DOYOU HAVE BACK ISSUES OF 26007 If not, look what you're missing!

AHOY!-an introduction to 2


DS HACKERS-FBI Investigator unwlttlnglv reveals tactics and recent activities;
FLASH: LlCA d,scusses GTE raIds, AT&T credit cards, wireless phone trouble; THE TRUTH BEHI ND THOSE 9999 NUMBERS--a tol l free error
story; DA fA: various White House extensions; HACKI NG ON TELENET -how to's of T elenet use; ESS: ORWEll'S PROPHECY-the fi rst in a
series on the fun and dangers of ESS; FLASH: directory assistance changes. computer ai r-ban, AT&T credit cards. etc.; SOME THOUGHTS
ON GARBAGE PI CKI NG-first of a series of trashi ng for val uabl e information as related to a discussion of crosstalk; DATA; COUNTRY
CODES-very last country coe for overseas dIal i ng; THE CONSTITUTION OF A HACKER-a discussion of hacki ng; ALTERNATE LONG
DI STANCE: Mel-hlstorV. systems. and servIces; FLASH: 718. Connecticut wiretaps. Sweden person numbrs, etc.; THE FIRST ATOMIC
BOMB-an i nside story on the event as rel ated to our nation's phone system; DATA: ARPANET HOSTS-l i st of accessible hosts; WHOSE
STRI KE WAS THAT ANYWAY?-a startl i ng anal ysis of summer 83 phone strike; THE TROUBLE WITH TELEMAIL-lscussion of GTE's
i r responsi bi l i ty in protect i ng t hei r system; FLASH: AT&T credi t cards, port abl e pr i sons, 414' s pl ead, etc.; A TRUE SAGA OF
COLIGE 0l --ur arti sti c heritage i n phone bok designs; THE SI MPLE PLISURES OF A STEP OFFI CE-iscussion of i ns and outs of
antiquated phone systems; I BM' S AUDI O DI STRI BUTI ON SYSTEM-using voice messaging technoloy; FLASH: 414 sentencing, eual
access, bank record privacy, etc.; THE WOES OF HAVING A SMALL-TIME RURAL PHONE COMPANY-a true story; DATA: AVAILBLE
AMERI CA' S NEWEST PASTIME-how it works and ti ps for i ts use; ELECTRONI C SWITCHI NG ADVANCES-some of the possible services
and drawbacks; FLSH: Di rectory assistance charges, 260 writer indicted, demise of E-COM, etc; THE DARK AND TRAGIC SI DE OF THE
GRET BREAK-UP-a frank discussion; LTTERS: sysop problems, 51 B-789 an Xstep, etc.: DATA: E-COM ACCESS NUMBERS--ial ups
for the (now-de
unct) service; NY TELEPHONE "LTTER OF DOOM" -a copy of a law enforcement monitoring notice; "LOOK OUT, HE' S GOT
A COMPUTER I -a defense of the hacker VIewpInt; MCI MAIL: THE ADVENTURE CONTI NUES-an analysis of the well-knon faulty E-mai l
system; FLSH: computerize meter-maid, blue bx arrests, anti-hack legislation; I NTRODUCI NG THE ClR BOXI-"pst-pay" payphone
device; LETTERS: new switching equipment. 99 scanning. repulsive operator story, etc. ; SPECIAL REPORT: TRW-BIG BUSI NESS IS
WATCHI NG YOU-how to use TRW, and an assessment olthe potential of thi s system; BUT HOW DOES ITWORK?-a si mple explanation of
the p

one system, wi ri ng. voltages, black

. ri ng. etc.; PRI

ST - review of David Burnham' s bok 'The Rise of the Computer
State ; BE NI CE TO YOUR TELCO-how indIVIduals are abUSi ng their telcos; FLSH: Big Brother i n Miami , NASA computer break-in,
computer export controls, ædirectories; LETTERS: phone scramblers, page numbrs. hacker's o.etc.; DATA: CNA NUMBERS-list of
CNA's; A HACKER' S GUI DE TO AN AREA CODE-a Si mpl e scheme to help "map out" exchanges i n your area; HI STORY OF BRI TI SH
PHREAKING-an account olthe history and techniques; MORE ON TRASHI NG-what to l ok for, where togo, how to act; A FRI END I N HI GH
