You are on page 1of 24

DOYOU HAVE BAC K ISS U E S OF 26007 If not, look what you're missing!

1984
AHOY!-an introduction to 2 � ; FBI G O E S AFTER � DS HACKERS-FBI Investigator unwlttlnglv reveals tactics and recent activities;
FLASH: LlCA d,scusses GTE raIds, AT&T credit cards, wireless phone trouble; T H E TRUTH B E H I N D THOSE
9999 NUMBERS--a tol l free error
story; DA fA: various Wh ite House extensions; HAC K I N G O N TELENET-how to's of Telenet use; ESS:
ORWEll'S PROPHECY-the first in a
series on the fun and dangers of ESS; FLAS H : directory assistance changes. computer a i r-ban, AT&T
credit cards. etc.; SOME THOUGHTS
O N GARBAGE PICKING -first of a series of trash i n g for valuable information as related to a discussion
of crosstalk; DATA; COUNTRY
CODES--every last country code for overseas dIa l i ng; T H E CONSTITUTION O F A HACKER-a discussion
of hacking; ALTERNATE LONG
D ISTAN C E : Mel-hlstorV. systems. and servIces; FLAS H : 718. Connecticut wiretaps. Sweden person
numbers, etc.; THE FIRST ATOMIC
BOMB-an inside story on the event as related to our nation's phone system; DATA: ARPANET HOSTS-l
i st of accessible hosts; WHOSE
STR I K E WAS THAT ANYWAY?-a start l ing analysis of summer 83 phone strike; THE TROUBLIE WITH
TELEMAIL--<llscussion of GTE's
i r r e s po n s i b i l ity in protect i n g t h e i r system; F LA S H : AT&T c r e d i t c a rds, port a b l e p r i s o n s , 414
' s p l ea d , etc.; A T R U E SAGA O F
TELECO N F E R E N C I N G -what can happen o n a teleconference; DATA: M C I ACCESS N U M B E R S-DIALUPS
FOR MCI MAIL; PHONE BOOK
COLILAGE N l ---ou r artistic heritage in phone book designs; THE S I M PL E PLIEASURES OF A STEP OFFICE--<l
iscussion of ins and outs of
antiquated phone systems; I B M ' S AUDIO DISTRIBUTION SYSTEM-using voice messaging technology;
FLAS H : 414 sentencing, equal
access, bank record privacy, etc.; THE WOES OF HAVING A SMALL-TIME RURAL PHONE COMPANY-a
true story; DATA: AVAILABLIE
N ElWORKS O N THE D E F E N S E DATA NElWORK-a list including base addresses, EASYLINK ACCESS
NUMBERS; ARPANET HOPPI N G :
AMERICA'S N EWEST PASTIME-how it works and t i p s f o r i t s use; ELECTRON I C SWITC H I N G ADVANCES-some
o f the possible services
and drawbacks; FLASH: D i rectory assistance charges, 2600 writer indicted, demise of E-COM, etc;
THE DARK AND TRAGIC S I D E OF THE
G REAT BREAK-UP-a frank discussion; LlETTER S : sysop problems, 51B-789 a n X'f step, etc.: DATA:
E-COM ACCESS NUMBERS--<lial ups
for the (now-de funct) service; NY TELEPH O N E "LlETTER OF DOOM" -a copy of a law enforcement
,, monitoring notice; "LOOK OUT, H E ' S GOT
A COMPUTER I -a defense of the hacker VIewpoInt; MCI MAIL: THE ADVENTURE CONTINUES-an ana
lysis of the well-known faulty E-m a i l
system; F LA S H : computerized meter-maid, blue box arrests, anti-hack legislation; INTRODUCING THE
C lEA R BOXI-"post-pay" payphone
device; LETTE R S : new switching equipment. 99 scanning. repulsive operator story, etc . ; SPECIAL
R E PORT: TRW-BIG B U S I NESS IS
WATC H I N G YOU-how to use TRW, a n d an assessment olthe potential of this system; BUT HOW DOES
ITWORK?-a simple explanation of

the p one system, w i r i ng. voltages, black
� � C?
x��. r ing. etc.; PRI ACY L ST--a review of David Burnham's book 'The R ise of the Computer
State , ; B E N I C E TO YOUR TELCO-how indIVIduals are abUSing their telcos; FLASH : Big Brother
i n M iami, NASA computer break-in,
computer export controls, BOO directories; LETTE R S : phone scramblers, page n umbers. hacker's book . etc.; DATA: CNA NUMBERS-list of
CNA 's; A HACKE R ' S G U I D E TO AN AREA CODE-a Simple scheme to help "map out" exchanges
i n your area; H I STORY O F BRITISH
PHREAKING-an account olthe history and tec h n iq u es; MORE O N TRASH I N G -what to look for, where
to go, how to act; A FRIEND I N H I G H
PLACES--story of a friendly operator; FLASH : NSA insecurity, hacker caught. private directories; LETTERS:
p h o n e l oo p . WATS. TAP, etc.;
DATA: A NON-COPYR IGHTED D I RECTORY; N Y TELEPH O N E "BIG BROTH E R " LETTERS-touch tone
without permission, etc; GETTING
CAUGHT: HACK E R ' S VIEW-a story of the personal effects of hacking; VITAL I N G R E D I ENTS-what
makes the phones work: operators,
switc h i ng; FLASH: NSA wants better phones, crime-computer victim. wiretap loopholes. 911 attacker
caught; LETTERS: BSS discussion,
Comsec Letter, Computer Crime Data, others; DATA: N Y TELEPH O N E SECUR ITY NUMBERS; MCI
ANECDOTE-ads, vulgarisms, M C I
chairman profole; P H O N E B O O K COLILAGE # 2 ; EXPLORING CAVES I N TRAVELNET-a n interesting extender
explained; F U N WITH
FORTRESS F O N E S-what a pay phone does, how people beat them; FLASH: SS computer foul ups, Airfone,
wiretaps, 81B, pay phone attaCk;
LlETTE R S : boo k l ist, SIlver boxing, another hacker'S view; DATA: I C ' S AND CARR I E R IDENTIFICATION
CODES-guide to 950 exchange; MCI
MAIL "TROUBLE LETTER"-the harassment begins; A TIME FOR REFLECTION-the year i n review; MCI
MAIL AND EASYLlNK--electronic
mail horror stories; THE SCARIEST N U M B E R I N THE WORLD-true story; F LAS H : campaign computer,
Pentagon by phone, students bog
computer, electroniC lali. federal phone upgrade; SURVEY-reader survey responses; SOME, BUT NOT
ALL ELECTRONIC MAIL SYSTEMS­
l ist and price comparisons plus voice messagmg companies; REACH OUT AND GOOSE SOMEONE-l
ist of many unique dial-it numbers.

1985
THOSE H O R R I B LIE HACKERS STRIKE AGA I N -analysis of Newsweek incident; WIRETAPPING AND DIVESTITURE-a l ineman discusses
these topics; G ETTI N G IN THE BACK DOOR-a guide to some popu l a r operating systems i ncluding TOPS-10, TOPS-20, and U N IX; 2600
I N FORMATION BUREAU: our phone bill, our thanks, and other notices; FLASH: IRS and telco data. G E I SCO, KKK computer; LETTERS: BBS
rights, Easylink, Canada loops, international phreak day; BITNET TOPOLOGY-a schematic of the BITnet; THE THEORY OF "BLUE
BOXING"-h istory, future, and hovv they are used; TRASHING ALASKA STYLE-a real trashing adventure story; SURVEYING THE
COSMOS-a beginner's guide to COSMOS, B e l l ' s computer program; F LA S H : phreak roundups, real TRW crime, 2600 BBS, data; BOO
LETTERS; Bell problems. telco discount. marine c a l l i ng. many questions; 2600 I N FORMATION BUREAU-acronym l ist of useful telephone
largon; NAZI BBS A CHALL E N G E TO HACKERS-the role of the hacker; ARE YOU A PHR EAK???-humourous review of phreaking; HOW TO
GET I N TO A C. O.-a tour of a central office; FLASH: custom c a l l ing, Kenyan pay phones. hacker coke machine. IRS computer screw-up;
LETTERS: reading l ist. tracing a nd law enforcement. U N I X info, NSA phone #; 2600 I N F ORMATION BUREAU-interesting phone numbers.
hovv to d i a l a telephone. New York Tel message; CNA LIST; NSA CIPHER D I S K ; WHAT A WHITE BOX CAN DO-how to build and the use of a
portable touch-tone generator; A PHONE PHREAK SCORES-another successful soci a l engineering story; HACKING PACKARD-usefu l
Information about the H P2CXXJ ; FLASH: ta lking clock. computers for communists, robot k i l l s man, war games. s i lver pages; LETT E R S : Tom
Tcimpid is, secure telephones and cryptography; 2600 I N FORMATION BUREAU-MILNET hosts by location; PEOPlE EXPRESS TO B E
HACKED TO PI ECES-a look a t People's new anonymous reservation service; HOW T O RUN A SUCCESSFUL TELIECONFERENCE-complete
guide to A l l i a nce Teleconferencing Service; F LA S H : hacker bust. pol ice hacker. Reagan doesn't dial kids. dia l-a-dir� ry; LETTER S :
.
computer networks, s i lver boxes. 950. remob, tracing; 2600 I N FORMATION B U R EAU-A l l i a nce TeleconferenCing matenal; INTERESTING
PHONE NUMBERS; U N BELI EVABLE ADVERTI S E M ENT; GUIDE TO THE ISRAELI PHONE SYSTEM; S H E RWOOD FOREST SHUT DOWN B Y
SECRET SERVICE; S O M E W O R D S O N HACKER MORALITY; OUT OF THE I N N ER CIRCLE REVIEWED-an ex-hacker's new book; FLASH: who
Invented the phone, porno phone. wi retap award. AT&T computer stea ls; LETTERS: information charges. AT&T cutoff, marine ca l l ing; 2600
INFORMATION BUREAU-600 prefixes by state; SYSTEMATICALLY SPEAK ING. goodbye to meter readers, Thai phone books, tracking
devIces, TINA. "Ca l l Me" Card; FROM SHERWOOD FOREST: INTRO TO HACKING-whal lo do and nol lo do; INTERESTING TH INGS TO DO
O N A DEC-20-hovv to use var ious commands and some t h i ngs to look for; BAN K I N G FROM YOUR T E R M I NAL: A LOOK AT PRONTO­
E lectronic banking. how it works with a focus o n Chemica l ' s system; FLASH : $2 b i l l ion error. I TT crackdown. monitor ing; 2600
INFORMATION B U REAU-M i l net TAC d i a l ups by location; SYSTEMATICALLY SPEAKIN G : M C I goes opt ical, 100'... ESS, GTE bigger than
AT&T; S E IZED! 2600 BULLIETIN BOARD IS IMPLICATED I N RAID ON JERSEY HACKERS-an accurate account of the Private Sector BBS;
COMMENTARY: T H E THREAT TO U S ALL-what BBS seizures mean; FLASH : 2600 a hacking victim, M i ddlesex Courthouse; MOVING
SATELLITES .. .wHAT WAS REALLY GOING ON?-point by point correctIon of New Jersey prosecutors' fallacious charges; WHY
COMPUTERS GET SNATCHED-why law enforcement seIzes equipment; SOME I M PORTANT QUESTIONS TO ASK-provocative questions
about these events; HOW CAN SYSOPS PROTECT T H E M S E LVES?; A G U I D E TO VMS-how to use DEC's VAX operating system; THE
I N F I N ITY TRANSM ITTER-an old bug exp l a i ned; REAC H I N G OUT O N YOUR OWN-blue boxing verification; PURSUIT FOR PEOPLE-GTE
Te lenet's computer to computer l i nk-up service; FLASH: phone-in registration, 800 word numbers. war game addict, hacker extortionist;
2600 I N F O R MATION BUREAU-Telenet directory of interesting addresses; SYSTEMATICALLY SPEAKING: Dick Tracy toys, computer
di rectory assistance, B e l l propaganda films, Europe standardizing telcoms; MANY FAM ILIAR TONES; AND THEY CAL L U S CROOKS?-story
of a phone ph reak who c a n ' t sell his expertise; AN INTERESTING DlVERS I O N -ca l l diverters and how they are abused; MORE I N FO ON
VMS-second instal lment of an in-depth guide to VMS; FlASH---comp uter elections. big phone bil l , Navy phreaks. phone boot h captures
man; LETTERS : BBS suggestion, colleges are a goldm ine, recommended reading; 2600 I N F O R MATION B U R EAU-B lue Box plans; THE NEW
AT&T HOSTAG E PHON E-unbe l ievable ad; SYSTEMATICALLY SPEAK I N G : hackers scare busi nesses, D u Pont bypasses telco, computer
campaign Info. phone computers, divestiture woes; RSTS: A TRICK OR lWO--some aspects of this operating system; THE SECRET
REVEALED-the problem with GTE's GTDN5 switch; H I STORY OF ESS, EQUAL ACCESS MAY NOT BE "EQUAL" TO MODEMS-some
problems that may anse; FLASH: columnist attacks AT&T, feds dial-it too much, l ittle town phones. Spri ngsteen mania; LETTERS: some
advice, CIC's and free calls, British ph reak, blue boxing gone?; CHASE BANK IS CRACKED; 2600 INFORMATION BUREAU-many interesting
test numbers; SYSTEMATICALLY SPEAK I N G : aVOid phones i n storms, rural u nequal access, police cel l u l a r phones, toll-free from where?
AT&T to read e-m a i l ; OUR WISHES FOR '86 AND BEYOND-some of what we'd l ike to see i n the future; FUN WITH COSMOS-how to
interpret and use parts of the phone company computers; FLASH. French phones, racist banter. Cityphone; SURVEY-reader survey
responses. 2600 INFORMATION BUREAU-BBS numbers; SYSTEMATICALLY SPEAKI N G : AT&T e-maIl. German phones. super pay phone.

