 Portsmouth 01706 Rochdale 01707 Potters BarHatfield, Welwyn Garden 01708 Romford 01709 Rotherham 0171 inner London 01720 Isles of Scilly 01721 Peebles 01722 Salisbury 01723 Scarborough 01724 Scunthorpe 01725 Salisbury 01726 St Austell 01727 St Albans 01728 East Suffolk 01729 North Yorkshire 01730 Hampshire 01732 Sevenoaks 01733 Peterborough 01734 Reading 01736 Penzance 01737 RedhillReigate 01738 Perth 01740 Co. Durham 01743 Shrewsbury 01744 St Helens 01745 RhylPrestatyn 01746 Shropshire 01747 Shaftesbury 01748 North Yorkshire 01749 Shepton Mallet 01750 Selkirk 01751 North Yorkshire 01752 Plymouth 01753 SloughWindsor 01754 Skegness 01756 Skipton 01757 North Yorkshire 01758 Pwllheli 01759 East Yorkshire 01760 Norfolk 01761 North East Somerset 01762 Portadown 01763 Hertfordshire 01764 Perth & Kinross 01765 Ripon 01766 PorthmadogHarlech 01767 Bedfordshire 01768 Penrith 017687 Keswick 01769 Devon 01770 Isle of Arran 01772 Preston 01773 Ripley 01775 Spalding 01776 Stranraer 01777 Retford 01778 Lincolnshire 01779 Aberdeenshire 01780 Stamford 01782 Stoke-on-TrentNewcastle-under-Lyme 01784 Staines 01785 Stafford 01786 Stirling 01787 Sudbury (Suffolk) 01788 Rugby 01789 Stratford-upon-Avon 01790 Lincolnshire 01792 Swansea 01793 Swindon 01794 Hampshire 01795 Kent 01796 Pitlochry 01797 Rye 01798 West Sussex 01799 Essex 01803 Torquay 01805 Devon 01806 Shetland 01807 Moray 01808 Inverness 01809 Highland 0181 outer London 01820 Co. Down 01821 Perth 01822 Devon 01823 Taunton 01824 Denbighshire 01825 East Sussex 01827 Tamworth 01828 Perth & Kinross 01829 Cheshire 01830 Northumberland 01832 Oundle 01833 Teesdale (Co. Durham) 01834 Tenby 01835 Scottish Borders 01837 Devon 01838 Stirling/Argyll 01840 Cornwall 01841 Cornwall 01842 Thetford 01843 ThanetMargate, Ramsgate 01844 Thame (Oxfordshire) 01845 North Yorkshire 01846 Lisburn 01847 Thurso 01848 Dumfries & Galloway 01849 Antrim 01851 Isle of Lewis 01852 Argyll 01854 Highland 01855 Fort William 01856 Kirkwall 01857 north Orkney 01858 Market Harborough 01859 Isle of Harris 01861 Armagh 01862 Highland 01863 Highland 01864 South Lanarkshire 01865 Oxford 01866 Argyll 01868 Co. Tyrone 01869 Bicester 01870 Isle of Benbecula 01871 Isle of Barra 01872 Truro 01873 Abergavenny 01874 Brecon 01875 Lothian 01876 Isle of North Uist 01877 Callander 01878 Isle of South Uist 01879 Isle of TireeIsle of Coll 01880 Argyll 01882 Perth & Kinross 01883 Surrey 01884 Devon 01885 Herefordshire 01886 Worcestershire 01887 Perth & Kinross 01888 Aberdeenshire 01889 Uttoxeter 01890 Scottish Borders 01892 Tunbridge Wells 01893 UK$$ 01895 Uxbridge 01896 Galashiels 01899 Biggar 01900 Workington 01902 Wolverhampton 01903 Worthing 01904 York 01905 Worcester 01908 Milton Keynes 01909 Worksop 0191 NENewcastle, Sunderland, Durham 01912 north TynesideNewcastle 01913 Durham 01914 south TynesideGateshead 01915 WearsideSunderland 01920 Ware 01922 Walsall 01923 Watford 01924 Wakefield 01925 Warrington 01926 Leamington SpaWarwick 01928 Runcorn 01929 Dorset 01931 Cumbria 01932 Weybridge 01933 Wellingborough 01934 Weston-super-Mare 01935 Yeovil 01937 Wetherby 01938 Welshpool 01939 Shropshire 01942 Wigan 01943 West Yorkshire 01944 North Yorkshire 01945 Wisbech 01946 Whitehaven 01947 Whitby 01948 Whitchurch (Shropshire) 01949 Nottingham 01950 Shetland 01951 Isle of Colonsay 01952 Telford 01953 Norfolk 01954 Cambridge 01955 Wick 01957 Shetland 01959 Kent 01960 Co. Antrim 01962 Winchester 01963 Dorset/Somerset 01964 East Yorkshire 01967 Argyll 01968 Midlothian 01969 Wensleydale 01970 Aberystwyth 01971 Highland 01972 Argyll 01974 Ceredigion 01975 Aberdeenshire 01977 Pontefract 01978 Wrexham 01980 Wiltshire 01981 South Herefordshire 01982 Powys 01983 Isle of WightNewport, Ryde 01984 Somerset 01985 Wiltshire 01986 East Suffolk 01988 Dumfries & Galloway 01989 Herefordshire 01992 HoddesdonEpping, Hertford 01993 Witney 01994 Carmarthenshire 01995 Lancashire 01997 Highland 04325 Bt Easyreach 0408 Cellnet 0401 Cellnet 0410 Cellnet 0402 Cellnet 0411 Cellnet 0585 Cellnet 0802 Cellnet 0589 Cellnet 0850 Cellnet 0860 Cellnet 0370 Vodaphone 0385 Vodaphone 0321 