PLACES-story of a friendly operator; FLSH: NSA insecurity, hacker caught. private directories; LETERS: phone l op. WATS. TAP, etc.;
CAUGHT: HACKER' S VI EW-a story of the personal effects of hacki ng; VITAL I NGREDI ENTS-what makes the phones work: oprators,
switchi ng; FLSH: NSA wants btter phones, crime-computer victim. wiretap lopholes. 911 attacker caught; LETTERS: BSS discussion,
Comsec Letter, Computer Cri me Data, others; DATA: NY TELEPHONE SECURITY NUMBERS; MCI ANECDOTE-ads, vulgarisms, MCI
chairman profole; PHONE BOOK COLGE #2; EXPLORING CAVES I N TRAVELNET -an interesting extender explained; FUN WITH
FORTRESS FONES-what a pay phone does, how people beat them; FLSH: SS computer foul ups, Airfone, wiretaps, 81 B, pay phone attaCk;
LETTERS: bok l ist, SIlver bxing, another hacker' S view; DATA: I C' S AND CARRI ER I DENTI FI CATION CODES-uide to 95 exchange; MCI
MAIL "TROUBLE LETTER"-the harassment bgins; A TIME FOR REFLECTION-the year i n review; MCI MAIL AND EASYLlNK-lectronic
mail horror stories; THE SCARIEST NUMBER I N THE WORLD-true story; FLSH: campaign computer, Pentagon by phone, students bg
computer, electroniC lali. federal phone uprade; SURVEY-reader survey responses; SOME, BUT NOT ALL ELECTRONI C MAIL SYSTEMS­
l i st and price comparisons plus voice messagmg companies; REACH OUT AND GOOSE SOMEONE-l ist of many unique dial-it numbrs.
THOSE HORRI BLI HACKERS STRIKE AGAI N-analysis of Newsweek i ncident; WIRETAPPING AND DIVESTITURE-a l ineman discusses
these topics; GETTI NG IN THE BACK DOOR-a guide to some ppul ar operating systems i ncluding TOPS-10, TOPS-20, and UNIX; 260
I NFORMATION BUREAU: our phone bi l l , our thanks, and other notices; FLSH: IRS and telco data. GEI SCO, KKK computer; LETTERS: BBS
rights, Easyl i nk, Canada loops, i nternati onal phreak day; BITNET TOPOLOGY-a schemati c of the BI Tnet; THE THEORY OF "BLUE
BOXI NG"-history, future, and hov they are used; TRASHI NG ALASKA STYLE-a real trashi ng adventure story; SURVEYI NG THE
COSMOS-a bgi nner's gui de to COSMOS, Bel l ' s computer proram; FLSH: phreak roundups, real TRW cri me, 260 BBS, ædata;
LETTERS; Bell problems. telco discount. mari ne cal l i ng. many questions; 260I NFORMATION BUREAU-acronym l ist of useful telephone
largon; NAI BBS A CHALLENGE TO HACKERS-the role of the hacker; ARE YOU A PHREAK???-humourous review of phreaking; HOWTO
GET I NTO A C. O.-a tour of a central office; FLSH: custom cal l ing, Kenyan pay phones. hacker coke machi ne. IRS computer screw-up;
LETTERS: readi ng l ist. traci ng and law enforcement. UNI X info, NSA phone #; 260 I NFORMATION BUREU-i nteresting phone numbrs.
hov to di al a telephone. New York Tel message; CNA LIST; NSA CI PHER DI SK; WHAT A WHI TE BOX CAN DO-how to bui ld and the use of a
portable touch-tone generator; A PHONE PHREK SCORES-another successful soi al engineering story; HACKING PACKARD-useful
Information about the HP2CX; FLSH: tal ki ng cl ock. computers for communists, robt ki l l s man, war games. si lver pages; LETERS: Tom
T ci mpi dis, secure telephones and cryptography; 260 I NFORMATION BUREAU-MI LNET hosts by loation; PEOPlE EXPRESS TO BE
HACKED TO PI ECES-a lok at People's new anonymous reservation service; HOW TO RUN A SUCCESSFUL TELECONFERENCE-omplete
gui de to Al l i ance Teleconferencing Service; FLSH: hacker bust. pl ice hacker. Reagan doesn't dial kids .
di al-a-dir