(continued on inside back cover)


Page 2 July, 1987 1600
y ....... ....,-...JI U.JI V &,ar;;.r I�' LUlltt:
�J yuu vc IlOt Upe'ncu magazl1U!,
IRIS
....... � .. u:

yoU may want to glance over to your out, asking questions about certain
left. That is the beginning of an articles. And in reading over them
advertisement for something that IIUlny ourselves, we can understand why. It all
of you have been asking about-2600 seems so fresh and new, even though
back issues. They've always been some of it is three years old and the
available in the past, but now we've had circumstances have changed.
our entire collection reprinted to prevent But one thing that hasn't changed is
us from running out for a very long our feeling towards technological
time. enthusiasts. They understand at least
Having all of these back issues some of what's going on in the world of
floating around has been an uplifting computers and phones and the average
experience for us. It's easy to lose track person wants to know what they find
of the IIUlny different subjects we've out. Mostfolks would have never heard
tackled in these pages and it's really of TRW Credit Services if it weren't for
UIIUlzing to look back on what we've hackers, let alone know that huge credit
done. files existed in their nomes. More people
2600 is not like other magazines. Our wouldn't know what electronic and
readers are constantly refe"ing back to (continued on page 20

STAFFBOX

Editor and Publisher


Eric Corley 110

Office Manager Cover Art·


Fran Westbrook Tish Valter Koch

Writers: John Drake, Paul Estev, Dan Foley, Mr. French,


Emmanuel Goldstein, Chester Holmes, The Kid & Company,
Lex Luthor, Bill from RNOC, David Ruderman, Bernie S., Mike
Salerno, Silent Switchman, Mike Yuhas, and the usual
anonymous bunch.

Production: Mike DeVoursney.


Cartoonists: Dan Holder, Mike Marshall.
Editor Emeritus: TSH.

2600 (ISSN 0749-3851) is published monthly by 2600 Enterprises. Inc. 7 Strong's Lane. Setauket. NY 11733.
Second class postage permit pending at Setauket. New York.

POSTMASTER: Send address changes to 2600, P.O. Box 752, Middle Island, NY 11953�752.

Copyright © 1987, 2600 Enterprises, Inc.

Yearly SUbscription: U.S. and Canada�$15 individual, $40 corporate.


Overseas�$25 individual, $55 corporate.
Back issues available at $25 per year, $30 per year overseas.
ADDRESS ALL SUBSCRIPTION CORRESPONDENCE TO: 2600 Subscription Dept., P.O. Box 752,
Middle Island, NY 11953�752.
For letters and article submissions, write to: 2600 Editorial Dept., P.O. Box 99, Middle Island, NY 11953�752.

26(}() Jul • 1987 Pa e 3


LeUumrPhoneFraud
by Bernie S. error. The home carrier wil l then change the
The recent FBI /Secret Service cel lular sting legitimate subscriber's M I N in the MTSO (Mobile
operation that culminated in the arrests of over Telephone Switchin g Office) and arrange for a
25 people in New York City confirms what many new NAM (Number Assignment Module, or
of us have suspected for quite some time: that ROM) to be installed in that subscriber's CMT
cellular telephone fraud is widespread. The FBI transceiver. The MTSO maintains a database of
estimates that cellular phone fraud costs system a l l its valid ESN/M I N pairs, as well as a
operators $3 million anually; with the average "negat ive verify" fil e on a l l known invalid
subscriber'S airtime bill about $50 per month for numbers for the dead beats and pirates in its area.
100 minutes of usage, there could be over 2500 The carrier may c h o o se to l eave certain
cellular pirates on the air if a pirate uses twice the fraudulent codes active to have any activity
normal amount of airtime. The term "pirate" monitored, but as long as all parties at the
rather than "phreak" is used here because the receiving end of any phreaked cal l s become
vast majority of illegitimate CMT users (Cellular amnesiac to any inquiries, the phreak's identity
Mobile Telephone) are only interested in stealing will remain secret. If a phreak uses a different
airtime, while phone phreaks are mainly ESN & MIN every month, it'll be extremely
interested in leaming more about the telephone difficult for the carri er to react in time to gather
network through its manipulation. any information.
The six-mo n t h FB I investigation used As with any land line, inband signal l ing (i.e.
"cooperative sources" who named fraudulent 2600 Hz, MF tones, etc.) wil l work but can be
installers; then FBI agents posing as customers easily detected by the ESS control l ing that line.
and i n s tallers used s t andard entrapment Since a l l cellular systems are in metropolitan
techniques to gather evidence against those areas, it's logical to assume that most cel lular
al l egedly invo l ved. The FBI's press release lines are on ESS. Although telco security may be
statement that "recent technological advances in aware of any b lue-boxing, the links in their
computerized telephone switching equipment security chain stop at the MTSO. Moreover,
and billing systems were instrumental in. . . (their since the MTSO sel ects outgoing landlines from a
investigation)" is deliberately misleading. New trunk group, a pen regist er at the CO would be
York cellular carrier NYNEX merely supplied the useless for establish ing any toll fraud pattems.
FBI with its billing data to document the use of Because of cellul ar's inherent frequency­
bogus and sto len ESN's & M IN's (Electronic hopping nature, it is very difficul t to track down a
Serial Numbers and M o b i l e I dentification CMT using convent ional radio direction-finding
N umbers) discovered in the investigation. The (OF) techniques, even if it's stationary. A sma l l
Secret Service later became involved because d i r e c t i o nal a n t enn a ai m e d r a n d o m l y a t
the laws rel ating to the credit fraud being surrounding cell-site repeaters with a TV antenna
allegated are under their jurisdiction. rotor will thoroughly confuse any OF attempts,
Safe Phraaking although keeping calls as short as possible is
In practice, cellular phreaking is very safe if always a good precaution. Locating a mobile
one does their own tranceiver modifications, CMT is virtually impOSSibl e. I was recently given
changes ESN's & M I N's regularly, and uses a tour of an FCC monitoring van in Washington
standard phone phreak precautions. Indeed, FBI DC, and was surpri sed t� see how lacking in
agent Greg Meecham has stated that sophistication their o nboard OF gear was. The
fraudu l ently programmed CMT's are only equipment available to readily locate a CMT
"unat t ributable, unbillable, untraceable and transmitter is primarily used by the military and
untappable. " A cellular carrier wil l become aware intelligence agencies, w hich couldn't care less
of any bogus or stolen ESN's and MIN's used on about CMT fraud unless it involved national
its system within a month or so after their initial security.
use once the subscriber or carrier who is assigned Equipment
those codes is billed and notifies them of the Most CMT's are actually two main pieces of

Page 4 July, 1 987 2600


and Where lt7s Headed
equipment: the transceiver ahd control head. The model. It uses a proprietary paral lel bus and
transceiver (transmitter/receiver) is usually a control head, but costs l ess, is very rugged, and
nondescript met a l box w ith three extern a l is also easy to work on . In addition, a l l Novatel
connectors and contains sOPhisticated circuitry. CMT's have built-in diagnostics which a l l ow
There are usual ly two mai� Circuit boards inside: (among other things) manual scanning of a l l 666
an RF board with a l l the radio transmitting/­ r e p e a t e r o u t p u t f r e q u e n c i e s--g r e a t
receiving circuits, and a logic board with a entertainment when you're bored!
microprocessor, AID and D/A circuits, and AnI8nnu
control logic. The control head is a touch-tone A mobile cellu lar antenna is usually a short
telephone handset with an extended keypad, (less than a foot long) piece of stiff wire with a
numeric, or alphanumeric display, and volume half-dozen or so turns in the middle, like a spring.
and mic mute controls. It often has a separate The "spring" acts as a phasing coil in a 5/8-wave
speaker mounted in the cradl e for on-hook dialing configuration. The antenna is mounted vertical ly
and cal l-progress monitoring. Some CMT's have either through a hole in the vehicle's roof or at the
a speakerphone option that allows you to drive top of the rear windshield using silicon adhesive
with both hands on the wh�1 by talking into a with conductive plates on either side to pass RF
small microphone mounted near the vehicle's sun energy right through the glass. It's not quite as
visor, and listening to the cradle loudspeaker. efficient as a roof mount, but most folks prefer
This may seem to be the ultimate in laziness, but not to dri l l a hole in their Mercedes. A 50-Ohm
remember you cou ld be rral)euvering your five­ coaxial cable such as RG-58/ U l inks the antenna
speed through heavy traffic on the expressway to the transceiver with a male TNC-type UHF
when the phone rings! TheC()ntrol head/cradle is connector. A ceramic d u p l exer a l l ows the
usua l l y bolted to the tranSrI)ission hump by the transmitter and receiver to share the same
driver's seat, and the trahsceiver is usually antenna sim u l taneo u s l y . Mobi l e roof-mount
mounted in the trunk wi th a power cable antennas are designed to work with the ground
connecting it to the car battery and ignition plane provided by the vehicle's body, but for fixed
switch. A shielded contr()1 cable links this use an "extended-feed" or voltage-fed coaxial
equipment together and allows data and audio to antenna (which requires no ground plane) can be
pass between them. Most first-generation CMT's used if there's no tin roof on your house. A capped
used the AMPS bus, develOPed by AT&T, which PVC pipe makes an ideal rooftop housing for this
specified a system of 36 paral lel wires in a bul ky type of antenna, concealing it and making it
contro l cab l e. Some !T1an ufacturers l ater weatherproof at the same time. As with any kind
developed their own buses-Novatel's serial bus of antenna, the higher the better--but unless
specifies a thin cable of just a few wires which is you're surrounded by tal l steel buildings any
much easier to install in vl11icles. For fixed use, a height will probably do (provided you're within
CMT may be powered by al)y 12-volt regulated range of a cell-site repeater). It should even work
DC power supply that can deliver at least 5 indoors if near a window--remember that
Amperes. cellular systems are designed to work primarily
Any would-be cellular Ihreak must first obtain with inefficient antennas at ground-level. Vagi
a CMT. Used bargains <bOund in some cities, and comer-reflector antennas are available for
where many subscribers found they couldn't fixEjd use' that provide very high gain and
afford to pay their airtimebi l l s after they bought directivity. Antenna specialists Co. (216-791-
t heir p hone! First-generation E. F. Johnson 7878) manufactures a broad line of cellular
transceivers are a good chOice because they're antennas.
easy to work on, use a uniquely effective InlBrflcing
diversity (dual-antenna) receiver, and use the Interfacing audio devices such as MF tone­
AMPS control bus, whith means that several generators to a CMT can be accomplished by
manufacturers' control hta(js will work with it. coupling the device's output through an audio
Another good choice is Novatel's Aurora/150 coupling transformer and capacitor across the
(continued on page 11)
2600 July, 1987 Page 5
now pnone pnreal(s
by No Severance on the FGA number. This causes the trunk
Until about four months ago, I worked in a number your cal l came over to be printed out
switch room for a large long distance company. I From the trunk number Telco cou ld tel l which
was given the pink slip because some guy in my central office (CO) your cal l was coming from.
office fo und out that I did a little hacking and From there Telco cou ld put an outgoing trap in
phreaking in my spare time. It seems that most your CO which wou ld print the telephone number
companies just aren't into that anymore. I feel I of the person placing a cal l to that number-that
shou ld do alii can to keep phreaks from getting' is provided that you are in an ESS or other
caught by the IC's ( Independent Carriers or Inter­ electronic switch. This is how a majority of
exchange Companies). Remember: a safe phreak people are caught hacking codes on an FGA
is an educated phreak. access number.
When you enter an authorization code to N ext down the line we have Feature Group B
access a long distance company's network there (FGB). There are two FGB signal ling formats
are a few things that happen. The authorization called FGB-T and FGB-D. A l l FGB's are 950-
code number you enter is cross referenced in a list XXXX numbers and I have yet to find one that
of codes . When an unassigned code is received doesn't use FGB-T format
the switch wil l print a report consisting of the When you dial an FGB number your cal l can
authorization code, the date and time, and the take two paths: 1 ) Large CO's have direct trunks
incoming trunk number (if known) along with going to the different I C's. This is more common
other miscel l aneous information. in electronic offices. 2) You r cal l gets routed
When an authorization code is found at the end through a large switch cal led a tandem, which in
of a billing cycle to have been abused, one of two tum has trunks to a l l the IC's.
things is done . Most of the time the code is When you dia l an FGB-T number the I C's
removed from the database and a new code is switch receives:
assigned . But there are times when the code is KP + ST
flagged "abused" in the switch. This is very This prompts the switch to give you a dialtone.
dangerous. Your call sti l l goes through, but there The IC gets no information regarding your
is a bad code report printed. (This is similar to an telephone number. The only thing that makes it
unassign ed code report, but it also prints out the easier to catch you is that with a direct trunk
number being ca l led.) You have no way to know from your central office, when you enter a bad
that this is happening but the IC has plenty of code the IC knows what office you're coming
time to have the cal l traced . This just goes to from . Then it's j ust a matter of seeing who is
show that you should switch codes on a regu lar cal ling that 950 number.
, basis and not use one until it dies. On the other hand, when you dial an FGB-D
Access number the switch receives:
There are several ways to access an IC's KP + (950-XXXX) + ST fol lowed by
network. Some are safe and some can be deadly. KP + 0 + NXX-XXXX + ST or KP + 0 + NPA
Feattrll Group A (FGA). This is a local dial-up to NXX-XXXX + ST
a switch. It is just a regular old telephone number The first sequence tel ls that switch that there
(for example 871 -2600) . When you dial the is a cal l coming in, the 950-XXXX (optional) is
number it wil l ring (briefly) and give you a the same 950 number that you cal l. The second
di altone tel ling you to proceed. There are no sequence contains your n u mber (AN 1-
id entifyimg digits (i.e. your telephone number) Automatic Number I dentification). If the cal l
sent to tile switch. The switch is signal l ed to give comes over a trunk directly from your CO it wil l
. you a dialtone from the ringing voltage alone. The not have your NPA (area code). If the call is
only way you cou ld be caught hacking codes on routed through a tandem it wil l contain your
an FGA In umber wou ld be if Telco (your local N PA. FGB-D was original ly developed so that
te lephone company) were to put an incoming trap when you got the dialtone you cou ld enter j ust