Vodaphone 0467 Vodaphone 0374 Vodaphone 0468 Vodaphone 0378 Vodaphone 0469 Vodaphone 0390 Vodaphone 0421 Vodaphone 0441 Vodaphone 0831 Vodaphone 0836 Vodaphone 0456 Orange 0941 Orange 0966 Orange 0973 Orange 0976 Orange ------------------------------------------------------------------------ COST OF CALLS IN UK RATE | Applies to calls made... | Daytime | Monday to Friday, 8am to 6pm The most expensive Costs 3p approx a minute | Evening & | Monday to Friday before 8am The second cheapest and exspensive | night time | and after 6pm Cost 1.5p approx a minute | weekend | Midnight Friday to Midnight Sunday The cheapest Costs 1p approx a minute | ------------------------------------------------------------------------ There are five main categories that relate to the distance covered by your call. CATEGORY APPLIES TO CALL MADE TO NUMBERS Local Within your own or neighbouring charge areas and to numbers preifxed by area codes such as 01473 Regional Outside your local area, up to 56.4km (approx 35 miles) away and within UK National Over 56.4km away and within the UK. International Outside the UK, including Ireland. Calls to Nothern Ireland are charged at UK rates. Each country has a specific charge rate. Other Within the UK but charged independently of distance. Service charges that may apply to your call and a list of the different codes which indicate specific services. PHREKERS MINI ENCYCLOPEDIA This a very basic mini encyclopedia on phreaking that i made my self ACD: Automatic Call Distributor - A system that automatically distributes calls to operator pools (providing services such as intercept and directory assistance), to airline ticket agents, etc. Administration: The tasks of record-keeping, monitoring, rearranging, prediction need for growth, etc. AIS: Automatic Intercept System - A system employing an audio-response unit under control of a processor to automatically provide pertinent info to callers routed to intercept. Alert: To indicate the existence of an incoming call, (ringing). ANI: Automatic Number Identification - Often pronounced "Annie," a facility for automatically identify the number of the calling party for charging purposes. Appearance: A connection upon a network terminal, as in "the line has two network appearances." AT&T [American Telephone and Telegraph]- Originally American Bell Telephone, the company that started the telephone. It was bought and, under the tutelage of another huge company, became a monopolous phone provider. The Microsoft of the Seventies and early Eighties. It was broken up by the justice department in 1982, which created lots of little baby RBOCS. In 1990 their phone network crashed temporarily, which got them into a lot of trouble, but since then they've been doing pretty well. Attend: The operation of monitoring a line or an incoming trunk for off-hook or seizure, respectively. Audible: The subdued "image" of ringing transmitted to the calling party during ringing; not derived from the actual ringing signal in later systems. Backbone Route: The route made up of final-group trunks between end offices in different regional center areas. BHC: Busy Hour Calls - The number of calls placed in the busy hour. Blocking: The ratio of unsuccessful to total attempts to use a facility; expresses as a probability when computed a priority. Blocking Network: A network that, under certain conditions, may be unable to form a transmission path from one end of the network to the other. In general, all networks used within the Bell Systems are of the blocking type. Blue Box- Infamous box that pretty much no longer works (though it still does in certain areas), but kicked ass in the 1960s, Seventies and Eighties. It is a device that plays a sound at a frequency of 2600 hertz, which allows a phreak to control a phone trunk and make free world-wide phone calls. BORSCHT Circuit: A name for the line circuit in the central office. It functions as a mnemonic for the functions that must be performed by the circuit: Battery, Overvoltage, Ringing, Supervision, Coding, Hybrid, and Testing. British Telecom- Also known as BT