computer networks, si lver bxes. 950. remob, tracing; 260 I NFORMATION BUREAU-Al l i ance TeleconferenCing matenal; I NTERESTI NG
Invented the phone, porno phone. wi retap award. AT&T computer steal s; LETERS: information charges. AT&T cutoff, mari ne cal l i ng; 260
INFORMATION BUREAU-60 prefixes by state; SYSTEMATICALLY SPEAKI NG. goodbye to meter readers, Thai phone bo k, tracking
devIces, TINA. "Cal l Me" Card; FROM SHERWOOD FOREST: INTRO TO HACKING-whal lo do and nol lo do; I NTERESTI NG THI NGS TO DO
ON A DEC-20-hov to use various commands and some thi ngs to look for; BANKI NG FROM YOUR TERMI NAL: A LOOK AT PRONTO­
Electroni c banki ng. how it works with a focus on Chemi cal ' s system; FLSH: $2 bi l l ion error. I T crackdown. monitoring; 260
INFORMATION BUREAU-Mi l net TAC di al ups by location; SYSTEMATICALLY SPEKI NG: MCI goes opti cal , 10 .. ESS, GTE bigger than
AT&T; SEIZED! 260 BULLTIN BOARD I S I MPLI CATED I N RAID ON JERSEY HACKERS-an accurate account of the Private Sector BBS;
COMMENTARY: THE THREAT TO US ALL-what BBS seizures mean; FLSH: 260 a hacki ng victim, Mi dl esex Courthouse; MOVI NG
SATELLI TES . . . wHAT WAS REALLY GOI NG ON?-poi nt by point correctIon of New Jersey prosecutors' fal l aci ous charges; WHY
COMPUTERS GET SNATCHED-why law enforcement seIzes equipment; SOME I MPORTANT QUESTIONS TO ASK-provoative questions
about these events; HOW CAN SYSOPS PROTECT THEMSELVES?; A GUI DE TO VMS-how to use DEC' s VAX operating system; THE
I NFI NITY TRANSMITTER-an old bug expl ai ned; REACHI NG OUT ON YOUR OWN-blue bxi ng verification; PURSUI T FOR PEOPLE-GTE
Telenet's computer to computer l i nk-up service; FLASH: phone-in registration, Bword numbrs. war game adict, hacker extortionist;
260 I NFORMATION BUREAU-Telenet di rectory of interesting addresses; SYSTEMATICALLY SPEAKI NG: Dick Tracy toys, computer
di rectory assistance, Bel l propaganda fi l ms, Europe standardi zi ng telcoms; MANY FAMI LIAR TONES; AND THEY CALLUS CROOKS?-story
of a phone phreak who can' t sell his expertise; AN I NTERESTI NG DlVERSI ON-cal l diverters and how they are abused; MORE I NFO ON
VMS-second i nstal l ment of an in-depth guide to VMS; FlSH--puter elections. big phone bil l , Navy phreaks. phone bo th captures
man; LETTERS: BBS suggestion, colleges are a goldmine, recommended reading; 260I NFORMATION BUREAU-Bl ue Box plans; THE NEW
AT&T HOSTAGE PHONE-unbel ievable ad; SYSTEMATICALLY SPEAKI NG: hackers scare busi nesses, DuPont bpasses telco, computer
campai gn Info. phone computers, divesti ture woes; RSTS: A TRICK OR lO-me aspects of this operating system; THE SECRET
problems that may anse; FLSH: columnist attacks AT&T, feds dial-it to much, l ittle town phones. Spri ngsteen mania; LETTERS: some
advice, CIC's and free cal l s, British phreak, blue bxing gone?; CHASE BANK I S CRACKED; 260 INFORMATION BUREAU-many interesting
test numbers; SYSTEMATICALLY SPEAKI NG: aVOid phones i n storms, rural unequal access, police cel l ul ar phones, toll-free from where?
AT&T to read e-mai l ; OUR WI SHES FOR `BôAND BEYOND-some of what we'd l i ke to see i n the future; FUN WITH COSMOS-how to
interpret and use parts of the phone company computers; FLSH. French phones, racist banter. Cityphone; SURVEY-reader survey
responses. ZôUINFORMATION BUREU-BBS numbers; SYSTEMATICALLY SPEAKI NG: AT&T e-maIl . German phones. supr pay phone.
(continued on inside back cover)
lagc 2 JuI¶, lº8T
�¡ jou PC¶ur uDmu fMfð mgazl,
}0 may want to glnce over to your
lft. That i the beginig of Û
adveriment for somethig that Iny
of you have been askig aout-260
back isus. They've alays been
availl i te past, but now we've m
ou entie colltin reprited to prevent
u from mig out for a very lng
Havig all of these back isus
flotig around mbeen an ulitig
exprience for u. It' easy to lose track
of te Iny diferent sujects we've
tckld i these pages æit's reall
UIzig to look back on what we've
260 i not lie other magazies. Our
rears are constntl refe"ig back to
¡Þ¾+ 0& BWw�w æo w ¶rsc+ Å [�4 LCffM
out, askig qustion aout certai
articls. And i redig over the
ourseles, we can uderstand why. It all
MO so fresh æMy even though
some of it i tree years ol and the
circustances have chged.
But one tig that hs't changed is
our feelig toward tcholgial
entuists. They unrstnd at lat
some of what' goig on i te worl of
comuters æphones æthe average
person wants to kow what they fid
out. Mostfols woul have never heard
of TRW Credit Services i it weren't for
hackers, lt alone know tat huge credit
fils exited i tei nes. More peopl
woul't know what eletronic and
(continud on /02CZ|
Editor and Publisher
Eric Corley ³³L
Ofice Manager
Fran Westbrook
Cover Ar·
Tish Valter Koch
Writers: John Drake, Paul Estev, Dan Foley, Mr. French,
Emmanuel Goldstein, Chester Holmes, The Kid &Company,
Lex Luthor, Bill from RNOC, David Ruderman, Bernie S., Mike
Salerno, Silent Switchman, Mike Yuhas, and the usual
anonymous bunch.
Production: Mike DeVoursney.
Caroonists: Dan Holder, Mike Marshall.
Editor Emeritus: TSH.
ZW (ISSN 0749-3851) is published monthly by 2600 Eterprises. Inc. 7 Strong' Lne. Setauket. NY 11733.
Second clss postage perit pending at Setauket. New York.
POSTMASTER: Send address changes to 2600, P.O. Box 752, Middle Island, NY 11953�752.
Copyright ° 1987, 260 Enterprises, Inc.
Yerly SUbscription: U.S. and Canada�$15 individual, ¼ corporate.
Overses�$25 individul, $55 corporate.
Back issues available at $25 per year, $30 pr year overseas.
Middle Island, NY 11953�752.
For letters and article submissions, write to: 2600 Editorial Dept., P.O. Box º,Middle Island, N11953�752.
2óN Jul • 1987 Pa C J
by Bernie S.
The recent FBI /Secret Service cel l ular sting
operation that culminated in the arrests of over
¿bpeople in New York City confirs what many
of us have suspected for quite some time: that
cellular tel ephone fraud is widespread. The FBI
estimates that cellul ar phone fraud costs syste
operators $J mil lion anually; with the average
subscriber'S airtime bill about $bUper month for
IUUminutes of usage, there could be over ¿bUU
cellular pirates on the air if a pirate uses twice the
noral amount of airtime. The term "pirate"
rather than "phreak" is used here because the
vast majority of il legitimate CMT users (Cel l ular
Mobil e Telephone) are onl y interested in stealing
ai rti me, while phone phreaks are mainly
interested in leaming more about the tel ephone
network through its manipulation.
The six-mont h FBI i nvesti gati on used
"cooperative sources" who named fraudulent
installers; then FBI agents posing as customers
and i nstallers used st andard entrapment
techniques to gather evidence against those
al l egedly i nvo l ved. The FBI' s press release
stateent that "recent technological advances in
computerized telephone switching equipment