Page 6 July. 1987 1600


are caught
the number you were cal ling and your cal l would dialing a 950. The IC would receive:
go through; thus alleviating authorization codes. KP + II + 100 (ANI) + ST
FGB-D can also be used as FGB-T, where the KP + ST
customer enters a code but the switch knows
The KP + ST gives you the dialtone, but the I C
where the cal l is coming from. This could be used
has your number b y then.
to detect hackers, but has not been done, at least
BOO Numbers
not in my switch.
Now that we have the feature groups down pat
FGB-D was the prelude to Feature Group
we wil l talk about 800 numbers. Invisible to your
o (FGOI. FGD is the heart of equal access. Since eyes, there are two types of 800 numbers . There
FGD can only be provided by electronic offices,
are those owned by AT&T-which sel l s WATS
equal access is only available under ESS (or any service. There are also new 800 exchanges
other electronic office). FGD is the signal l ing
owned by the I C's. So far, I believe only MCI, US
used for both 1+ dialing (when you choose an IC
Sprint, and Western Union have bought their own
over AT&T) and 1 OXXX dialing (see equal access
800 exchanges. It is very important not to use
guide, 2600, March 1987) . The signal ling format
codes on 800 numbers in an exchange owned by
for FGD goes as fol lows:
an IC. But first. . . .
KP + II + 100 (10 digits) + ST fol lowed by When you dial a n AT&T 800 number that goes
KP + 10D + ST to an IC's switch the fol lowing happens. The
The first sequence is cal led the identification
AT&T 800 number is translated at the AT&T
sequence. This consists of KP, information digits
switch to an equiva l ent POTS ( P l ain O l d
(II), and the cal ling party's telephone number Telephone Service). This number i s an FGA
with NPA (10D ANI) finished up with ST. The number and as stated before does not know
second or address sequence has KP, the cal l ed
where you're cal ling from. They might know what
number (10D) fol lowed by ST. There is a third
your general region is since the AT&T 800·
FGD sequence not shown here which has to do
numbers can translate to different POTS numbers
with international cal ling-I may deal with this
depending on where you're calling from. This is
in a future article. When the IC's switch receives
the beauty of FGA and AT&T WATS but this is
an FGD routing it wil l check the information
also why it's being phased out.
digits to see if the cal l is approved and if so put
On the other hand, IC-owned 800 numbers are
the cal l through. Obviously, if the information routed as FGD cal l s-very deadly. The IC
digits indicate the cal l is coming from a coin
receives:
phone, the cal l wil l not go through.
KP + II + 100 + ST
nil il I 1111 01 01 InIul1lllllon dllill CIIIIIII y I11III IIV Bell KP + BOO NXX XXXX + ST
IIpInIIng ca.niII. When you call an IC. 800 number which goes to
CadI s.na Manlng
00 IdInIIIICItIon lllgullr 1InI, no 8plCiliInItIMnI an authorization code-based service, you're
01 IdInIIIICItIon ONI 10plrllDr Numblr Id lnlIIlCltlDO) taking a great risk. The IC's can find out very
IIIIIItIfII1Y lIMa
02 IdanIIIICItion ANIIlIIurl easily where you're cal ling from. If you're in an
06 IIIInIIIIcau. IIDIII Dr MoIIl electronic central office your cal l can go directly
07 IdnIIICItIoR Clllnllll, 1IIIIpllll, iDmlll, lie. over an FGD trunk. When you dial an IC 800
08 IdriIICItIaR IIIIIrLATA rIIIrIcIId
10 Addna lOX l1li Clil number from a non-electronic CO your cal l gets
13 IIIInIIiIInII 011.: dine! dllllnCl dilild routed through another switch, thus ending up
15 InInIIiIIII 0111l1li: apnIDr IIIiIIId
with the same undesirable effect.
27 IIIMtIIICItIon CaIn
68 ...1ICI1iIIn IIIIIrLATA-ratrlcllll1I1III or_I MCI is looking into getting an 800 billing
78 ' 1dIIII1ICItIan IllIrLATA·rlllrlclld hDlpllll, COIIIIII. service tariffed where a customer's 800 WATS
IIIIII, 111:.
95 Addna 959·xxx)( l1li Clil bill shows the number of everyone who has called
it. The way the IC's handle their billing, if they
There is a provision with FGD so when you dial wanted to find out who made a call to their 800
10XXX# you wil l get a switch dial tone as if you number, that information would be available on
dial a 950. Unfortunately, this is not the same as bil l ing tapes. The trick is not to use codes on an
(continued on page 10)
2600 July,I987 Page 7
the telecom informer BY GOLDSTEIN

If you're in New Orleans, a simple spot....Robert Post of Poland allegedly


seven-digit number can wind up costing robbed $86,000 from New York ATM
you $25. That's right, if you call machines and he did it without stealing
976-2767, a $25 charge is added to your cards. He'd simply look over customers'
bill. The money is then donated to the shoulders as they were conducting
New Orleans Symphony to help them transactions and memorize their PIN
payoff a $3.8 million debt. Seems like it code. Then, if the customers didn't take
won't be too hard to run up a $3.8 their receipt (morons), Post would
million debt of your own with this trick. snatch it up and get the card number.
By the way, if you call it from out of the Then, using a special machine, Post
area (area code 504), you11 hear the would create his own version of their
same thank-you message, but you won't cards, complete with a magnetic strip
get charged anything more than a long­ with pertinent information. He also
distance call. Classical music lovers: if needed the Manufacturers Hanover
you have some extenders in New "signature " that is imbedded on the
Orleans, you could quickly put these strip, which apparently has leaked out.
guys back in the black! Only His method worked, but it consistently
kidding .... Bell of Pennsylvania is going set off alarms and that is how he was
to initiate a service that would allow caught.... A new computer system is
customers to hang up during the first 10 working hard in New York State to find
seconds of a dial-it service message and fathers who are delinquent in child­
not get charged. The first to seconds will support payments. Computers at two
be a warning, both of the price of the state agencies are now talking to each
service and of the possibly offending other, allowing a match to be made
content. ... Have you signed up recently between the offender and his employer.
for long distance service from California The employer is ordered to withhold
Discall or Hello America? If so, then whatever is overdue from the person's
you were involved in telephone fraud! paycheck....Nobody understands why
California Discall, also known as New York Telephone embarked on a
Lindahl Enterprises, allegedly sold flat­ hopeless campaign of plastering pay
rate long distance service to hundreds of phones with little blue stickers that said
businesses nationwide, then distributed "New York Telephone, A Nynex
stolen US Sprint access codes to its Company " on them. Perhaps they're
customers. Sprint was also used by suffering from an identity crisis and
Hello America, which reportedly bilked want Nynex phones to stand out from
them for $3,018,818 as of January. You all the others, some of which look
have to wonder why Sprint always seems remarkably similar. But these stickers
to be the victim of these schemes. were so easy to peel off that they had
Perhaps they could work it into their been appearing everywhere except on
ads�"Sprint: the choice of thieves. " Nynex phones--cars, bicycles,
Speaking of which, common criminals refrigerators, even other pay phones that
are getting into the act with a vengeance. obviously aren't Nynex phones. Almost
You can buy stolen Sprint and MCI as quickly as they appeared, all of the
code, on the street, for up to $400. remaining stickers vanished. Now there
(Thi5, incidentally, is a rotten deal-they are huge signs on top of all the phones
usually go bad within a day.) You might that identify them as the precious Nynex
also run across a clandestine "operator " models. They've also replaced all of the
who will place your call for you and faceplates on the front of the phones.
charge you several dollars on the They sure do keep busy at Nynex, don't
(continued on page 16)
Page! July, 1987 2600
***************************************************

An Exciting 2600 Contest


DIFFERENT WAYS TO
ANSWER THE PHONE
8008778000

Tired of just plain "Hello"] So are we.


Send us your ideas on what to holler when
the ringer jingles. We'll give the best entry
a TWO-YEAR subscription to 2600!

NOT EVERYONE HAS TO USE "HELLO".


HERE ARE SOME ALTERNATNES....
"Suicide Hotline, please hold...."
'Yes, Commissioner."
"Operator, may I help you?"
'Wrong number."
"Authorization code, please?"
"Bueno!"