for short.One of the most easist telephone to phreak of all time. They are are also one of the most stingist and most pathetic fone companies there is. Busy Signal: (Called-line-busy) An audible signal which, in the Bell System,comprises 480hz and 620hz interrupted at 60IPM. Bylink: A special high-speed means used in crossbar equipment for routing calls incoming from a step-by-step office. Trunks from such offices are often referred to as "bylink" trunks even when incoming to noncrossbar offices; they are more properly referred to as "dc incoming trunks." Such high-speed means are necessary to assure that the first incoming pulse is not lost. Cable Vault: The point which phone cable enters the Central Office building. CAMA: Centralized Automatic Message Accounting - Pronounced like Alabama. CCIS: Common Channel Interoffice Signaling - Signaling information for trunk connections over a separate, nonspeech data link rather that over the trunks themselves. CCITT: International Telegraph and Telephone Consultative Committee- An International committee that formulates plans and sets standards for intercountry communication means. CDO: Community Dial Office - A small usually rural office typically served by step-by-step equipment. CO: Central Office - Comprises a switching network and its control and support equipment. Occasionally improperly used to mean "office code." Cocot-Is a certain phone where u find in bars, hotels, restaruants etc. When u make a fone on it u charged more than a normal fone box beacause the owner of the box makes a profit from when u use them Commity Dial Office - A small usually rural office typically served byby-step equipment Central Office - Comprises a switching network and its control and support. Occasionally improperly used to mean "office code" [COmputer System for Mainframe OperationS]- Database program used by telcos to store information; staple of the elite phreaker; or at least it was. Centrex: A service comparable in features to PBX service but implemented with some (Centrex CU) or all (Centrex CO) of the control in the central office. In the later case, each station's loop connects to the central office. Customer Loop: The wire pair connecting a customer's station to the central office. DDD: Direct Distance Dialing - Dialing without operator assistance over the nationwide intertoll network. Direct Trunk Group: A trunk group that is a direct connection between a given originating and a given terminating office. EOTT: End Office Toll Trunking - Trunking between end offices in different toll center areas. ESB: Emergency Service Bureau - A centralized agency to which 911 "universal" emergency calls are routed. ESS: Electronic Switching System - A generic term used to identify as a class,stored-program switching systems such as the Bell System's No.1 No.2, No.3,No.4, or No.5. ETS: Electronic Translation Systems - An electronic replacement for the card translator in 4A Crossbar systems. Makes use of the SPC 1A Processor. False Start: An aborted dialing attempt. Fast Busy: (often called reorder) - An audible busy signal interrupted at twice the rate of the normal busy signal; sent to the originating station to indicate that the call blocked due to busy equipment. Final Trunk Group: The trunk group to which calls are routed when available high-usage trunks overflow; these groups generally "home" on an office next highest in the hierarchy. Full Group: A trunk group that does not permit rerouting off-contingent foreign traffic; there are seven such offices. Glare: The situation that occurs when a two-way trunk is seized more or less simultaneously at both ends. High Usage Trunk Group: The appellation for a trunk group that has alternate routes via other similar groups, and ultimately via a final trunk group to a higher ranking office. Intercept: The agency (usually an operator) to which calls are routed when made to a line recently removed from a service, or in some other category requiring another station, such as an Emergence Interrupt. Junctor: A wire or circuit connection between networks in the same office. The