and billing systems were instrumental in . . . (their
investigation)" is deliberately misleading. New
York cel lular carrier NYNEX merel y supplied the
FBI with its billing data to document the use of
bogus and stol en ESN's & MI N's (El ectronic
Serial Numbers and Mobi l e I denti fi cati on
Numbers) discovered i n the investigation. The
Secret Service l ater became involved because
the laws rel ating to the credit fraud being
allegated are under their jurisdiction.
Sfe Phraking
In practice, cell ul ar phreaking is very safe if
one does their own tranceiver modifications,
changes ESN's & MI N's regul arly, and uses
standard phone phreak precautions. Inded, FBI
agent Gr eg Meecham has s t at e d t hat
f r a u d u l e n t l y p r o g r a mme d C MT ' s a r e
"unat t ri butable, unbillable, untraceable and
untappable. " A cell ul ar carrier wil l become aware
of any bogus or stolen ESN's and MIN's used on
its system within a month or so after their initial
use once the subscriber or carrier who is assigned
those codes is billed and notifies the of the
lagc4 JuIy, 1 987 2H
error. The home ca
rrier wil l then change the
legitimate subscribe
r's MI N in the MTSO (Mobil e
Telephone Switchin
g Office) and arrange for a
new NAM (Numbe
r Assignment Module, or
ROM) to be installe
d in
that subscriber's CMT
transceiver. The MT
SO maintains a database of
al l its val id ESN/MI N pairs, as well as a
"negat ive verify"
file on al l known invalid
numbers for the dead
beats and pirates in its area.
The carrier may
choose to l eave certain
fraudulent codes ac
tive to have any activity
monitored, but as
as all parties at the
receiving end of an
y phreaked cal l s become
amnesiac to any inquiries, the phreak's identity
will remain secret. If a phreak uses a different
ESN & MIN every month, it'll be extremely
difficult for the carrier to
react in time to gather
any inforation.
As with any l and
l ine, in band signal l ing (i.e.
¿bUU Hz, MF tones, etc.) wil l work but can be
easily detected by the ESS control l ing that line.
Since al l cell ular systems are in metropolitan
areas, it's logical to assume that most cel l ul ar
lines are on ESS. Although tel co security may be
aware of any bl ue-boxing, the links in their
security chain stop at the MTSO. Moreover,
since the MTSO sel ec
ts outgoing l andl ines from a
trunk group, a pen r
egister at the CO woul d be
usless for establish
ing any tol l fraud pattems.
Because of cellul ar' s inherent frequency­
hopping nature, it is very difficul t to track down a
CMT using conventional radio direction-finding
(OF) techniques, even if it's stationary. A smal l
di r ec t i o nal ant enn a ai med r andoml y at
surrounding cell-site
repeaters with a 1antenna
rotor will thoroughly confuse any OF attempts,
although keeping ca
lls as short as possibl e is
always a good precaution. Locating a mobil e
CMT is virtuall y impOSSibl e. I was recentl y given
a tour of an FCC mo
nitoring van in Washington
DC, and was surpri sed t� see how lacking in
sophistication their
nboard OF gear was. The
only equipment avail
able lJreadily locate a CMT
transmitter is primar
i l y used by the militar and
intelligence agencies, which couldn't care less
about CMT fraud u
nless it involved national
Most CMT's are a
ually two main pieces of
and Where lt7s Headed
equipment: the transceiver
hd control head. The
transceiver (transmitter/re
eiver) is usual l y a
nondescript met al box
ith three external
connectors and contains sOPhisticated circuitry.
There are usual l y two mai� Circuit boards inside:
an RF board with al l the radio transmitting/­
receiving circuits, and a
ogic board with a
microprocessor, AID and D/ A circuits, and
control logic. The control
ead is a touch-tone
telephone handset with ¹' extended keypad,
numeric, or al phanumeric display, and vol ume
and mic mute controls. It
ften has a separate
speaker mounted in the cra
e for on-hook dialing
and cal l -progress monitori
g. Some CMT's have
a speakerphone option tha
al l ows you to drive
with both hands on the w
�1 by tal king into a
small microphone mounted
ear the vehicl e's sun
visor, and listening to the cradle loudspeaker.
This may seem to be the ul
mate in laziness, but
reember you coul d be r
leuvering your five­
speed through heavy traff
on the expressway
when the phone rings! TheC(ntrol head/cradl e is
usual l y bol ted to the tranSrission hump by the
driver's seat, and the tr
hsceiver is usual l y
mounted i n the trunk w
th a power cabl e
connecting it to the car battery and ignition
switch. A shiel ded cont
(1 cable links this
equipment together and all
ws data and audio to
pass between them. Most f
st-generation CMT's
used the AMPS bus, devel OPed by AT&T, which
specified a syste of 36 pa
al l el wires in a bul ky
control cabl e. Some !anufacturers l ater
devel oped their own buses-Novatel ' s serial bus
specifies a thin cabl e of j us
a few wires which is
much easier to instal l in vl1
cl es. For fixe use, a
CMT may be powered by
ly 12-vol t reul ated
DC power supply that C¹U deliver at least 5
Any woul d-be cel l ular Ih
eak must first obtain
a CMT. Used bargains <bOund in some cities,
where many subscribers found they coul dn't
afford to pay their airtime
l l s after they bought
their phone! First-gene
ati on E. F. Johnson
transceivers are a good c
Oice beause they're
easy to work on, use
uniquely effetive
diversity (dual -antenna)
eeiver, and us the
AMPS control bus, whith means that several
manufacturers' control ht(s will work with it.
Another good choice is Novatel's Aurora/150
model. It uses a proprietary paral l el bus and
control head, but costs l ess, is very rugged, and
is al so easy to work on. In addition, al l Novatel
CMT's have buil t-in diagnostics which al l ow
(among other things) manual scanning of al l 666
r e p e a t e r o u t p u t f r e q u e n c i e s-g r e a t
entertainment when you're bored!
A mobil e cel lul ar antenna is usuall y a short
(l ess than a foot long) piece of stiff wire with a
hal f-dozen or so turs in the middle, l ike a spring.
The "spring" acts as a phasing coil in a 5/8-wave
configuration. The antenna is mounted vertical l y
either through a hol e in the vehicl e' s roof or at the
top of the rear windshiel d using silicon adhesive
with conductive pl ates on either side to pass RF
energy right through the gl ass. It's not quite as
efficient as a roof mount, but most fol ks prefer
not to dri l l a hol e in their Mercedes. A 50-Ohm
coaxial cabl e such as RG-58/ U l inks the antenna
to the transceiver with a mal e TNC-type UHF
connector. A ceramic dupl exer a l l ows the
transmitter and receiver to share the same
antenna simu l taneousl y. Mobi l e roof-mount
antennas are designed to work with the ground
pl ane provided by the vehicl e' s body, but for fixed