CONTEST RULES: No more than 3 entries per contestant, please. Entries


must be received by September 1, 1987. Entries will be judged primarily on
brevity a n d levity, but other out standing merits including assonance,
dissonance, alliteration, allusion, or shock value will be con sidered.
Deserving entries will be printed in an upcoming issue of 2600 WITHOUT
. contestants' names, unless entry includes the request "Please attribute to
(name or handle)". All judgements are final. Winner will receive a 2-year
subscription or extension to their existing subscription. Runner(s)-up will
receive a I-year subscription or extension.
I

SEND ENTRIES TO:


2600 CONTEST
I
PO BOX 99 I
i•l
MIDDLE ISLAND, NY 11953-0099
Cash value YK of Y2 pence Void where prohibited

--------�- !
************************************** �****�*�� ***�

2600 July,I987 Page 9


how phone phreaks get caught
� IC-owned 800. 800-627 800-666 800-678 800-727 800-759
� The way to find out who owns an 800 800-777 800-825 800-876 800-888 800-937
� exchange is to cal l 800- NXX-0000 ( NXX being 800-950 800-955 800-999
§ the 800 exchange). If this is owned by AT&T you US Sprint
<!:::, wil l get a message saying, "You have reached the 800-347 800-366 800-699 800-877
] AT&T Long Distance network. Thank you for WaslBm Union
;::s choosing AT&T. This message wil l not be 800-988
.§ repeated." When you cal l an exchange owned by And to avoid confusion, these are the AT&T 800
.'"� an IC you wil l usual ly get a recording tel ling you exchanges:
-.:::.
that your cal l cannot be completed as dialed, or 800-202 800-21 2 800-221 800-222 800-223
else you wil l get a recording with the name of the 800-225 800-227 800-228 800-231 800-232
IC. If you cal l another number in an AT&T 800 800-233 800-235 800-237 800-238 800-241
exchange (i.e. 800-NXX-01 72 ) the recording you 800-242 800-243 800-245 800-247 800-248
get should always have an area code fol lowed by 800-251 800-252 800-253 800-255 800-257
a number and a letter, for example, "Your cal l 800-258 800-262 800-263 800-265 800-267
cannot be completed as dialed. Please check the 800-268 800-272 800-282 800-292 800-302
number and dial again. 31 2 4T. " As of last 800-31 2 800-321 800-322 800-323 800-325
month, most AT&T recordings are done in the 800-327 800-328 800-331 800-332 800-334
same female voice. An MCI recording wil l tel l you 800-336 800-338 800-341 800-342 800-343
to "Ca l l customer service at 800-444-4444" 800-344 800-345 800-346 800-348 800-351
fol lowed by a switch number ("MCI 20G"). 800-352 800-354 800-356 800-358 800-361
Some companies, such as US Sprint, are 800-362 800-363 800-367 800-368 800-372
redesigning their networks. Since the merger of 800-382 800-387 800-392 800-402 800-41 2
US Telecom and GTE Sprint, US Sprint has had 2 800-421 800-422 800-423 800-424 800-426
separate networks. The US Telecom side was 800-428 800-431 800-432 800-433 800-435
. Network 1 and the GTE side was Network 2. US 800-437 800-438 800-441 800-442 800-443
Sprint wil l be joining the two, thus forming 800-445 800-446 800-447 800-448 800-451
Network 3 . When Network 3 takes effect there 800-452 800-453 800-457 800-458 800-461
wi l l be no more 950-0777 or 10777. A l l 800-462 800-463 800-465 800-468 800-471
cu stomers w i l l have 1 4 digit trave l cards 800-482 800-492 800-502 800-51 2 800-521
(referred to as FON cards, or Fiber Optic Network 800-522 800-523 800-524 800-525 800-526
cards) based on their t e l ephone n u mbers. 800-527 800-528 800-531 800-532 800-533
Customers who don't have equal access wil l be 800-535 800-537 800-538 800-541 800-542
given seven digit "home codes". These 800-543 800-544 800-545 800-547 800-548
authorization codes may only be used from your 800-551 800-552 800-553 800-554 800-555
home town or city. The access number they wil l 800-556 800-558 800-561 800-562 800-563
be pushing for travel code service wil l be 800- 800-565 800-567 800-572 800-582 800-592
877-8000. This cutover was supposed to have 800-602 800-61 2 800-621 800-622 800-624
been completed by June 27 but the operation has 800-626 800-628 800-631 800-632 800-633
been pushed back. 800-634 800-635 800-637 800-638 800-641
One last way to tel l if the port you dialed is in 800-642 800-643 800-645 800-647 800-648
an IC's 800 exchange is if it doesn't ring before 800-652 800-654 800-661 800-662 800-663
you get the tone. When you dial an FGA number it 800-665 800-667 800-672 800-682 800-692
wil l ring shortl y but when you dial 1 OXXX# you 800-702 800-712 800-722 800-732 800-742
get the tone right away. Last but not least, I wil l 800-752 800-762 800-772 800-782 800-792
provide you with a list of 800 exchanges that are 800-802 800-812 800-821 800-822 800-824
owned by IC's. A majority of them are owned by 800-826 800-828 800-831 800-832 800-833
MCI. 800-835 800-841 800-842 800-843 800-845
Mel 800-847 800-848 800-851 800-852 800-854
800-234 800-274 800-283 800-284 800-288 800-855 800-858 800-862 800-872 800-874
800-289 800-333 800-365 800-444 800-456 800-882 800-892 800-902 800-912 800-922
Page 10 July, 1987 2600 (continued on page 20)
CELLULAR FRA un �
g
control head's microphone wires. If it's avai lable, operation right down to i ts channel and RF output S·
a schematic diagram w i l l show which CMT bus power. If the MTSO doesn't recognize the �
I:;..
lines carry the transmit audio; coupl ing the signal received ESN/M I N pair as valid, it retums a �
there would be preferable. Acoustic modems can reorder signal and w i l l not process the cal l. I n �
be interfaced acoustically, or by coupling the mic most cities with cel lular systems there are two �
and speaker wires to those on the control head or carriers: the wireline operator ( usually Bel l or the �
to the appropriate bus l ines. D irect-connect local telco ) and the non-wirel ine operator, an -:::
modems, answering machines, reg u l ar and independant company. Both maintain their own
cordless telephones, and other devices can be MTSO and network of cell-site repeaters, and
interfaced to a CMT through the AB1 X cellular occupy separate halves of the cel lular radio band.
interface manufactured by Morrison & Dempsey Non-wirelines operate on system A (channels
Communications (81 8-993-01 95) . This $300 001 to 333), and wirelines oll system B (channels
device is a one-l ine PBX that connects between 334 to 666).
the transceiver and control head and provides an Custom-Ca l l i n g feature s such as ca l l­
RJ-1 1 C jack that accepts any direct-connect forwarding, cali-waiting, and three-way cal ling
telephone accessory. It recognizes touch-tone are all standard with most cel l ular carriers, but
and pulse dialing, provides 1 .0B equivalent the procedures for using them differ so it's best to
ringing voltage, and generates dial and busy cal l the carrier for more information .
tones when appropriate. Obtaining Codes
Access Codes The most difficult task for cel lular phreaks and
Every CMT manufactured has a unique ESN, pirates is obtaining usable ESN's and M I N's. One
which is a four-byte hexadecimal or 1 1 -digit method involves having an accomplice who is
octal number i n a ROM soldered directly to the employed at a CMT installation center. They w i l l
logic board. I t's supposed to be there for l ife and have a file o n every CMT installed a t that
never removed. Some newer CMT's imbed the location, including the ESN's and MIN's assigned
ESN in a VLSI chip along with the un i t's program to those subscribers. Using several codes from
code, which makes ESN modifications virtually one source could focus attention there, however.
impossible. The ESN is a l so imp rin ted on the Another method involves the help of an inside
rece i v e r I D p late moun ted on the o u t s i de person at the cellular carrier's customer service or
housing. When converted to octal ( 1 1 digits), the b i l l i n g department, where many low-paid
first three digits specify the CMT manufacturer, employees have access to thousands of valid
and the other 8 identify the unit. Typical ESN's ESN's and MIN's. The most sophisticated
might be 1 350001 4732 (octal) for a NEC brand method requires interfacing a CMT's AID
CMT, and 8 E01A7F6 (hexadecimal) for a circuitry to a personal computer, enabling one to
Novatel. The other important chip is the NAM, literally pick valid codes out of thin air.
which contains the MIN (NPA-XXX-XXXX), lock Progl1lllllling the CMT
code (keeps the kids from using it), and various Once a valid ESN/MIN pair is obtained, it
model-specific and carrier-specific codes. Some must be programmed into the CMT's ROM's.
newer CMT's have no NAM at all and use an Some CMT manufacturers use different devices
EEPROM which allows a technician who knows and memory maps, but most adhere to the AMPS
the maintenance code to change NAM data 16-pin, 32x8 bit format. The most common
through the control head keypad. ROM's are Signetics 82S23 (open collector) and,
Basically, when one attempts to make a CMT 82S123 (tri-state) or equivalents, but it's best to
call the transceiver first automatically transmits check the part numbers used in your unit. The
its ESN and NAM data to the nearest cell-site existing ESN ROM should be carefully removed
repeater by means of the overhead data stream, from the logic board using grounded desoldering
or ODS. The ODS is a 10 kilobaud data channel tools and read using a NAM programmer's bit­
that links the CMT's computer to the MTSO editor mode. Any PROM programmer that is
computer, which controls the phone's entire device-compatible can be used, but dedicated
(continued on page 14)
2600 July, 1981 Page II
The Letters
On Disclaimers compa ny)? I wou ld l i ke to tu r n myse lf i n
for to l l fra ud. M y n a m e i s ( i nsert n a m e
D e a r 2600:
o f some person y o u w i s h reve n g e o n )."
I n t h e J u l y 1 984 issue of 2600,
You ca n g u ess what h a ppens from
Q u a s i Moto, sysop of t h e late P lover­
there. . . .
N et B B S s a i d he had the "perfect"
T ec h n ocracy nowl
d iscl a i me r for a B B S. I have some
The Hooded Claw
f r i ends who a re sta rt i ng a B B S , and
W h a t y o u su g g e st i s i mm o ra l ,
t h ey cou ld really use h i s "perfect"
u nj u s t. s n e a ky , d i s g u sti n g , a n d
d i sc l a i m er.
horrible. I t ' s also incomplete. The
MAC???'
number to call is 703-641 -9292. It
Th e r e i s n o s u c h t h i n g. Ma n y
belongs to the Communications Fraud
computer bulletin boards ask the
C o n t r o l A s s o c i a t i o n , t h a t sca r y
question "Are you a member of the
organization that gathers information
law enforcement commun ity?" A nd
fr o m a l l o f t h e l o n g d i s t a n c e
members of the law enforcement
compani es. They recently plastered
community simply answer in the
Texas Tech with posters, a likeness of
n egative. You won't find many judges
which appears on this page.
who will sympathize with a defendant
that was "lied to" by a cop. Other'
boards claim they're not responsible
for anything that's posted by others.
Well, that may be so, but if the law this
IT'S A CRIME
month says sysops are responsible,
they will feel the heat. disclaimer or no
disclaimer. So what are we saying?
Disclaimers are useless and offer a
false sense of security. In many cases
they do more harm than good because
the very presence of a disclaimer leads
some to believe that something illegal
.is going on. You're better off running a
board you can be proud of and whose
contents you 're prepared to defend. It
being the 80's, you may very well have
to justify your existence.

Texas Toll Fraud


,Dear 2600:
E n c l osed i s a tabloid a rt i c l e about
Suggestions, Comments,
' acces s code to l l fra ud on T exas col lege Dear 2600:
camp u ses. H ope you g uys get some C a n you toler ate a nother comme nt
us e or l a u g h s from it. on the n ew format vs . 3- r i ng b i nde r
It m e n t i o n s a n u m ber set up by Texas c o m p a t i b i l i t y? A d d a n e n t i c i n g
Tech for students to tur n themselves i n ce nterfold p icture. Maybe then your
for to l l fra u d . H a s a nyon e ever readers wou l d rea l ize that opened, the
' considered do i n g the fol lowing? n ew format is rea l ly the 3- r i ng bi nder
" H e l lo, ( i nsert n a m e of long d i stance format "sort of on its s id e" . Some