functional equivalent to an intraoffice trunk. MF: Multifrequency - The method of signaling over a trunk making use of the simultaneous application of two out of six possible frequencies. NPA: Numbering Plan Area. ONI: Operator Number Identification - The use of an operator in a CAMA office to verbally obtain the calling number of a call originating in an office not equipped with ANI. PBX: Private Branch Exchange - (PABX: Private Automatic Branch Exchange) A telephone office serving a private customer, Typically , access to the outside telephone network is provided. Permanent Signal: A sustained off-hook condition without activity (no dialing or ringing or completed connection); such a condition tends to tie up equipment, especially in earlier systems. Usually accidental, but sometimes used intentionally by customers in high-crime-rate areas to thwart off burglars. Phreak- Someone who abuses the phone system the way a hacker abuses computer networks. Also used by Rudy Rucker in his novels to refer to hobbyists who hack systems, as opposed to cryps, who do it for money or power. [From a combination of "phone" and "freak," which became "phreak." " Phreaker" is sometimes also used. POTS: Plain Old Telephone Service - Basic service with no extra "frills". ROTL: Remote Office Test Line - A means for remotely testing trunks. RTA: Remote Trunk Arrangement - An extension to the TSPS system permitting its services to be provided up to 200 miles from the TSPS site. SF: Single Frequency. A signaling method for trunks: 2600hz is impressed upon idle trunks. Supervise: To monitor the status of a call. : (Step-by-Step or Strowger switch) - An electromechanical office type utilizing a gross-motion stepping switch as a combination network and distributed control. Talkoff: The phenomenon of accidental synthesis of a machine-intelligible signal by human voice causing an unintended response. "whistling a tone". Telco [TELephone COmpany]- A corporation which sells a service that would be dirt cheap if it wasn't run by profiteering gluttons, i.e. telephone service. The largest (and until the early Eighties, only) telco is AT&T. Telephone- A device that allows one to speak to someone else through wires, long distance. It was created in 1876 and gained true widespread use in 1904. It has great potential for abuse, particularly to get around the insane charges telcos put on the phone that most people pay without question. (I mean really, what the fuck is an "area code"? It doesn't cost any more to the phone company to put me through to Borneo then it does to put me through to my neighbor.) While it was originally copper wires that carried voice, it has been increasing computerized and digitized. Trunk: A path between central offices; in general 2-wire for interlocal, 4-wire for intertoll. TSPS: Traffic Service Position System - A system that provides, under stored-program control, efficient operator assistance for toll calls. It does not switch the customer, but provides a bridge connection to the operator. X-bar: (Crossbar) - An electromechanical office type utilizing a "fine-motion" coordinate switch and a multiplicity of central controls (called markers). There are four varieties: No.1 Crossbar: Used in large urban office application; (1938) No 3 Crossbar: A small system started in (1974). No.4A/4M Crossbar: A 4-wire toll machine; (1943). No.5 Crossbar: A machine originally intended for relatively small suburban applications; (1948) Crossbar Tandem: A machine used for interlocal office switching. INFO ON BT Bt has to be one of the most meanist & dumbest fone companies in the world. For the financial year of 1994 BT made a pre-tax profit of 2 3/4 billion pounds and have sacked over 90 000 employees in the past 4 years. The largest profit margin ever recorded was for the 1991 financial year when BT made a pre-tax profit of over 3 billion pounds.In 1994, there were over 120 000 public payfones dotted around the country and BT spent a whopping 10 million GBP on the physical security of theirpayfones (and still managed to screw up)(DOH!!) After they spent