use an "extended-feed" or voltage-fed coaxial
antenna (which requires no ground pl ane) can be
used if there's no tin roof on your hous. A capped
PVC pipe makes an ideal rooftop housing for this
type of antenna, concealing it and making it
weatherproof at the same time. As with any kind
of antenna, the higher the better-but unless
you're surrounded by tal l stel buildings any
height will probably do (provided you're within
range of a cell-site repeater). It should even work
indoors if near a wi ndow-remember that
cellular systems are designed to wor primaril y
with inefficient antennas at ground-level. Vagi
and comer-reflector antennas are available for
fixE use' that provide ver high gain and
diretivity. Antenna speialists Co. (216-791-
7878) manufactures a brad line of cellular
Interacing audio devices such as MF tone­
generators to a CMT can 0 accoplishe by
coupling the dvice's output thrugh ± audio
coupling trnsforer and capacitor acrs the
(continued on page 11)
ZW Jul¶. 1987 Page 5
now pnone pnreal(s
by No Severance
Until about four months ago, I worked in a
switch r oom for a large long distance company. I
was given the pink sl ip because some guy in my
office found out that I did a littl e hacking and
phreaking in my spare time. It seems that most
companies just aren't into that anymore. I feel I
shoul d do al ii can to keep phreaks from getting'
caught by the I C's ( I ndependent Carriers or Inter­
exchange Companies). Remember: a safe phreak
is an educated phreak.
When you enter an authorization code to
access a long distance company's network there
are a few things that happen. The authorization
code number you enter is cross referenced in a l ist
of codes. When an unassigned code is received
the switch wil l print a report consisting of the
authorization code, the date and time, and the
incoming trunk number (if known) al ong with
other miscel l aneous inforation.
When an authorization code ¯found at the end
of a bil ling cycle to have been abused, one of two
things is done. Most of the time the code i s
removed from the database and a new code is
assigned . But there are times when the code i s
flagged "abused" i n the switch. This i s very
dangerous. Your call sti l l goes through, but there
is a bad code report printed. (This is similar to an
unassigned code report, but it also prints out the
number being cal l ed.) You have no way to know
that this is happening but the IC has pl enty of
time to have the cal l traced. This just goes to
show that you shoul d switch codes on a regular
, basis and 00Ìuse one until it dies.
There are several ways to access an IC's
network. Some are safe and some can be deadl y.
Feattl Group A(FGA). This is a local dial-up to
a switch. It is just a regular ol d telephone number
(for exampl e 871 -2600) . When you dial the
number it wil l ring (briefly) and give you a
di al tone tel l ing you to proceed. There are 0O
identifyimg digits (i.e. your telephone number)
sent to te switch. The switch is signal l ed to give
. you a dialtone from the ringing voltage al one. The
onl y way you coul d be caught hacking codes on
an FGA In umber woul d be if Telco (your local
te lephone company) were to put an incoming trap
lagc 0 JuIy, lº8T 2ó0
on the FGA number. This causes the trunk
number your cal l came over to be printed out
From the trunk number Telco coul d tel l which
central office (CO) your cal l was coming from.
From there Tel co coul d put an outgoing trap in
your CO which woul d print the tel ephone number
of the person pl acing a cal l to that number-that
is provided that you are in an ESS or other
el ectronic switch. This is how a majority of
peopl e are caught hacking codes on an FGA
access number.
Next down the l ine we have Feature Group B
(FGB). There are two FGB signal l ing forats
called FGB-T and FGB-D. Al l FGB's are 950-
XXXX numbers and I have yet to find one that
doesn't use FGB-T format
When you dial an FGB number your cal l can
take two paths: 1 ) Large CO's have direct trunks
going to the different I C's. This is more common
in electronic offices. ¿) Your cal l gets routed
through a large switch cal l ed a tandem, which in
tum has trunks to al l the IC's.
When you dial an FGB-T number the I C's
switch receives:
KP ! B1
This prompts the switch to give you a dialtone.
The IC gets no information regarding your
telephone number. The onl y thing that makes it
easier to catch you is that with a direct trunk
from your central office, when you enter a bad
code the IC knows what office you're coming
from. Then it's j ust a matter of seeing who is
cal l ing that 950 number.
On the other hand, when you dial an FGB-D
number the switch receives:
KP ! (950-XXXX) + ST fol l owed by
KP ! 0 ! NXX-XXXX ! ST or KP ! 0 ! NPA
The first sequence tel l s that switch that there
is a cal l coming in, the 950-XXXX (optional ) is
the same 950 number that you cal l . The second
sequence contains your number (AN |¬
Automatic Number I dentification). If the cal l
comes over a trunk directl y from your CO it wil l
not have your NPA (area code). If the call is
routed through a tandem it wil l contain your
NPA. FGB-D was original l y developed so that
when you got the dial tone you coul d enter j ust
are caught
the number you were cal l ing and your cal l woul d
go through; thus al l eviating authorization codes.
FGB-D can al so be used as FGB-T, where the
customer enters a code but the switch knows
where the cal l is coming from. This coul d be used
to detect hackers, but has not been done, at least
not in my switch.
FGB-D was the prelude to Fture Group
U(FGOI. FGD is the heart of equal access. Since
FGD can onl y be provided by el ectronic offices,
equal access is onl y available under ESS (or any
other el ectronic office). FGD is the signal l ing
used for both 1 + dialing (when you choose an IC
over AT&T) and 1 OXXX dialing (seequal access
guide, ?600,March 1987) . The signal l ing forat
for FGD goes as fol l ows:
KP + ||+ 100(10 digits) + ST fol l owed by
KP 1 10D 1 ST
The first sequence is cal l ed the identification
sequence. This consists of KP, information digits
(II), and the cal l ing party's tel ephone number
with NPA (10D ANI) finished up with ST. The
second or address sequence has KP, the cal l ed
number (10D) fol l owed by ST. Ther is a third
FGD sequence not shown here which has to do
with interational cal ling-I may deal with this
in a future article. When the IC's switch receives
an FGD routing it wil l check the inforation
digits to S if the cal l is approved and if so put
the cal l through. Obviously, if the inforation
digits indicate the cal l is coming from a coin
phone, the cal l wil l not go through.
Wl8 l8 8 lR 0| 0| Î0Í9M0 0̧lB W ̶ æ W Mll
00 Wæm Ml8| ÎM. M Wl8̶
01 W Ü¥l Í09f|8¡0| ¥0N8f| l0f0¡ÎÍÌ08ÌÌ08j