Page 12 July, 1987 2600


Never Stop
creative h o l e p u n c h i ng , a nd, by gol ly, computer data fro m one lo cati o n to
the n ew format fits in a 3 - r i ng b i nderl a nother- specifica l ly, I want to be able
(You c a n h e l p , of course, by leav i ng a to access a com puter B BS fro m my
bit m ore m a rg i n at t h e top of the n ew home locat i o n , about five m i les away.
page format. ) B ut, I want to be a b l e to do t h i s witho ut
N ow what d o I d o with m y address i nc u r r i n g per- m i n ute tol l c h a rg es. The
l a be l s? I j u st r ecently t r i ed t h e " new sysop is a f r i en d of m i ne and wou ld
P r i v a t e S e c t o r b u l l e t i n b o a r d" , p r o b a b l y be a b l e to co nn e c t t h e
a d v e r t i s e d on t h e J a n u a r y a n d computer t o a rad i o l i nk d u r i ng the t im e
F e b r u a ry back covers. Why no a n swer I w i s h t o use i t , b u t there i s o n e further
at 20 1 -366-443 1 ? prob l e m- n ot o n ly i s the B BS a lo ng
H ow about a n u pdated l ist o f pr ivate d i stance ca l l from m y l ocat ion; it a lso
B B S n u m b e r s? E s p e c i a l l y i n t h e h a ppens to be on the other s ide of an
Western p a rt of t h e cou ntry. Anyo n e i n i nt e r n at i o n a l border, i n S a u lt Ste.
t h e Los Ang e l es a rea h ave a n y good M a ri e , O ntario, C a nada.
ones to s h a re? I rea l ize that o n e possi b l e sol ution
The RAM wou ld be to use a m ateu r pa ck et radio,
Not a bad idea for hole placement. At but n e it h e r m y f r i e n d n o r I a re
the moment though, it's not a viable a m ateu rs, nor, q u ite fra nk ly, do we
option for us. have any des i re to becom e ham r ad io
The entire hole controversy has o p e r a t o r s. W e h a v e t h r e e b i g
really gotten out of hand Is it so hard to objections to a m ateu r rad i o-fi rst. we
file something away that doesn't have don 't want to wa ste t i m e try i n g to lear n
holes in it? Let's see if we can come up the ant i q u ated morse code; second, we
with creative ideas for doing just that. have m et far too m a ny amate u rs who
Private Sector will not be coming seem to th i nk of am ate u r radio as t h e i r
back up, unfortunately. But we are persona I frate r n ity, a n d who a re far too
planning an active 88S future for our w i l l i ng to m ak e tro u b l e for thos e who
read ers. Resp onse to last month's don't share the i r views on how th i ngs
appeal for 88S's nationwide has been s ho u ld be done; a n d t h i rd, the BBS
encouraging. What you will soon see is often conta in s m ess ages of com puter
a list of bulletin boards that have eq u i pment wanted or for s a l e, and I
agreed to be "2600 bulletin boards". s u s p e c t t h a t t h es e wo u l d b e
Each will have its own unique traits, con s i d e r e d b u s in e s s -r e l at ed tr ans­
but will also p o ssess certain key m is s ion s by the FCC and thus co u Id not
similarities and functions. We are in be lega l ly tran s m itted over a m ateu r
the process of determining what the r a d io (and it wo u ld be impr actica l to try
common d enominators sho uld be. an d s egr egate thos e types of m ess ages
Please send .us your input on this. from the r est of the m ess age base).
If the d is tan ce invo lved w ere longer, I
A Horrible Problem wou ld suppos e th at we ar e proba bly
Dear 2600: stu ck w ith M a B e l l, but du e to th e short
I have a r ather sp ecif ic commun i­ d is tan ce I can't h e lp but th ink there
cations problem. L et me hasten to add must be som e way to avo id the to l l . My
that I am s eek ing a co mp letely leg a l fr i end and I can eas i ly ta lk for ho urs via
s o l u t ion, as I d o not w is h to becom e C B r ad io ( a l t hou g h it wou ld be n ice to
i nvo lved in an intern ation a l in c id ent! h ave a so m ewhat mor e pr ivate l ink and
The probl e m is that I want to tr ansm it no "sk i p" interf er en ce), but it is my
(continued on page 18)
261JO· Jul-,Ift7 Pa - 13
.......,
CELL ULAR FRA·UD
:::: NAM programmers have built-in software which switches to the sockets, although a computer
� greatly simpl ifies the process. The ESN printed program would sti l l be needed to determine the
t:l.. on the I D plate ( i f in decimal , convert to hex) proper switch settings. Either of these two
§ shou l d be f o u n d in memo ry and w i l l be approaches would al low quick emulation of any
� immediately fol lowed by an 8-bit checksum CMT at w i l l .
� determined by the 8 least significant bits of the Roaming
.� hex sum of the ESN's four bytes . The old ESN Whenever a CMT is used in a cel lular system
'i:: data (now copied into the NAM programmer's other than the one indicated by the S I D (System
� RAM ) should be replaced with the new ESN and I D ) code in its NAM , it is in the ROAM mode and
checksum . A new blank ROM of the same type the ROAM indicator on the control head w i l l tum
should be inserted into the programmer and on . A CMT can roam in any system i ts home
"bumed . " It would be advisable to solder a Z I F carrier has a roaming agreement with , and most
(Zero Insertion Force) D I P socket onto the logic carriers now have roaming agreements with each
board to accomodate the new ESN chip and any other. If there is no roaming agreement , the
future versions. MTSO w i l l transmi t a recorded voice message to
The NAM chip is usually already Z I F socketed the CMT user with instructions to cal l the carrier
on the logic board for easy replacement . I t , too , (the only cal l the CMT w i l l be able to make) and
should be copied into the NAM bumer's RAM and give his name , M I N , ESN , and American Express
the old M I N replaced with the new one. The NAM Card number. A l l roamed cal ls wi l l then be
checksum should also be updated to reflect the completed by the MTSO and b i l led to the credit
n ew data . A l t h o u g h t h e carrier's system card account. Fortunately, this procedure is
parameters must also be programmed into the becom i n g l ess common as m o re roam i n g
N AM , they can be left the same if the NAM being agreements are made.
changed had previously been on the carrier now Usual ly, a carrier can only determine if a
to be used . All that needs to be changed in this roamer came from a system with which it has a
case is the last four M I N digits and checksum roaming agreement, not the credi tworthiness of
(and maybe the exchange if they're using more that roamer. Consequently, many carriers have
than one ) . An excel lent write-up on NAM been abused by roamers who've been denied
programming is available free of charge from service on their home system due to non­
Curtis Electro Devices (41 5-964-3846) . Ask for payment. Once the home carrier is b i l led for
the May '87 reprint from Cel lular Business roaming services provided by the roamed carrier,
magazine. Bytek Corporation (305-994-3520) it w i l l notify same to add that ESN and M I N to
sells a good budget NAM programmer for about their MTSO's "negative verify" file to prevent
$500, and the operations manual (avai lable further abuses. Several independent companies
separately) explains in detail the memory maps, are estab l i s h i n g system software and data
part numbers, and programming techniques for networks to al low Positive Roamer Verification
most CMTs on the market . This same unit is also ( PRV) which w i l l allow near real-time roamer
capable of programming many ESN chips using val idation by sharing data between carriers.
the bit-editor mode. Some carriers and their Because of the many technical , financial , and
instal lation agents will provide NAM system pol itical details that sti I I need to be resolved,
parameters on request , and some CMT service PRV systems w i l l probably not be in place for at
facilities w i l l provide NAM and ESN memory least two more years. In the meantime , even
maps and schematics of specific CMTs for a fictitious ESN's and M I N 's can roam if they
price. fol low the standard format , although some
One could eliminate the need for a NAM carriers are sharing roamer data on a limited
programmer altogether by programming and basis to prevent this.
interfacing a personal computer to the CMTs To cal l a roaming CMT, the cal ler must know
ESN and NAM sockets. Another approach is to which system that uni t is i n , and call that
interface 2 banks of 8 hexadecimal thumbwheel carrier's roaming number. Roaming numbers
(con tinued on page 20)
Page f4 July, 1987 2600
2600 Exposes New York Tel
In late June, we at 2600 got around to doing
something we've been meaning to do for a long
@
time. We've mentioned before in these pages how
1:OIlUD.a.int .UOftl! to ..iAtaiA ac:ell._t.
unfair it is that telephone companies charge
sa our
.. rd,!;e aacIbilliJlt ac:I;QQCiY . .. HCi...tlr tuted. 01lU' u....
aacI ,.qa1p"lII!t dult prvwo� yo-. vUlt t.al.� ..rri.I: ••
consumers a monthly fee for using touch tones :
Dar1nrJ tb1. tat.. _ fCND4 tMt fOU an _:Lilli • p!Jah�bQ.t.toe
ul ...... , ....... . . 1:...1_ of o.r I:eoo�a ....,.,. tbat �
an ftC¢ be1a9 bU l ed to!' OIIZ' Touc:...-to.. 11.... wbicb -.bl"

They're not providing any additional service or J01IZ'--oii�i'" .:all. to tMI �l.UIl O'M¥' that. t.ype of
.... -.

equipment. The only real technological advance v.1a.. _ .... r f_ J'01I w:Lt:btA
1 0 daya . _
.....:La bll1i.at yoa to!' tile 'rouc:Il-t._
..a:v:Lc:e oa
to plAa
fO\U Aaqu.t.
.. s.pu.De!' 1917 bill. 'DwI _tAll'
they've come up with is a device that can ignore
o:.II.ror_ tor n.id __
CWI_. L . ' :l . .U to!' eacb l.Laa , or
telepaoa. nUliber. aat.
if yeN dhcaat1a_ tJle .. �_ aow aAII deci.4e latA.&" to ...._
it. ot.ber c:barIJ apply.
touch tones coming from nonpaying customers.
_ � •• I;IJald.

'to 41 __ • t.bJ. . _t.t..I:, 51'1 •• _ 1:&11 (711' ''75-''50

Sounds more like blackmail than a service,


t.a &,..ak to • ME'Yioe �._t&ti_.

doesn't it?
So after having received about 25 ca. l l s from
New York Telephone virtual ly begging uS to sign
up for this "service" by July so we wouldn't have
to pay the "instal l ation" fee, we reached the alike, are flabbergasted when confronted with
conclusion that enough was enough. On June 26, ev idence that they're paying over $4 a month per
we mailed a press release to every newspaper, line for this non-service. Take a company with
television and radio station in New York Stat e, as 5 00 lines and this comes out to $24, 000 a year.
wel l as state senators, state assemblymen, and a N ot inconsequential.
whole host of others we thought would be And more recently, we were confronted with
interested . Wel l, as it turns out, many of them additional evidence of wrongdoing. It seems New
were . Inside of a couple of days we were talking York Telephone has taken to sending out undated
to a l l kinds of media people and it would not be an notices informing the customer that they are
exaggeration to say that many thousands of about to be charged for touch tone service since
people now know about this. The support has to uch tones were detected on their line. Many
been terrific. Nobody likes the idea of paying a people disregard this notice because it looks just
little extra every month for something t� at's not like a i l the other pitches they've received to sign
real l y there. And businesses, large and small up for touch tones. So they wind up being signed
up for something they never wanted. Think about
CONTACT:
that. If touch tones were rea l ly a service,
wou ldn't the phone company punish a "violator"
tN C_

2600
1611 '-11_
.. ... �
'I iIWIo l -' ." Y I 1 Ml
.SI61 7ll 1 .!611 by stopping the service, rather than signing the
person up for it?
We must be fair about this, however. New
F"'''''� l t .. ..an. 'i_ y",* r.""_ """ _ "",,,,, � l or ' _ _ ___ w�
(... 'IIII 'O Ill! I ' .... '"._""I PrKlD . ..... '".. _ .....y .. ....... 'o � !IUI ._ m.-....
Y o rk T e l ephone is not the on l y t e l ephone
"' _ _ IICII_p:al ....... ... _.....ly d�I IIIc .. OI _ '......

We _ . ..ft -. <......M'o ... "'IinIIIcIM .-n. O"' ......,.... :'JQIJ. _. , "" .-,. _ _
company doing this. But since they're local to us,
w e felt it only right that we tackle them first.
_ . � _ ,...... � . ....... _ "'"'....-. 'a _n..... _ · __ · mII J--.-
1II _'. ... o/ l .. _ """ �_ ""'fIpu_ 'oI .... ..DftU and .....,.... .. t*- .......-
pW ". ....... 'nIO�... rrI'IIC � _ """' _ __. II "' .... " _ _ "-..._

O dds are your l ocal company is up to the same


u.a _ ....:n '''.".,.au-- ' IW !JeI''ftI ''''* II ..... IftItIod _ P'l' ... '.. . ._ _ d_'
-. -

trickery. If they are, it's up to you to make people


n.e ..... ... 'IIIIdI _ betleflU .t. _. boII _ _ _ _ . Ol Ilaocl.. lM piIorIr _ .
A _ loni d_ .......tler U _ IMCI I ' _ LO " ... "" . rocary plM>ne .....,. _ J _
... . 11o pc:lll ' _ ._ _. "," _ l ' _ "i � d""" _ f"' ".. pe.-
....,,'*"' . Cli.. '""' ...- � .._ _ _. mon <2lll c... tJe ...- "' . __ _ �
TlI.. .... ,-. ....... _ _ .or ,lIt -..puw. aware of it. Call your elected officials and explain
1 1IoIII ....... ....... _ _ _ _ _ _ lO muJU.I_ ' M Ft _ _ u.. ....
c::u _ prta!SIIIIII . I" _ ...... __ <OOOtII I_ _ Ioe ClHl\<efl.ed ... IJU'- � _ can • the situation to them. Keep in mind that most
........aud ,MO M F .-. n. ....... ..... .. _ _ .... buI •• _ _ . ..... _
... .. .....,.... IOt ". ...... _..--Q'".IT _ o...:acr. ln _ """' -. '.. .. ,am-
u.a _ ... ... ,..,.. _ tnl , 96IrI. no _ '.. puw .. .--. l people accept this simply because they don't
� _ r.o '.,.. gj � 1WIICI'I"" _ 'IIM �letu�, .. \II \IIC ... _ ..,. g( 1M
_... T'hcw . le c..._ _ .IKI;......, •.,IdI,ft\ ....... 'ESSl. n.. .,.,.... ....... _ . _ ot understand what's actual ly happening. They're
.,� ... _ IO _ oJl&I , _ _ ""'Ie ".,.. h lldui lne <ODll_ lO oJ .......
_ _ poolOl r"' ,.,...,, 'OfII ocn1Ce .... _ t-·'. The """ • • 't.l e>'aVlIo:Ior< . �IIII IO _ """'"
,_ """ , ... _ _¥ """ �O "." ',II��_ ". h' • ..,.".,., .w...,n'.. ..-. a _ 1o!anI1e thinking precisely the way the phone companies
_ oncrod_. The � tom_ _ .....,.. ".. a ... " IW 'o ' l d .. 'n....,. ... """ ..... _ 'ne l.. ' ....

want them to. By letting people know they're


_ u,n_ _ !I lIaoo e ' ... .er...., -..er ' _ �... ,...... ' ...... """'"'II I ....... '''- ....... Sa.
. ,"fea" "" _ . _ "' _ """"� lor a _ . ... .. pa""" I O �...III """ -......s.