the 10,000 grand on the security it was still just as easy. After reading all this u are prepared to take BT on totally wreak their phone boxes. Well thats all from me ISP POLICE hope u have fun, & if u get caught by BT say that AT&T have employed u to do this. See ya Websites on fone freaking http://www.geocities.com/SunsetStrip/Alley/7705 http://redcat.org.uk/~pteknik http://www.hackhull.com/phuk/ 2600 meets are held on the first friday of the month all over the world. After the initial meeting they generally move to a local pub/Pizza Hut/phone exchange :). Here in the UK they meet in following London-Next to the VR machines in The Trocadero. Starts 7:00pm-7:45pm Bristol-The payphones near the Almshouse pub (part of the Galleries). Starts 6:45pm to 7:00pm; Pay phone numbers are +44-(0)117-929-9011, 929-4437, 922-6897. Manchester-Meet at Cyberia Cafe, Oxford Road, at around 7pm. Email chase@webspan.net for more info Hull Meet in the Old Grey Mare, Cottingham Road, at around 7pm. First Friday of every month Email dcups@hackhull.com for more info or check out the hackHull web page. Leeds-Meet on the first Friday of each month outside the payphones on Leeds Train Station (next to John Menzies). Email wazza@norad.demon.co.uk Credits Thanks The Internet-When are u goin to speed up?? All u other phreakers-Without them this would never have been here Created by A person who wants remain anoymous. All i,m say in that i live in Ipswich and i,m on the net, nuff said Me E-mail address is :- T0SPolice@hotmail.com (the 0 for T0S is a ZERO) Special thing If u are going to add this text to your webpage please inform me as i,m intrested to know. Yes u can distrubute this file. Let the whole world know about this STyz &'(ABYZxy:;\]xy]]U]]]]]]]]]]]]]]]U]]]]]]]]]]]]]U]]]]]]]]]U]]]U]c]]]]]]]]]]]6$%-.<=OPQ]^no*+:;HITUdetu]]]]]]]]]]]]]]]]]]]]]U]]]]]U]]]]]]]]]U]]]]]]]]]]]]]U]]]]]]]7u    2 3 E F ] ^ _ z { a b ¿U]]]U]U]cU]cU]c]]]]]]]]]]]]]]]U]]]]U]U]]]]]]]]]]]]]]]]]]]U]]]]]]4 7 8 R S   m n ()KL  kl?@ijk<=]]]]]]]]]]]]]]U]U]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]7=#$hideLM34DEF^_efg]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]834\]^()efghiMN}~GHqrsCD01]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]U]]]]]]]]]]]]]]]]81@ABEF~A B r s !!! !h!i!!!!!!!! " "h"i""",#-#y#z#{#######]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8#$$)$*$+$$$$$K%L%R%S%%%&&l&m&&&,'-'''''I(J((( ) )+),)-)))))***#*$*%*&*****F+G+++,]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8,,d,e,,,,,,,,,,=->----------..\.].p.q.r............. / / /!/6/7/L/M/b/c/////]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8////////0000v0w00011111%1&1'1111111111111H2I222 3 3L3M3N33333334454i4j444]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]844455^5_5`555 6!66666?7@777777@8A8j8k8l8m8n8z8{8|8}8~888<9=99999]:^:::; ;;;;;;;;;]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8;<<<<<==i=j======>=>>>\>]>^>k>l>>>>>>>>L?M?S?T?U?^?_??????)@*@V@W@X@a@b@@@#A$AAAA]]]]]]]]U]]]]]]]U]]]]]U]]]]]]]U]]]]]]]U]]]]]]]]]]]]]]]]]]]]]7AAFBGBJBKBLBTBUBBBCCCCC}C~CCC>D?D{D|D}D~DDDDDEEfEgEEE(F)FFFFFAGBGGGGG^H_HHH I!III]]]]]]]]]]]]]]]]]]]]]]]]]]]]U]]]]]]]]]]]]]U]]]]]]]U]]]]]]]7III&J'JJJJJDKEK]K^K_KKKKKKDLELLLMMcMdMMM#N$NNNNNEOFOOOPP]P^PPPQQQ#Q$Q%QQQQQDR]]]]]]]U]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]U]]]]]]]]]]]]]]7DRERRRSSSSS*S+S,SkSlSSSSSSZT[TyTzT{TTTUUUU7U8U9UUUUUTVUVVVWWnWoWWW*X+XXXXXPYQYY]]]]]]]]]]]]]]]]]]]]]]]]]U]U]]]]]]]]]]]]]]]]]]]]U]]]]]]]]]7YYYYYYYYYPZQZZZ[[p[q[[[2\3\\\\\#]$]%]]]]]D^E^^^__b_c_____3`4`5````````Ja]]U]cU]cU]c]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]U]]]]6JaKaLafagahaaaa b blbmbbb$c%ccccc?d@dddddd"e#eeeeefff{f|fff;g{?{{{{{{{{{{{||W|X|||||||||||||}}c}d}}}}}}~~`~a~~~~~~=Z[\z]]]U]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]7zVWȀɀʀ OPցׁ%&'(678z{CDɃʃ OP]]]]]]]]]]]]]]]]]]]]]]]U]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]U]7CDɅʅ *+,no78z{ƇLJȇ MN҈ӈXY()kl]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]845?