W å¥l¾lÌ0|f
lM WÌ 0| MÆl
W wm,MÌBl. lM, m
W ÆU1åm
lÆÌ 011Æ.0ÌW0ÌÆ0l8ÌM
WÌ 01¶lM¦ WW
W w
ÆU1å¾ ¾ NWÌ
W l8l8|Lå1å·|t8¡|Ì6¡t00089Ì¡8l.00l8l8tt.
Ther is a provision with |ûÛso when you dial
10XXX# you wil l get a switch dial tone as if you
dial a 950. Unforunatel y, this is not the same as
dialing a 950. The IC woul d reeive:
KP + ||+ 100 (ANI) + ST
The KP + ST gives you the dial tone, but the I C
has your number by then.
BOO Numbers
Now that we have the feature groups down pat
we wil l tal k about 800 numbers. Invisibl e to your
eyes, there are two types of 800 numbers. There
are those owned by AT&T-which sel l s WATS
service. There are al so new 800 exchanges
owned by the I C's. So far, I believe onl y MCI, US
Sprint, and Wester Union have bought their own
800 exchanges. It is very important not to use
codes on 800 numbers in an exchange owned by
an IC. But first. . . .
When you dial an AT&T 800 number that goes
to an IC's switch the fol l owing happens. The
AT&T 800 number is translated at the AT&T
switch to an equival ent POTS ( Pl ain Ol d
Tel ephone Serice). This number i s an FGA
number and as stated before does not know
where you're cal l ing from. They might know what
your general region is since the AT&T 800·
numbers can translate to different POTS numbers
depending on where you're calling from. This is
the beauty of FGA and AT&T WATS but this is
al so why it's being phased out.
On the other hand, IC-owned 800 numbers are
routed as |üÛ cal l s-very deadly. The IC
KP 1 ||1 100 ' ST
When you cal l an IC. 800 number which goes to
an authorization code-based service, you' re
taking a great risk. The IC's can find out very
easil y where you're cal ling from. If you're in an
el etronic central office your cal l can go diretly
over an |ûÛ trunk. When you dial an IC 800
number from a non-eletronic CO your cal l gets
routed through another switch, thus ending up
with the 50 undesirable effet.
MCI is looking into getting an 800 billing
srice tariffe where a customers 800 WATS
bil l shows the number of everone who has calle
it. The way the IC's handle their billing, if they
wanted to find out who made a call to their 800
number, that inforation would be available on
bil l ing tapes. The trick is not to use codes on an
(continued on page 10)
ZW Jul¶.4Y87 Fagz7
the telecom informer
If you're in New Orleans, a simple
seven-igit number can wind up costing
you $25. That's right, if you call
9Jb-/Jb7,a $25 charge is added to your
bill. The money is then donated to the
New Orleans Symphony to help them
payoff a $3.8 million debt. Seems like it
won't be too hard to OH up a $3.8
million debt of your own with this trick.
By the way, if you call it from out of the
area (area code 504), you11 hear the
sme thank-you message, but you won't
get charged anything more than a long­
distance call. Classical music lovers: if
you have some extenders in New
Orleans, you could quickly put these
guys back in the black! Only
kidding .... Bell of Pennsylvania is going
to initiate a service that would allow
customers to hang up during the first 10
seconds of a dial-it service messge and
not get charged. The frst ÌÛ seconds will
be a waring, both of the price of the
service and of the possibly offending
content. ... Have you signed up recently
for long distance service from Califoria
Discall or Hello America? If so, then
you were involved in telephone fraud!
Califoria Discall, also known as
Lindahl Enterprises, allegedly sold flat­
rte long distance service to hundreds of
businesses nationwide, then distributed
stolen Uh Sprint access codes to its
customers. Sprint was also used by
Hello America, which reportedly bilked
them for $3,018,818 as of January. You
have to wonder why Sprint always seems
to be the victim of these schemes.
Perhaps they could work it into their
ads�"Sprint: the choice of thieves. "
Speaking of which, common criminals
are getting into the act with a vengeance.
You can buy stolen Sprint and MCI
code, on the street, for up to $40.
(Thi5, incidentally, is a rotten deal-they
usually go bad within a day.) You might
also rn across a clandestine "opertor"
who will place your call for you and
charge you several dollars on the
Fage1 JuIy, lº87 2óW
spot....Robert Post of Poland allegedly
robbed $86,000 from New York ATM
machines and he did it without stealing
cards. He'd simply look over customers'
shoulders as they were conducting
transactions and memorize their PIN
coe. Then, if the customers didn't tke
their receipt (morons), Post would
snatch it up and get the card number.
Then, using a special machine, Post
would create his own version of their
cards, complete with a magnetic strip
with pertinent information. He also
needed the Manufacturers Hanover
"signature" that is imbedded on the
strip, which apparently has leaked out.
His method worked, but it consistently
set off alarms and that is how he was
caught.. .. A new computer system is
working hard in New York State to fnd
fathers who are delinquent in child­
support payments. Computers at two
state agencies are now talking to each
other, allowing a match to be made
between the offender and his employer.
The employer is ordered to withhold
whatever is overdue from the person's
paycheck .... Nobody understands why
New York Telephone embarked on a
hopeless campaign of plastering pay
phones with little blue stickers that said
"New York Telephone, A Nynex
Company" on them. Perhaps they're
sufering from an identity crisis and
want Nynex phones to stand out from
all the others, some of which look
remarkably similar. But these stickers
were so easy to peel off that they had
been appearing everywhere except on
N ynex phones-cars, bicycles,
refrigerators, even other pay phones that
obviously aren't Nynex phones. Almost
as quickly as they appeared, all of the
remaining stickers vanished. Now there
are huge signs on top of all the phones
that identify them as the precious Nynex
models. They've also replaced all of the
faceplates on the front of the phones.
They sure do keep busy at Nynex, don't
(continued on page 16)
An Exciting 2600 Contest
Tired of just plain "Hello"] So are we.
Send us your ideas on what to holler when
the ringer jingles. We'll give the best entr
a ¯L-XLPH subscription to 2ÛÛÛ!
HE A SM A T T ....
"Suicide Hotline, ples hold .... "
'Yes, Comissioer."
"Opertor, may I help yo?"
'Wrog numbr."
"Authorization coe, ples?"
CONTEST RULES: No more than 3 entries per contestant, please. Entries
must be received by September l, lÜd¯. Entries wil be judged primarily on
brevity and levity, but other outstanding merits including assonance,
dissonance, alliteration, allusion, or shock value will be considered.
Deserving entries wil be printed in an upcoming issue of 260 WITHOUT
. contestants' names, unless entry includes the request "Please attribute to
(name or handle)". Al judgements are final. Winner wil receive a 2-year
subscription or extension to their existing subscription. Runner(s)-up wil
receive a I-year subscription or extension.
tash va!uc /, O|/· pnO
VOtd whcrc prohtbìtO
il •
ZW July,I987 Page º
how phone phreaks get caught
� IC-owned 800.