11 1I _ M_ ' .... an ...... ''' � .- , o an d..:t'''.lIr _ _ fi... ' ... ..If ' ...... _ _
ptoono:. ... ....... _ becl... I>I 'n. . _ �1CC. rbo lK'l .. .... _ __ .......auI ... ....... being cheated and by getting them to say
-..noon 10 paw ,111 6"" •.

something abou t it, we're taking the most


IOYER)
important step in reversing an unfair policy.

2600 July, 1 987 Page 1 5 .


Telecom Informer (continuedfrom page 8)
numbers for stool-pigeons:
they? While we're on the subject of 800-CAL L-SPY is for those who want
payphones in New York, we 'd love to to report somebody for espionage ,
know how someone has managed to 800-BE-ALERT is for turning in d rug
scrape a " religious " message into each smugglers, and 800-U SA-FA K E is for
and every one of the payphones in New reporting phony imported merchandise
York City and its surrounding buroughs . to a Customs agent. . . . I n overseas news,
If you look at the silver part of the the numbers to connect directly to
phone, you11 see at least one message, AT&T operators are: from Australia:
usually two, to the effect of "Praise 0014-881-011; from Denmark: 0430-
G od ", " Love God ", or "Thank G od ". 00 10; from England : 0800-89-0011; from
First of all, how d o they scrape the France: 19 (wait for d ialtone) 0011; from
message into the phone? Does this H o l land : 06 (wait for d ialtone) 022-9111;
happen anywhere else in the world? And from Sweden: 020-7 I 5'{)1 I ; and from
would n 't it be nice if all pa yphones said West Germany: 0130-0010. AT&T
"2600 " on them somewhere? Not that operators can also be reached directly
we 'd ever suggest such a from these countries: Bahrain,
thing . . . . Congratulations are in order for Colombia, EI Salavad or, Guatemala,
a Temple U niversity ( Pennsylvania) H ong K ong, Japan, S outh Korea ,
student who managed to add his name Panama , Phillipines, and S pain. From
to a list of merchants paid through a these countries, though , you have to use
bank-by-phone savings account. He dedicated phones, usually located in
made $21,120, which he transferred to airports . And from the U nited States,
his account . Of course , he was caught. you can reach these countries' operators
Otherwise, how would we know about at no cost: England : 800-44 5 -5667 ;
it? .. . l n other rude behavior: Jerry France: 800-33 1-1323 ; H ong Kong: 800-
Edward Gastil, a San Diego ham rad io 992-2323 ; Japan: 800-543-00 5 1; and
operator alleged ly jammed the two-way Panama: 800-872.{)106 . . . . 0ur London
rad io system of the local FBI office . He correspondent has also discovered that
"caused music and other sounds to be it's possible to call toll-free 800 numbers
transmitted on the FBI frequency, in the U . S . simply by inserting 83 before
interfering with regular FBI the 800, such as 0101 83 800 874 4000 .
transmissions , " accord ing to the fed s . The 0101 is the international access to
They a lso said i t caused them some real the U . S . from the U . K . . . . ln England
embarrassing p roblems . And no motive there are a number of organizations that
has been found . . . . Our subscribers in regularly track down published
Alaska have long been complaining telephone numbers of hacker electronic
about their inability to access most bulletin boards to find out if their own
nationwide 800 numbers . Beginning later network telephone numbers a re listed
this year, Alascom will connect Alaskan there for hackers to exploit. If they are ,
callers to all western U . S . and they change them immediate ly . Hackers
nationwide toll-free numbers . One less are retaliating by encrypting the bulletin
thing to complain about . . . . Cincinnati board s . . . .There is a group of German
Gas and Electric is giving meter readers hackers calling themselves the Computer
hand-held computers that will help Chaos Club . They reportedly have links
locate meters and tell whether to expect to environmental and animal protection
a dog in the yard . It sound s like a device activists. They target large companies
they 'd use on Sta r Trek to scan a p lanet with questionable ethics and create
fo r life forms . It's more likely some sort mayhem on their computer systems ,
of a database that keeps track of who either by obtaining data or send ing fake
has d ogs and who doesn't. . . . H otline erro rs to users.

Page 16 July, 1987 2600


D I D Y O U K N O W ?

1. A 35 foot tel ephone pole weighs an average of 1 000 pound s ?

2. T h e s a m e p o l e costs us approximately $ 7 5 .00 to s e t i n t h e grou n d .

3. That we h a v e m o r e female empl oyees t h a n male - 1 24 female,


64 male.
4. \V/e have an average of $356 i nvested for every telephone i n service .

5. Our e n t i re territory encompasses approximately 250 square m i l es .

6. More telephone calls are made o n s tormy days than during clear
weather.

7. A n exten sion telephone costs less than 90c a month .

8. 6 2 , 000 local cal l s a re made daily o n a normal busi ness day.

9. No matter where you telephone from or to; your voi c e travels


both underground and aerial ly, and is a i r cond itioned during its
.
travels through our cables.

1 0. An extension tel ephone in color makes a,n excellent and thoughtful


gift for b i rthdays, anniversaries and special holidays.
"

1l. A lmost 1 0, 000 changes i n telephone equipment w i l l be made by


our i nstallation force during the year 1 960.

1 2. We like to give you service with a Dial.

O fficers and Employees at an nual outing i n 1 9 3 5.

From an old local telephone company's propaganda. This was published in the 1950's.

2600 July, 1 987 Page 17


Letters (continuedfrom page 13)

u ndersta n d i ng that you c a n ' t l ega l ly u nder $400, but I c a n ' t afford one (and
tra n s m i t data via CB radio (and, we'd need at least two ! ) .
u nfort u nately, h e l ives fa i r l y c l ose t o a I have been to l d t h a t it wou ld be
C a n a d i a n D e p a rt m e n t of C o m m u n i ­ t o t a l l y l e g a l to s h o ot l a s e r b e a m s
c a t i o n s l i s t e n i n g p o s t ) . We h a v e across t h e r iver . B u t neither of u s a re
t h o u g h t a l ot about va r i o u s m et hods of up on a h i l l ( a n d t h u s " l i n e of s i g h t " to
acco m p l i s h i ng what we wa nt to do, but the other) a n d bes ides, such common
everyt h i ng seems to h ave some snag l oca l occu rences as fog a n d very la rge
attached. l a ke fre ig hters sa i l i ng by cou ld eas i ly
We h a v e t u r n e d up s o m e r a t h e r d is r u pt com m u n ications.
c u r io u s t h i ng s i n t h i s q u est t o send free It's rea l ly frust ra t i ng that we shou l d
data . For exa mple, a com pany ca l led h ave to go t h ro u g h a l l o f t h i s t o t r y a n d
E lectro n i c Systems Tec h n o l ogy ( 1 03 1 obta i n to l l -free co m m u n i ca t i o n s
N. K e l l o g g St r e e t , K e n n ew i c k , between two locations that are l ess
Was h i ngton 99336, phone ( 509) 7 3 5 - t h a n f ive m i les apart. By a l l r ig h ts, it
9 0 9 2 ) m a ke s a d e v i c e c a l l e d t h e s h o u l d be a l o c a l t e l e p h o n e c a l l
" E S T e e m W i r e l e s s M o d e m " . F ro m between S a u lt Ste. M a r ie, M ic h i g a n
w h a t I ca n te l l , t h i s devi ce i s a cross a n d S a u lt Ste . M a r i e, O n ta r io . B u t (my
between a Term i n a l Node Contro l l e r persona l op i n ion fo l lows) the M ic h i g a n
( a s u s e d by t h e h a m s ) a n d a Pu b l i c Service Com m ission shou ld be
t r a n sc e i v e r . I t t r a n s m its o n 24 r e n a m e d t h e " M i c h i g a n Te l e p h o n e
c h a n n e l s i n the freq u e n cy range of Com p a n y I ncome Protect ion C o m ­
7 2 . 040 to 7 2 . 960 m hz . It is l i censed m iss i o n ", beca u se they consistently
u s i n g "FCC form 574" ( u nder "Pa rt seem t o favor t h e i n t e r e s t s o f t h e
90" of the FCC reg u lat ions, I be l i eve). te l e p h o n e compa n i es (espec i a l ly
And when I f i rst heard a bout t h i s u n it. it M ic h i g a n Be l l ) over t hose of telephone
was be i n g u s e d t o t r a n s m i t d a t a consu mers. O n e of t h e i r recent act ions
between t h e U n ited States a n d Mexico. was to proc l a i m that t h e re wi l l be no
I ' m to l d that it can be lega l ly used i n new Extended Area Service areas in
C a n a d a as we l l , b u t what I ' m not c l e a r the state of M ic h igan, a n d that i n fact.
on i s whether it can lega l ly b e u sed for some exi st i n g Extended Area Serv i ce
cross-border traff i c between the U . S . m a y be d i s c o n t i n u ed i n t h e f u t u re
a n d C an a da. Also, i t appears that t h i s ( Extended Area Serv i ce is the p h rase
u n it is i ntended for business u s e d to d e n o t e t o l l - f r e e c a l l i n g
appl ications, a n d it seems that i t m ig ht betwe e n t e l e p h o n e exc h a ng e s i n
not be poss ib le to l icense it for what n e a r by l oc a t i o n s ) . T h e r e a r e o t h e r
w o u l d b a s i c a l l y be c o n s i d e r e d a reas a long the U . S . /Canada border
" hobbyi st" use (despite the w h e r e to l l - f r e e c a l l i n g is i n effect
transm ission o f the "buy/se l l " betwee n two exchanges on oppos ite
messages t hat a re forbidden on the s i d e s of t h e l i n e ( S w e e t g r a s s ,
amate u r band). I f you fee l that I a m M o n t a n a / C o u t t s , A l be rt a a nd Po i nt
wrong i n a ny of these ass u m ptions, Roberts, Was h i ngto n /Va ncouver, B . C .
p l ease fee l free to cha l lenge them . In a re tw o that I know of) but w e a r e not so
the meantime, there is one further l u cky.
obstac l e-eac h w i reless modem costs I n fact. not on ly is it a long distance
over $ 1 .ooo ! I ca n 't i m a g i n e why the ca l l across the border, but we can 't
c o st is s o h i g h w h e n an a m a t e u r even ut i l ize the services of a ny of the
Term i n a l Node Contro l ierlTra nsceiver a l t e r n a t e l o n g d i st a n c e c o m p a n i e s .
c o m b i n a t i on ca n be p u r c h a s e d f o r With t h e excepti o n o f AT&T, none of
(continued on page 22)
Page 18 July. 1987 2600
2600 marketplace
F O R S A L E : ATA R I 1 3 0 X E C o m p u t e r ,
ATA R I 1 030 modem, 1 050 d i s k d r ive, 1 3 WANTE D : Look i n g for a good used 5 o r 1 0
i n c h S h a r p c o l o r TV, K o a l a P a d , w o r d mega byte h a r d d r ive for t h e App l e I I series
p r o c e s s i n g , g r a p h i c s and t e l eco m m u n i ­ of com puters. I f you a re s e l l i n g one or know
cations software, m a n u a l s . L i ke new. Send of a nyone that is t h e n send rep l i es to: B r i a n
p h o n e # to : Box 5 7 1 , Forest H i l ls, NY 1 1 3 7 5 . F . , 1 003 W. M a i n , Apt. 3 , Ottawa, I L 6 1 350.
C O M M O D O R E 8- B IT/AM IGA U S E R S TA I WA N ! A l l T a i w a n c o m p u t e r s a n d
p l ease send yo u r best t e l ecom u t i l ities to accessories ava i l a b l e for d i rect s h i pment
M a r k S . , 1 1 1 48 B u rkard Ln, R o u g h & for cost p l u s s h i pp i n g p l u s 3% (q u a nt i t ies of
Ready, CA 9 5 9 7 5 . If I get e n o u g h together, l 50 0r m o r e ) . G i l e s , PO Box 1 2 566, EI Paso,
wi l l ret u r n you r d i s k with other peop l e ' s TX 799 1 3 .
s u b m i ss i o n s . I N E E D I N FO o n a powe r s u p p l y m a d e for
B E ST HAC K E R A N D PH R EA K E R wr itten Western E l ectr i c by AC M E E l ectr i c Corp . i n
p u b l i c dom a i n softwa re for the App l e I I 1 97 1 . It i s d e s i g n a t e d : R e c t i f i e r
fa m i l y . Two d o u b l e s ided d iskettes fu l l of S e m i co n d u ctor Type-J87233A-2 LI . I n p u t
co m m u n icat ion a n d dep rotect ion u t i l it i e s . i s 2081 24Ov, o u t p u t 48v/30a u s i ng' S C R ' s
These prog r a m s w e r e com bed f r o m the best as control e l e m e nts. Any i nfo wou ld be
BBS and c l u bs nationwide. S e n d $ 1 0 cash, a p p r e c i a t e d . A s c h e m a t i c wou l d be
c h eck, o r M O to M a r k B., 1 486 M u rphy R d . , wonderf u l . I ' l l b e g l a d t o r e i m b u rse copy i ng
Wi l m i ngto n , O H 45 1 7 7 - 9 3 3 8 . costs. J. K l e i n , 1 2 330 Ta k i l m a R d . , Cave
WANTE D : Tec h n i ca l d a t a f o r p a y phones, J u nct i o n , O R 9 7 5 2 3 .
dot m a t r i x p r i n t e r s , a n d / o r m o d e m s . F O R S A L E : T e x a s I n s t r u m e n t "Afe i s ­
Lo o k i n g for s c h e m a t i c s a n d t h eory o f per u r it e r " ( S i lent 7 00 s e r i es ) i nte l l igent
operat i o n . Ca l l ( 205) 293-6333/6395, 7 to d a t a t e r m i n a l . M a n y u s e s . R e a so n a b l e .
4 CST. Ask for A i r m a n Paroch e l l s . C a n not Contact Ted K . , P O Box 5 3 3 , Au b u r n , NY
accept co l l ect ca l l s . 1 302 1 -05 3 3 .
TA P BACK I S S U E S - com p l ete set (vo l . 1 - S C H E M ATI C S - B UY, S E LL, TRAD E . We
84 ) of h i g h q u a l ity copies s h i pped v i a UPS or a re i nte rested in e n l a r g i n g o u r co l l ect ion of
f i rst class m a i l for $ 1 0000. Over 400 pages c i rc u it d i a g r a m s for i nterest i n g e l ectro n i c
of TAP m ater i a l i nc l u d i n g schematics and dev i ces. Send l i st of w h a t y o u want/ h ave
spec i a l reports . C h ecks / M . O . to " P . E . I . " and a SAS E to: J . R . "Bob" Dobbs, PO Box
C a s h , M . O . s h i pped s a m e day. SASE for 444 , S h awnee M i ss i o n , KS 66202 .
s a m p l e . Pete G . , P . O . Box 463, Mt. La u r e l , 2600 M E ET I N G S . F r i days at 5 pm at the
NJ 08054. C it i corp Center in t h e Atr i u m- 1 53 East
D O C U M E NTAT I O N o n e l ectro n i c & d i g it a l 53rd Street, N ew York C ity . Come by, drop
P B X ' s a n d switc h i n g system s . Wi l l i ng to o f f a rt i c l e s , a s k q u e st i o n s . W e ' l l b e i n
t r a d e / p u r c h a s e . A l s o l o o k i n g for B e l l P h i l a de l p h i a o n J u l y 3 1 a t t h e G a l l e ry
System Pract i ces a n d other s u c h S hopp i ng Cente r . T u r n page for d i rect i o n s .
p a r a p h e r n a l i a . Write to B i l l , c/o 2600, PO Questions? Ca l l 5 1 6 - 7 5 1 - 2 600.
Box 7 5 2 B , M id d l e I s l a nd , N Y 1 1 9 5 3 . GOT S O M ETH I N G TO S E LL? Look i n g for
3 2 K M O D E L 1 00, U 1 - Rom I I , drive, T S ­ somet h i ng to buy? O r trade? Th i s i s the
D O S , s p r e a d s h e e t , modem c a b l es , AC p l a c e ! T h e 2600 M a rketp lace is free to
a d a ptors, b r i efcase i n c l u ded, good s u bscr i bers ! J u st send us whatever you
c o n d i t i o n , $ 1 2 0 0 . N ew , m a k e a n off e r . want to say (w i t h o u t m a k i ng i t too l o n g ) a n d
Ta ndy 2000 vers ion o f WordPerfect 4 . 0 we ' l l p r i nt it! O n l y peop l e p l ea s e , n o
$ 1 50 or trade f o r 1 200 o r 2400 ba u d b u s i n esses !
exte r n a l modem . I B M PC & XT & AT ve r s i o n Dead line for August issue: 8 / 5 /87.
of WordPerfect 4 . 1 a n d M a t h P l a n 2 . 1 . $250
or trade for 1 200 o r 2400 ba u d exte r n a l
mode m . C a l l ( 803 ) 244- 6429 or (803) 2 3 3 -
5 7 5 3 . A s k f o r Pa u l .