@ABNjȋ MNӌԌYZߍ45wx@AƏǏ LMZ[\$%]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8%gh01st=>ÓēIJ<=rst<=–ÖҖӖԖYZߗ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8ߗ"#fg01st<=RSTٚښ_`()kl45wx@A]^_]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8"#$%789{|DEߠ"#ef89{|DEʣˣ PQ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]U]]]]]]]]8<=¥åHIϦЦUVۧܧabab*+mn78z{]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8{<=¬ì`a)*lmήϮЮUVۯܯ)*lm]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]U]U]U]U]]]]]]]]]]]]]]]]]756MNOԲղZ[opq9:|}EF˵̵QR$%gh1]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]812tu=>EF̺ͺRSɻʻ OPռּ[\$%ghvwx]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8@Aǿȿ MNYZ45wx@A LMFG]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8ST`ab*+no78z{ MNYZ#$fg]]]]]]]]]]]]]]U]U]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]7g/0rs=>RST_` KL34vwST]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8_`jkl45wx!"de-.UVW cd,-op8]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]889{|DExyzBC NO|}~FGRS'(jk]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]834vw?@ @ABCDNOP[\%&=>rs]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]U]]]]]]]]]]]]]]]]]]]]]]]]8)*ST}~$%NOxy/0YZ9:^_CD]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8*+YZDEst/0^_)*]^-.ab]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]89:mn BCij+,-.=>lm >?@Aop]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8./]^KLz{|OPy '()mn45?@A]]]]]]]]]]]]]U]U]]]]]]U]U]U]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]7 &'(jk`a-.st;<KLM IJ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]U]]]]]]]]]]]]]]]]]]]8BCDQR\]]^EFWX'(mn]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8!"bc$%fg-.stab34ijk34fg¿]]]]]]]]]]]]]]]]]]]]]]]]U]U]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]7/ 0 m n        E F       R S            m n     / 0 1 C D d e f g     IJ]]]]]]]]]U]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8J+,rsCD9: !gh?@gh@]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8@A ijnopGH ijGH*+def>?EF]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8Fgh?@56  [ \      7!8!!!!!""a"b"""""?#@#U#V#W####]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8##3$4$~$$$$%%\%]%%%%%>&?&^&_&`&&&&&<'='''''((b(c(((((=)>)O)P)Q)))))) * *i*j*s*t*u*]]]]]]]]U]c]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]7u*****++I+J+++++(,),w,x,,,,,, -!-m-n---..R.S.....///`/a//////00h0i00011J1]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]U]cU]c]]6J1K11111.2/2|2}22233^3_33333444^4_444444;5<55555666.6/6M6N6666677E7F7777777]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]877 8 88V8W88888?9@99999(:):s:t::::::::::::!;";#;n;o;;;;;;;;;5<6<<<<<==e=f===]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8======>I>J>>>>>>>>>n?o?p?x?y?z???8@9@:@@@@@]A^AAApBqBBBBBBBBBBBB C CCC)C*C]]U]]]]U]]]]]]U]]]]]]]]]]]]]]]]]]]]]U]cU]c]]]]]]]]]]]]]]]]]]]6*C,C3CHCICKCRCgChCjCqCCCCCCCCCCCCCCCCCCDDDDD D%D:D;D=DEDYDZD\DcDwDxDzDDDDDDDDD]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]5DDDDDDDDDDEEEE+E,E.E7EKELENEUEiEjElEsEEEEEEEEEEEEEEEEEFF FF,F-F/F6FRFSFUFaFU]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]]]]U]5aFuFvFxFFFFFFFFFFFFFFFFFGGGG'G?@MNQRSTijklۇ܇݇އ߇ !,-.]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8.z{ɈʈMNӉԉՉ9:ŠÊ]^DE$%RSTUcd]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8def/0=>?@LMNO   -.MNst   67z{אِؐڐ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8*+no;<ƒǒ  GHIJXYZ[ߓ'()tuvw]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8ŔƔǔbcBCijk*+tuDE/0hiǙșə˙̙͙&'no]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8oMN-.vw UV56~ǞȞYZ[\lmn\] ]^]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8^56̢͢cdIJ./|}ƥǥvwKL]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8Ltu<=bcdڨۨ./[\IJŪƪDE  &'c]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8cdƬǬ  34RSop{|ƮǮȮɮʮ#$OPwxɯʯ89YZܰݰ  ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8 MNݱޱ?@ABCNOP78γϳ !jkRS01z{ɶʶcdշ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8շַ׷OPDEABۺܺ*+\]^GH#$%r]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8rs[\34^_̿Ϳ߿MNz{op78rs9:]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8:de"#AB\]z{z{45}~23TU|}]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8>?no45HIfg )*;<NOabc89]^]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8^ BC^_pq%&?