The way to find out who owns an 800
� exchange is to cal l 800- NXX-0000 | NXX being
§ the 800 exchange). If this is owned by AT&T you
: wil l get a message saying, "You have reached the
] AT&T Long Distance network. Thank you for
choosing AT&T. This message wil l not be

repeated." When you cal l an exchange owned by

an IC you wil l usual ly get a recording tel l ing you
that your cal l cannot be completed as dialed, or
el se you wil l get a recording with the name of the
I C. If you cal l another number in an AT&T 800
exchange (i.e. 800- NXX-01 72ìthe reording you
get shoul d al ways have an area code fol l owed by
a number and a letter, for example, "Your cal l
cannot be complete as dialed. Please check the
number and dial again. 31 2 4T. " As of last
month, most AT&T recordings are done in the
same feale voice. An MCI reording wil l tel l you
to "Cal l customer service at 800-444-4444"
fol lowed by a switch number ("MCI 20G").
Soe companies, such as US Sprint, are
redesigning their networks. Since the merger of
US Teleom and GTE Sprint, US Sprint has had 2
separate networks. The US Teleom side was
. Network 1 and the GTE side was Networ 2. US
Sprint wil l be joining the two, thus forming
Network 3. When Networ 3 takes effect there
wi l l be no more 950- 0777 or 10777. Al l
customers wi l l have 1 4 digit travel cards
(referred to as FON cards, or Fiber Optic Networ
cards) based on their tel ephone numbers.
Customers who don't have equal access wil l b
given seven digit "home codes". These
authorization codes may onl y be used from your
home town or city. The access number they wil l
be pushing for travel code serice wil l be 800-
877-8000. This cutover was suppose to have
been completed by June 27 but the operation has
ben pushed back.
One last way to tel l if the port you dialed is in
an IC's 800 exchange is if it doesn't ring before
you get the tone. When you dial an FGA number it
wil l ring shortl y but when you dial 1 OXXX# you
get the tone right away. Last but not least, I wil l
provide you with a list of 800 exchanges that are
owned by IC's. A majority of them are owned by
800-234 800-274 800-283 800-284 800-288
800-289 800-333 800-365 800-444 800-456
Fagc l0 JuIy, lº8T 2H
800-627 800-666 800-678 800-727 800-759
800-777 800-825 800-876 800-888 800-937
800-950 800-955 800-999
US Sprint
800-347 800-366 800-699 800-877
And to avoid confusion, these are the AT&T 800
800-202 800-21 2 800-221 800-222 800-223
800-225 800-227 800-228 800-231 800-232
800-233 800-235 800-237 800-238 800-241
800-242 800-243 800-245 800-247 800-248
800-251 800-252 800-253 800-255 800-257
800-258 800-262 800-263 800-265 800-267
800-268 800-272 800-282 800-292 800-302
800-31 2 800-321 800-322 800-323 800-325
800-327 800-328 800-331 800-332 800-334
800-336 800-338 800-341 800-342 800-343
800-344 800-345 800-346 800-348 800-351
800-352 800-354 800-356 800-358 800-361
800-362 800-363 800-367 800-368 800-372
800-382 800-387 800-392 800-402 800-41 2
800-421 800-422 800-423 800-424 800-426
800-428 800-431 800-432 800-433 800-435
800-437 800-438 800-441 800-442 800-443
800-445 800-446 800-447 800-448 800-451
800-452 800-453 800-457 800-458 800-461
800-462 800-463 800-465 800-468 800-471
800-482 800-492 800-502 800-51 2 800-521
800-522 800-523 800-524 800-525 800-526
800-527 800-528 800-531 800-532 800-533
800-535 800-537 800-538 800-541 800-542
800-543 800-544 800-545 800-547 800-548
800-551 800-552 800-553 800-554 800-555
800-556 800-558 800-561 800-562 800-563
800-565 800-567 800-572 800-582 800-592
800-602 800-61 2 800-621 800-622 800-624
800-626 800-628 800-631 800-632 800-633
800-634 800-635 800-637 800-638 800-641
800-642 800-643 800-645 800-647 800-648
800-652 800-654 800-661 800-662 800-663
800-665 800-667 800-672 800-682 800-692
800-702 800-712 800-722 800-732 800-742
800-752 800-762 800-772 800-782 800-792
800-802 800-812 800-821 800-822 800-824
800-826 800-828 800-831 800-832 800-833
800-835 800-841 800-842 800-843 800-845
800-847 800-848 800-851 800-852 800-854
800-855 800-858 800-862 800-872 800-874
800-882 800-892 800-902 800-912 800-922
(continued on page 20)

control head's mi crophone wi res. If i t' s avai l abl e,
a schemati c di agram wi l l show whi ch CMT bus
l ines carry the transi t audi o; coupl i ng the si gnal
there woul d be preferable. Acousti c modes can
be i nterfaced acousti cal l y, or by coupl i ng the mi c
and speaker wi res to those on the control head or
to the appropri ate bus l i nes. Di rect-connet
modems, answer i ng machines, regul ar and
cordless tel ephones, and other devi ces can be
i nterfaced to a CMT through the AB1 X cel l ul ar
i nterace manufactured by Morri son & Depsey
Communicati ons (81 8-993-01 95) . Thi s $300
devi ce is a one-l i ne PBX that connects betwen
the transceiver and control head and provi des an
RJ-1 1 C jack that accepts 30y di rect-connect
telephone accessory. It reognizes touch-tone
and pul se di al i ng, provides 1 . 0B equi val ent
ri ngi ng vol tage, and generates dial and busy
tones when appropri ate.
Every CMT manufactured has a uni que ESN,
whi ch is a four-byte hexadeci mal or 1 1 -di gi t
octal number i n a ROM sol dered di rectl y to the
l ogi c board. I t's supposed to be there for l i fe and
never reoved. Some newer CMT's i mbed the
ESN in a VLSI chip along with the unit's progra
code, whi ch makes ESN modi fi cati ons vi rual l y
i mpossi ble. Te ESN is al so imprinted on the
recei ver I D p l ate mounted on t he out si de
housi ng. When converted to octal ( 1 1 di gi ts), the
f i rst thre di gi ts spi fy the CMT manufacturer,
and the other 8 i denti fy the uni t. Typical ESN's
might be 1 350001 4732 (octal) for a NEC brnd
CMT, and 8E01A7F6 (hexadecimal) for a
Novatel. The other important chip is the NAM,
which contains the MIN (NPA-XXX-XXXX), lock
code (keps the kids from using it), and various
model-spific and carrier-speific codes. Some
newer CMT's have no NAM at all and us an
EEPROM which allows a tehnician who knows
the maintenance code to change NAM data
through the contrl head keypad.
Baically, when one attepts to make a CMT
call the transceiver first automatically transits
its ESN and NAM data to the nearest cell-site
repeater by means of the overhead data stream,
or ODS. The ODS is a 10 kilobaud data channel
that links the CMT's computer to the MTSO
computer, which controls the phone's entire

oprati on ri ght down to i ts channel and RF output

power. If the MTSO doesn't reogni ze the z
received ESN/MI N pai r as val i d, it retums a �
reorder si gnal and wi l l not process the cal l. I n