2600 July. 1987 Page 19


CELL ULAR FRA UD (continued from page 3)
(continuedfrom page 14)
digital switching was capable of if
vary, but are usually in the format : ( N PA)XXX­
phreaks and hackers didn 't get in and
ROAM , where N PA is the carrier's area code and
show them.
XXX is the MTSO exchange. Cal l i ng that number
Hackers have, through the help of
w i l l return a dial or ready tone, after which the
2600, exposed entrapment schemes that
roamed CMT's ful l M I N should be entered in
shady individuals engineered for reasons
Touch-Tones. After a few seconds, the mob i le
of greed and visions of glory.
unit w i l l ring or the caller w i l l hear a recording
. In 1 985, a bulletin board system
stating that the mobi le unit is out of range.
belonging to 2600 was raided by law
Te l o c a t o r P u b l i c a t i o n s ( 2 0 2 - 4 6 7 - 4 7 7 0 )
enforcement authorities on the shabbieSl
pub l i shes a nationwide roaming d irectory for
of pretexts. Before we were around, they
travel lers with cel l u lar phones.
would have gotten away with it without
Cellular Telephone technology offers phone
any problem. But we were able to draw
phreaks complete safety by allowing m i les of
phys! cal separation from the wire pair, and by
attention to the absurdities and
misconceptions. A nd the average person
offering thousands of lines to choose from . In
listened.
addition , a l l this is possible from just about any
This month we embark on another
location , even from a car, boat , train , or aircraft.
educational campaign-proving to the
I t is these characteristics that are attracting a
average person that the phone
sophisticated new breed of phone phreaks who
company s touch tone fee is a farce. We
w i " e n j o y u n p recedented c o n ven i ence a n d
have thefacts and now we 've attracted
security.
attention to this matter. The next couple
catch i ng ph reaks of months will be interesting.
They 'll be other campaigns in the
(continuedfrom page 1 0)
future-and more mistruths. But,
800-932 800-942 800-952 800-962 800-972
looking back on our back issues, we can
800-982 800-992
see that what we 've already been
(Other exchanges can be used by local phone
through hasn 't been for naught.
companies- New Jersey Bel l , Mountain Bel l ,
We hope you take the opportunity to
etc . )
further understand our unique world by
S o for the record , don't use 800-877-8000
examining what are surely on the way to
( U S Spri n t ) or 800-950- 1 022 ( MC I )
becoming historical relics. It certainly
i l leg itimately. 800-345-0007 ( U S Sprint) and
would give us more space to move
800-624-1 022 ( MC I ) are much less dangerous.
around if you did.

Directions to the 2600 Meeting in Philadelphia


at 5:00 PIT!- in the Gallery Shopping Center.
F r ? m 30th S t reet S tatlOn � where Amtraks come in), go upstairs ( if you've ever seen
Wl�ness, you may rec �gmze the men 's room) and follow the ramp to the SEPTA
t � m towa rds center city. Take this train two stops to Market East. (NOTE: This
nde costs $ 1 .50 but the conductor doesn't take tickets until after Market East. So

don 't ma e it obvious where you 're going and you 'II get a free ride .) At Market East,
go upstalfS to the Gallery Shopping Center and go to the lower level. Look for
people with 2600 buttons wandering around . See you there !

Page 20 July, 1987 2600


SAU D I ARAB IAN B BS LI ST
from The Vete ra n Cosm i c Rocker

ii ,.....; a
it
ii :J ":""""! � -:-i -: -1 ,;"""; o:- ! � -: -1 -:-! -;-i ":'"-i Ii "
"

!i U H >.. H
if
M� H
-
: '

II '0 !i
.0:-:
' :.'

:Tj
"
>- H
>- ii
.":":
: :;

:: : I ....... ........ ....... Ii I::;:


il ill r·� c·� (".� c-.� H
"
7i:' .. :li .,-i ':� -:-: ri ii ii
...... .
... .... ....... .
.. ....
.
.. ..... ........ ...... ..
. ... ........ ........ I i t ··....
. .

o �
..;..) :1)
"'i' -:-i (..� I,-')
H * * -::f :�. >..
a
!I :15 =S'
(0 -::t CI�: 11 �
(T'I .:::::: -:::t Lf) () ";-01 c··� =s: D C:�i
• :--T Cf! cr'; � Ii -:-:
r'''� (.. � (i) (T"i ::;-1 U) Lf= iT! ,
"
!'- (":�: :.£: 1 1
::S:: -:-: ((: C:) (T! CO CO :�..� !i
· Ul !•.D r..... 'l�-: H -:-:
� C:) C::: C-.� -:::j' r·... .. t·.... 'S:
H :- "

� ..q. C:) (".J C) I..D C:�! (I) -::::r -:q- CO :T.i n


n
:-- ;; � :�{: j� G:� :�;:� E:� �(� �(� g�: :S�: li ,S:: ::

· 0 ::U ii G) !i
JJ "-', ,'-', .. --, ,'-', ,'-', ,'-. ,.-.., ,'-. ,'-', ,'-. ,'-', i ! " :--! i!
"
* r: E ":""""! -;-; C".� C::: C:) (I:: C::: C:) C:�: C:�i i�'�i li Cr'! i!
• . :--i :J :s.,: :S: IS: ::�) ::S:: ::S:I ::7�: (S= :S: ::;:1 'S: !: ::S:: >.. n
',-' ...... . ....... '_' '._' '"-,' '_' ',_' '0_"
. �: Z '_' '0_' ii !r� H
if ::: -0 o it
· :--: H _:--=: 0 :-; H
" 0 :"""i "
ij ::...
:S: 1.L n
"
· w !i

· W (0 H
.,....: H
"
"

:jj f� if
r-! U "
a

H
Ii
H
. :-; if
:T; ii
> II
,tj iI
li !1j >- >. ii
!! Z >... c,) ).. iiJ >.. 1 1) H
H :--{ .
:-f iJ :-i lJ I i
!! ....,:: tD +: . :-e ..;..:: 0 :-i H
H =- 'r"'I