@tuvwJKlm}~]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8#$78XYlm-.:;VW  &'>?QRgh{|]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8EF_`78_`z{,-<=WXrs  &'BC^_]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8_yz :;IJdest./IJXYrs]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8  56PQlm()78FGabpq12LM]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8Mijxy89STbc}~ ()78FGUVde]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]834\]wx ./IJde '(BC]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8CQRlm{|)*89STno}~$%?@MN\]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8]wx"#12LMghvw)*DESTbc}~*]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8*+,`a@Atuxy  $%12IJVWrs]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8  34@AMNZ[fgst  5678stNO{|]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]823uvBCEF)*+KL`a    1]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]812EFGHhi 4567IJPQVWYZ~]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]867VW]^fghi#$)*;<QRjk  ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8./45CDEFXYmn #$)*9:MNhi|}]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8%&;<OPbceflm  $]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8$%*+89LMabuv{|&'(;<PQRefkl]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8lz{|} "#$%89?@FGHI\]cdjklm]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8,-?@BCDVWjk}~!"()78JKdewx]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8x #$*+12EFYZnotu]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8   !"45HI[\uv&'-.4567HI[\mn]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8ntu|}~$%&'89GHZ[\]no]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8  /0xyz#$12?@OPabxy]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8*+9:QRgh|} -.>?QR^_kl|}]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8./:;LMYZghwx!"12BCjk{|]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8   !/09:NOcdqr!"./;<GHWXfgu]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8uv"#-.;<GHVWklwx&':]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8:;FG^_rs()56ABMNYZefuv]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8  ! " . / ? @ M N l m                       # $ 3 4 A B Q R ` a p q          ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8            - . = > S T f g | }                 & ' 4 5 C D R S ` a r s } ~      ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8            8 9 K L ^ _ l m z {           &'78DEOP_`rs]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]812BCRSqr  "#;<RSef~]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8  '(78UVefrs()>?RSfgz{]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8  "#./:;TUbcyz+,:;PQ_`wx]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8 23>?NO^_pq'(45BCRSijxy]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8 &'<=NOcdrs/0DE^_pq]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8+,@ANO\]op+,=>MN^_mn]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8 ./?@OPbcxy  /0@ARShi}~]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8)*CDSTgh}~ ,-:;MNabp]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8pq$%23BCMN]^ghyz    ! " 4 ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]84 5 F G U V k l z {                ! !!!*!+!H!I!b!c!x!y!!!!!!!!!!!!!!!!! " "" "7"]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]87"8"L"M"Y"Z"h"i"w"x"""""""""""""""#### #!#.#/#G#H#W#X#p#q############### $ $$ $/$]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8/$0$F$G$\$]$g$h$v$w$$$$$$$$$$$$$$$$$%%+%,%I%J%V%W%t%u%%%%%%%%%%%%%%%%& & &&&*&]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8*&+&?&@&W&X&d&e&s&t&&&&&&&&&&&&&&&&&''&'''5'6'L'M'Z'['h'i'x'y'''''''''''''''''(]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8( (((,(-(;(<(H(I(Y(Z(m(n(~(((((((((((((())))/)0)C)D)c)d)p)q))))))))))))))))))]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8))****!*"*.*/*;*<*J*K*Y*Z*h*i*w*x******************* + +++"+#+.+/+:+;+<+++++++++]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8+ , ,,,_,`,x,y,,,,,,,----]-^-v-w------.. .S.T.U.... //'/(/)/_/`/a////000000001]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8111U1V1W1X11111222`2a22222233334353u3v3w333444_4`4u4v4w44455655555V6W6i6j6k666666]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]86"7#7h7i7j77777788 8h8i888888:9;9~999::::::;;;;;;;;;;H<I<J<<<<^=_==>>>?>>>>>>>]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8>}?~???? @ @-@.@/@@@@#A$A%AAAAFBGBHBZC[C\CDDDDDDDwExEyEEEEAFBFCFFFF~GGGGGGvHwHxH)I]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8)I*IMINIIII/J0J1JJJJKKK1L2L3LLLLLLLMMMCNDNENuOvOwOOO:P;PPPPPPQQQIQJQKQQQQQQ$R%R1R]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]81R2R3R^R_RRRRRSSSKSLSSSSSSTTUTsTtTuTTT2U3UUUUUMVNVVVVVVVWWWWWWKXLXXXXXXX/Y0YiY]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8iYjYYYYYZZZZeZfZgZqZrZsZZZ [![[[[[B\C\\\\\\\B]C]]]]]]]]^^^J^K^h^i^^^^Q_R_S_T___]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]8__9`:`;```EaFaGaaaaaa!b"b)b*b+b1b2b\b]bbbbccccc\c]c^ccccccddUdVdWdXd]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]- Tz '(BZy;;]y%.=PQ^o+;IUeu  3 F ^ _ _ { b 8 S  n  )L l@jk=$ieM4EF_fg4]^)fghiN~HrsD1ABFFB s !! !i!!!!!! "i""-#z#{#####$*$+$$$L%S%%&m&&-'''J(( ),)-)))***$*%*&***G++,e,,,,,,,,>------..].q.r....... /!/7/M/c//////000w0001111&1'11111111I22 3M3N333354j44445_5`55!666@7777A8k8l8m8n8{8|8~88=9999^:: ;;;;;;<<<=j====>>>]>^>l>>>>>>M?T?U?_????*@W@X@b@@$AAAGBKBLBUBBCCCC~CC?D|D}D~DDDDEgEE)FFFBGGG_HH!III'J'JJJEK^K_KKKKELLMdMM$NNNFOOP^PPQQ$Q$Q%QQQERRSSS+S,SlSSSS[TzT{TTUUU8U9UUUUUVVWoWW+XXXQYYYYYYYQZZ[q[[3\\\\$]%]]]E^^_c___4`5````KaLagahaaa bmbmbb%ccc@dddd#eeeff|ffēJ=st=ÖӖԖZ#g1t=STښ`)l5xA^_##$%89|E#f9|EˣQ=åIЦVܧbb+n8{=ìa*mϮЮVܯ*m6NOղ[ppq:}F̵R%h2u>FͺSʻ Pּ\%hwwxAȿ NZ5xA  MGTab+o8{  NZ$g0s>ST` L4wT`kll5x"e.VW d-p9|EyzC O}~GS(k4w@ ACDOP\\&>s*T~%Oy0Z:_D+ZEt0_*^.b:n Cj,-.>m  ?@Ap/^L{|P ()n5@A '(ka.t<LM JCDR]^FX(n"c%g.tb4jk4g0 n     F         !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcde  S         n   0 1 D e f g   J,sD: !h@hA jopH jH+eef?Fh@6 \ \    8!!!"b"""@#V#W###4$$$%]%%%?&_&_&`&&&='''(c(((>)P)Q)))) *j*t*u***+++J+++),x,,,,!-n--.S...//a///~yt::::::::::::://0i001K111/2}223_33344_4444<555566/6N6667F77777 88W888@999):t:::::::::";#;o;;;;;;6<<<=f=====>J>J>>>>>>o?p?y?z??9@:@@@^AAqBBBB C*CIChChCCCCCDD;DZDxDDDDDE,ELEjEEEEEF-FSFSFvFFFFFG=GbGGGGGH(HLHiHHHHHI#IBIcIcIdIeIfII(J5JiJjJJKK@KKKKK(LoLpLL/MjMkMMMMMMMNNfNNNHOOO1P}PPPPPPPQ:QbQQQQQR*RRRzRRRRRRS+SCS[SsSSSSSSS"TqTqTTUZUUUCVVVVVVKWrWsWuWWXUXVXXXY-Y.Y.Y:YFYGYHYYY/ZMZNZZZ[[d[[[[B\C\\\\],],]-]E]\]q]u]]]]'^v^^__T___8`J`K`L`W`X````'a(axaaaaaa9bdbbbbbb9ccc"dodddd e e!e-e.e{eeffIfzfffffggagngogggg h,hMhMhnhhhhh1iTiUiii>@NRTjl܇݇އ!-.{ʈNԉՉ:ŠÊ^E%SUddf0>@MO .Nt 7{{ؐڐ+o<ǒ HJY[(()uvwƔǔcCjk+uuE0ișə̙͙'oN.ww V6ȞZ[\mn] ^6͢dJ/}ǥwLu=cdۨ/\JJƪE 'dǬ 4Sp|ǮȮɮɮʮ$Pxʯ9Zݰ Nޱ@ABCOOP8ϳ !kS1{ʶdַ׷PEBܺ+]^H$%s\4_ͿN{p8s:e#B]{{5~3U}?o5Ig*<Obc9^ C_q&@uwKm~$8Ym.;W '?Rh||F`8`{-=Xs 'C_z ;Jet/JYs 6Qm)8Gbq2Mjy9Tc~)8GVe4]]x /Je (CRRm|*9To~%%@N]x#2Mhw*EETc~+,aAuy %%Js 4Ng 68tO||3vCF+La2Hi 7JZ7Wii$<Rk /FYn$:Ni}&<Pm%9Mbv(<Rf}}%9I]m-DWkk~"8Kex$2FFZo "5I\v''7I\n'9H]o 0yz$2@Pby+:Rh} .?R__l}/;MZhx"2Ck| !0:Odr"/<HXgv#.<HWlx';G_s)6BNZfv " " / @ N m            $ 4 B R a q            . > T g }         ' 5 D S S a s ~         9 L _ m {      ''8EP`s2CSr #<Sf (8Vfss)?Sg{ #//;Ucz,;Q`x 3?O_q(5CSjjy'=Ods00E_q,AO]p,>N_n/@Pcy 0ASi~*DDTh~-;Nbq%3CN^hz  " 5 G V V l {         !!+!I!c!y!!!!!!!!! " " "8"M"Z"i"x""""""""##!#/#H#X#q######### $ $0$G$]$h$w$$$$$$$$$%,%J%W%u%%%%%%%%%& &&+&@&X&e&t&&&&&&&&&'''''6'M'['i'y''''''''' ((-(<(I(Z(n((((((((())0)D)d)q))))))))))**"*/*<*K*K*Z*i*x********** ++#+/+;+<++++++ , ,,`,y,,,,--^-w----. .T.U.../(/)/`/a/a///0000011V1W1X11122a222234353v3v3w3344`4v4w446555W6j6k6666#7i7j777788 8i8888;999:::;;;;;;I<J<<<_=>>?>>>>>>~??? @.@/@@@$A%AAAGBHB[C\C=D>DDDDDDxEyEEEBFCFFFGGGGwHxH*INIII0J1JJJKKK2L3LLLLLMMDNENvOwOO;PPPPQQJQKQQQQQ%R2R3R_RRRSSLSSSSUTtTuTT3UUUNVVVVVVWWWWLXXXX0YjYYYZZZfZgZrZsZZ![[[[C\\\\\C]]]]]^^K^i^^^R_S_T___:`;```FaGaaaa"b*b+b2b]bbbccc]c^ccccdVdWdXd Xd3 XdMaK@Normala "A@"Default Paragraph Font@ FMicrosoft Word 6.0 Document MSWordDoc9q