:-- -
,

"
ii GJ
Ii !- C
H !- :)
H :J !­
Ii l"rj () I.r-
H !})
iI � -r.:t H
H <I * ii

1600 July, 1 987 Page 2 1


Letters (continued/rom page 18)

the oth e r ca r r iers offer serv i ce here want to explore. If you can both get
(too sparsely popu l ated, they c l a i m ). a c cess to n etwork m a i l thr o u g h
Th i s despite the fact that o u r loca l A rpanet, your friend might be able to
c e n t r a l o ff i c e sw i t c h h a s b e e n upload what you want and you could
converted for "eq u a l access " . Yes, we call up later through your node and
g ot a ba l l ot from M ic h i g a n B e l l , with download If you can figure out a way of
o n ly one choice (AT&T, of cou rse-I lin k ing Telenet (USA ) and Datapac
t h o u g h t you o n ly got those k i nd of (Canada), you could also cut down on
ba l l ots i n R ussi a ! ). I g u ess I shou l d n ' t telephone charges, especially if you
com p l a i n too m uch-there's a n a rea both have local dial-ups. A lthough PC
about 50 m i les from h e re where there Pursuit (the service that allows you
i s no phone service at a l l (the fol ks unlimited data calls for a set fee per
there t r ied to get the M PSC to order a month) has no intention of ever going
p h o n e company to g ive t h e m service, to Canada, you can trick it by dialing an
b u t the M PSC decided it was j u st too alternate carrier's access number and,
I cost l y to r u n l i nes i nto t h e i r a rea, once after waiting an appropriate amount of
. a g a i n p rotect i n g t h e p r of i t s of t h e time, entering your authorization code ·
phone company). and number, just as you would if you
The FCC recently h a d a proposa l were using your own modem to place a
before it to create a " P u b l i c D i g ita l call through an alternate carrier. This
Radio Service" that wou ld have been at least allows you an altern ative,
j u st the th i n g for t h i s type of appl icat ion although it's not much of one. A lso,
(ass u m i n g that t h e C a n ad i a ns wou ld check out the various toll-free options
h ave approved a s i m i l a r service), but on a lt ern a t e l o n g d i st a n c e c o m ­
t h ey t u r n ed it dow n . I 'd l i ke to know panies-there might be a fairly cost­
why some freq u ency somewhere can 't efficient answer there.
be set a s ide for t h i s k i nd of service. I Finally, try being really vocal about
hope the n ext t i m e they w i l l g ive us a this. Forget the computer business­
few measly khz at least. call your elected officials and tell them
Per h aps there j u st i s n 't any way to do you have a friend or relative who's only
what I want to do for a reasonable cost, five miles away and you're sick of
g iven the p resent state of leg a l iti es i n paying through the nose to talk to
t h e U . S . a n d Ca nada (certa i n ly i t i s them. Apparently that worked in other
technologically poss ible), b u t i f you towns-it seems like something could
h ave a n y s uggestions, p lease drop me be done in your case. Make it known
a l i ne. Any ass i stance that you can that the other companies refuse to
provide w i l l be very m uch a ppreciated. serve your community. And if all else
JD fails, you can always mail disks.
You seem t o have really thought this
out pretty carefully. Keep in mind, WRITE FOR 26001
though. that legality is a rather hazy
concept these days when it comes to SEND LETTERS
electron ic communications. What's
legal today may not be tomorrow and
AND ARTICLES
may already not be in someone else's TO :
mind
A lthough we'll most likely get all 2600
kinds of suggestions from our readers, PO BOX 99
these are a couple of options you may
MIDDLE ISLAND ,
Page 22 July, 1 987 2600 NV 1 1 95J-0099
2600 BACK I S S U E S (continued from inside front cover)
1986
PRIVATE SECTOR R E TU R N I N G -Back o n l i n e soon but many questions on seizure rema i n ; THE BAS I C S : DIVESTITUR E : WHA T
HAPPENED ?-an explanation of that which IS confusing the populace; FLASH. AT&T steals customers, Dom i n ican blue boxers. computerized
hooky catcher, Falwell attacked by computer, an astronomical phone bill, d i a l - a -porn update. phone boot h victorious; LEITER S : Getting credit
f r o m a l t e r n a t e c a r n e r s , t r a c i n g m e t h o d s . m o b i l e p h o n e s . M a n itoba r a i d ; 2 600 I N F O R M A T I O N B U R EA U - b l u e box p r o g r a m s ;
SYSTEMATICALLY SPEAK I N G : confusing payphones, code abuse software. centrex features i n y o u r h o u s e . VAX 8650, overcharge hunters;
VMS: THE S E R I E S CONTINU ES-more on secur ity features; IT COULD HAPPEN TO YOU ! �what happens when hackers have a fight; D IAL
BACK SECUR ITY-holes i n the systems; FLASH : abuse of party l i ne, unique obscene caller, news on pen registers, reporters steal Swiss
phones, pay phone causes panic; LETT E R S : asking questions, blue box corrections, Computel com p l a i nt, B B S security; 2600 INFORMATION
B U R EAU-assorted numbers; SYSTEMATICALLY SPEAK I N G : Sprint and U S Tel merge, write protect tabs wrong, Bell Atlantic chooses MCI.
cel l u l a r phones in England, infrared beeper, electronic tax returns, acoustic trauma; AN OVERVIEW OF AUTOVON AND SILVER BOXES-the
m i l itary phone network and how your touch tone phone can play a long; AN AMERICAN EXPRESS PHONE STORY-a memory of one of the
better hacking escapades; F I NAL WORDS O N VMS-security devices and assorted tips; F LA S H : hacker zaps computer marquee, Soviets
denied computer access, calling the shuttle, new ways of stea ling data, computer password forgotten; LETT E R S : corporate rates. defeating
call waiting. r ingback n umbers. where is BlOC?, credit where it's due. special 800 number; THIS MONTH AT 2600: Private Sector's return,
Computel and Compuserve. Telepub '86, a postal m i racle; SYSTEMATICALLY SPEAK I N G : Jamming satel l ites. TASS news service, Soviet
computer update, d i a l i n g the yellovv pages, Nonhern Telecom to destroy CO's. more phones than ever; RSTS FOR B E G I N N E R S-basic
system functions, logi n procedures; MOBILE PHONES: THEORY AND CONSTRUCTION-how to b u i ld your own mobile phone; FLAS H :
British phoneboot h wedding. another l arge S p r i n t b i l l . bad tenant databases. car breathalizers. phone phreak fi ned. Marcos phones for free;
LETT E R S . blue box coding, electronic road pricing i n Hong Kong, UNIX bugs, more on AE hacking; A STORY O F EAVESDROPPING-from
Wor ld War I I ; T H I S MONTH AT 2600: transcripts of Private Sector raid, more on Compute!; SYSTEMATICALLY SPEAKI N G : 6 1 7 to be divided.
Congress chooses AT&T, Baby Bells don't pay AT&T b i l ls, equ a l access 800 n umbers. data encryption. DA failure. AT&T loses its zero;
EXPLOITS I N OPERATOR H ELL-haraSSing operators from Alaska; THE COMPUTEL SCOOP; FlAS H : Bel lcore publ ications go publ ic, US and
France link phones, computer grammar. shower phone. cel l u l a r modem. htgh tech parking meters. Congress ional computer; LETTERS:
foreign phone systems. Russian phone books. numbers to dial on a blue box. Boston ANI. Cheshire Catalyst. CNA. ways of answering the
phone; 2600 I N F ORMATION B U R EAU-Autovon numbers, alternate phreaking methods for a lternate carriers; SYSTEMATICALLY
SPEAK I N G : Wrest leman i a pins Bell. sting boards on the rise, American Network fears hackers. free pay-phones plague New Jersey.
disposable phones, hacker terrorists; COMPUTER C R I M E REVIEW-a review of the repon from The National Center for Computer Crime
Data, HOW TO HACK A PICK-An introduction to the Pick operating system and ways of hacking i nto it; NOTH ING NEW I N COMPUTER
U N DERGROUND-review of a new book; FLAS H : New York's new computer crime law, a $6,829 phone b i l l , hovv big computer crime pays,
public phone secrecy. Capitol H i l l hacker. Citibank money games; LETTE R S : English phreaking. ways of tricking sting BBS's, called party
supervision, 2600 P h u n Book , Captain M idnight, RCI; 2600 INFORMATION BUREAU-some phone numbers; RESOURCES G U I DE;
SYSTEMATICALLY SPEAK I N G : Hands across Telenet. calling Kiev, Nynex bumps off Southwestern B e l l , stock market crash. cell site names.
Videophones; VIOLATING A VAX-Trojan horses, collecting passwords, etc., etc.; THE FREE PHONES OF PHILLY-Skyline providing
completely free service from pay phones; FLASH : town crippled by telco strike. prisoners make i l lega l calls. hacker degrees. New Jersey tops
taps, ex-fed is tapped, water company wants customers' social security n umbers, computers strike again. federal employees "tracked";
LETTER S : ASSOCiation of Clandestine Radio Enthusiasts, ITT correction. NSA. more on VMS. T elecomputist. a 950 trick; 2600 I NFORMATION
BUREAU-World N u mbering Zones; SYSTEMATICALLY SPEAK I N G : AT&T sell ing pay phones, automated operators, cel l ular d i a l - by-voice,
new British phone service, no data protection for Hong Kong, CongreSSional fraud hotline, federal phone f a i l u res, Indiana telco threatens
AT&T; KNOWING U N I X-sending m a i l and general hacking; A TRIP TO E N G lAND-and the fun t h i ngs you can do with phones over there;
FLASH : Phone fraud i n governor's house, Big Brother, Tettec fights back. vandal ism, 9 1 1 calls: LETTERS: shutting down systems. legal
BBS's, VAXIVMS tips, 2600 I N FORMATION B U R EAU-a l ist of telcos, a l ist of area codes and n umber of exchanges; SYSTEMATICALLY
SPEAK I N G : USSR computers, ATM's in C h i na. NYCE, TV blue boxes, government phones, rural radio phones; SOME FACTS ON
SUPERVISION-answer supervision exp l a i ned; RCI & D M S - l oo BUGS; ANOTHE R STIN G E R I S STUNG-Maxfield exposed again; FlAS H :
N SA drops D E S . hackers on shortwave. B i g Brother traffic COP. crosstalk saves a life, I n d i a n phones, video signatures. FBI shopping l ist.
a i rphone causes confusion; LETTERS: Capta i n M idnight. annoyance bureau . SL- l switches. credit. PBX's, SOOword-numbers. public CNA's;
2600 I N FORMATION BUREAU-Winnipeg n umbers; SYSTEMATICI'LLY SPEAKING : Sprint overbi lls, AT&T ranks # 1 , portable VAXes, ca l l
rejection; DEATH OF A PAY PHONE-nasty busi ness; TRAS H I N G : AME R ICA'S SOURCE F O R I N F O R MATION-st i l l moretacties; FlASH : F B I
investigates coffee machine. CIS copyrights p u b l i c software; Navy software. HBO encryption. I n d i a n a "Fones · ' ; LEITER S : N u mbers. telco
ha rrassment, Puerto Rican telephones, Q's and Z's; 2600 I NFORMATION BUR EAU-Overseas n u mbers; SYSTEMATICALLY SPEAK I N G :
E lectronic t a x returns. software makers crash B B S , I C N . U ltraphone. ESS i n Taiwan, NSA wants new c h i p ; ICN-MORE THAN A BARGAIN­
a look at one of the worst phone companies in the world; MASTERING THE NElWORKS-com m u n icating on Arpanet. B itnet. etc. ; FLASH :
R eagan tonures patients. FBI angers parents. Q and Z controversy; LETTERS: Telenet hacking, ANI 's, 81 1 . 976 problems; 26CX>
I N FO RMATION B U R EAU-British BBS n umbers; WRATH OF GOO STRIKES 2600; SYSTEMATICALLY SPEAK I N G : Banks l i n k arms, Sprint
has too many customers. new payphones, n ickname l istings. computer college; A LOOK AT THE FUTURE PHREAK I N G WORLD-Ce� lular
telephones & how they work; HOW CELLULAR PHONES CAME ABOUT AND WHAT YOU CAN �XPECT; THINGS WE ' R E NOT S UPPOSED T O
KNOW ABOUT; FLAS H : Avoiding rejection, phreaks tie u p c i rCU its. N o r t h C a r o l i n a hackers. i nternational h a c k i n g . p a y i n g f o r t o u c h tones,
wiretaps; LETTE R S : Eq u a l access 800 n u mbers. strange n u m bers. I r i s h phreaking. disabling ca l l waiting; 2600 INFORMATION B U R EAU­
Netm a i l s ites; SYSTEMATICALLY SPEAK I N G : Free directories. f i ngerprint 10 system, navigating with CO's, sweeping for bugs.

A l l issues now in stock. Del ivery with in 4 weeks .


MAKE YOUR COLLEC TION COMPLE TE!
- -- - - - --- - - - - - - - - - ------ - - -
--

2600 BACK ISSUE ORDER:


D 1 984 $25 D 1985 $25 D 1986 $25
SEND THIS COUPON WITH PAYMENT TO:
2600 Back Issues
P.D. Box 752
Middle Island, NY 11 953
(your address label should be on the back a/ this/arm)

2600 July, 1987 Page 23


CONTENTS
CELLU LAR FRAUD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
HOW PHREAKS ARE CAUGHT . . . . . . . 6
TELECOM I N FORM ER . . . . . . . . . . . . . . . . . . . . . . . 8
N .Y. TELEPHON E EXPOSED . . . . . . . . . . . .9 .

LETTERS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
2600 MARKETPLACE . . . . . . . . . . . . . . . . . . . . . . 19
SAUDI ARABIAN BBS'S . . . . . . . . . . . . . . . . . . 21

2600 Magazine
PO Box 752
Middle Island, NY 1 1 953 USA.

WARNING:
MISSING lABEL

You might also like