most ci ties wi th cel l ul ar systes there are two

carriers: the wi rel i ne operator ( usual l y Bel l or the

l ocal tel co) and the non-wi rel i ne operator, an
i ndependant company. Both mai ntai n thei r own
MTSO and networ of cel l -si te repeaters, and
occupy separte hal ves of the cel l ul ar radi o band.
Non-wi rel i nes operate on syste A ( channel s
001 to 333), and wi rel i nes oll system B (channel s
334 to 666).
Cust om- Cal l i ng f eat ures such as cal l­
forwardi ng, cali-wai ti ng, and three-way cal l i ng
are al l standard wi th most cel l ul ar carri ers, but
the procedures for usi ng the di ffer so i t's best to
cal l the carrier for more i nforati on .
Obtining BMM
Te most di ffi cul t task for cel l ul ar phreaks and
pi rates i s obtai ni ng usabl e ESN's and MI N's. One
method i nvol ves havi ng an accompl ice who i s
epl oyed at a CMT i nstal l ati on center. They wi l l
have a f i l e on ever CMT installed at that
locati on, including the ESN's and MIN's assigned
to those subscribers. Using sveral cos fro
one source could focus attention there, however.
Another method involves the help of an inside
prson at the cellular carrier's customer srice or
b i l l i ng department, where many low-paid
employes have access to thousands of valid
ESN's and MIN's. The most sophisticated
method requires interfacing a CMT's AID
circuitr to a pronal computer, eabling one to
literally pick valid codes out of thin air.
Once a valid ESN/MIN pair is obtained, it
must be programmed into the CMT's ROM's.
Some CMT manufacturers us differet devices
and meor maps, but most adhere to the AM PS
16-pin, 32x8 bit forat. The most comon
ROM's are Signetics 82S23 (op colletor) and,
82S123 (tri-state) or euivalents, but it's best to
chek the part numbers used in your unit. The
existing ESN ROM should be carefully reove
from the logic board using grounded desoldering
tols and read using a NAM programer's bit­
editor mode. Any PROM programer that is
device-compatible can be us, but deicate
(continud on /02C 14)
2W July, 1981 Page 44
On Disclaimers
Dear 2600:
I n the Jul y 1 984 i ssue of 2600,
Quasi Moto, sysop of the l ate Pl over­
Net BBS sai d he had the "perfect"
di scl ai mer for a BBS. I have some
fri ends who are start i ng a BBS, and
they coul d realy use hi s "perfect"
di scl ai mer.
There i s no such t hi ng. Many
computer bulletin boards ask the
question "Are you a member of the
law enforcement community?" And
members of the law enforcement
community simply answer in the
negative. You won't find many judges
who wil sympathize with a defendant
that was "lied to" by a cop. Other'
boards claim they're not responsible
for anything that's posted by others.
Well that may be so, but if the law this
month says sysops are responsible,
they wil feel the heat disclaimer or no
disclaimer. So what are we saying?
Disclaimers are useless and ofer a
false sense of security. In many cases
they do more harm than good because
the very presence of a disclaimer leads
some to beleve that something ilegal
.is going on. You're better of running a
board you can be proud of and whose
contents you're prepared to defend It
being the 80's, you may very wel have
to justif your existence.
Texas Tol Fraud
,Dear 2600:
Encl osed i s a tabl oi d arti cl e about
' access code tol l fraud on Texas col l ege
campuses. Hope you guys get some
use or l aughs from i t.
I t menti ons a number set up by Texas
Tech for students to tur n themsel ves i n
f or t o l l f r a u d . H a s a n yo n e ever
' consi dered doi ng the fol l owi ng?
"Hel l o, ( i nsert name of l ong di stance
Page l? July, lY87 ZW
The Letters
company)? I woul d l i ke to turn mysel f i n
for tol l fraud. My name i s ( i nsert name
of some person you wi sh revenge on)."
You can guess what happens from
there . . . .
Technocracy nowl
The Hooded Claw
What you suggest i s i mmoral,
unjust. sneaky, di sgusti ng, and
horrible. I t' s also incomplete. The
number to cal is 703-641-9292. It
belongs to the Communications Fraud
Control A ssoci ati on, that scary
organization that gathers information
fr o m al l of t he l o n g d i st a nce
compani es. They recently plastered
Texas Tech with posters, a likeness of
which appears on this page.
Suggestions, Comments,
Dear 2600:
Can you tol erate another comment
on the new format vs. 3- r i ng bi nder
c omp a t i b i l i t y? Add a n e nt i c i n g
centerfold pi cture. Maybe then your
readers woul d real i ze that opened, the
new format i s real ly the 3- r i ng bi nder
format "sort of on i ts side". Some
Never Stop
creati ve hol e punchi ng, and, by gol l y,
the new format fi ts i n a 3- r i ng bi nderl
(You can hel p, of course, by l eavi ng a
bi t more margi n at the top of the new
page format. )
Now what do I do wi th my address
l abel s? I j ust recentl y tri ed the "new
P r i v a t e Se ct or b u l l et i n boa r d"
a d v e r t i s e d on t h e J a n u a r y a n d
February back covers. Why no answer
at 201 -366-43 1 ?
How about an updated l i st of pr i vate
B B S n u mbe r s? E s p e c i a l l y i n t h e
Western part of the country. Anyone i n
the Los Angel es area have any good
ones to share?
Not a bad idea for hole placement. At
the moment though it's not a viable
option for us.
The entire hole controversy has
really gotten out of hand Is it so hard to
file something away that doesn't have
holes in it? Let's see if we can come up
with creative ideas for doing just that.
Private Sector wil not be coming
back up, unfortunately. But we are
planning an active 88S future for our
readers. Response to last month's
appeal for 88S's nationwide has been
encouraging. What you will soon see is
a list of bulletin boards that have
agreed to be ´2ô0 buletin boards".
Each wil have its own unique traits,
but will also possess certain key
similarities and functions. We are in
the process of determining what the
common denominators should be.
Please send .us your input on this.
A Horrible Problem
Dear 2600:
I have a rather specif i c communi­
cations probl em. Let me hasten to add
that I am seek ing a compl etel y l egal
sol ution, as I do not wish to become
i nvol ved in an international incident!
The probl em is that I want to transmi t
computer data from one locati on to
another-speci fi cal l y, I want to be abl e
to access a computer BBS from my
home l ocati on, about fi ve mi l es away.
But, I want to be abl e to do t hi s wi thout
i ncurri ng per- mi nute tol l charges. The
sysop i s a fri end of mi ne and woul d
, probabl y be abl e to co nnect t he
computer t o a radi o l i nk dur i ng the t ime
I wi sh to use i t, but there i s one further
probl em-not onl y i s the BBS a long
di stance cal l from my l ocati on; i t al so
happens to be on the other si de of an
i nt er nat i ona l bor der , i n Sau l t St e.
Mari e, Ontari o, Canada.
I real i ze that one possi bl e sol uti on
woul d be to use amateur pa cket radi o,
b u t n e i t h e r my f r i e n d n o r I a r e
amateurs, nor, qui te frankly, do we
have any desi re to become ham radio
o p e r a t o r s. We h a v e t h r e e b i g
objecti ons to amateur radi o-fi rst. we
don't want to waste ti me tryi ng to l earn
the anti quated morse code; second, we
have met far too many amateurs who
seem to thi nk of amateur radi o as thei r
persona I fraterni ty, and who are far too
wi l l i ng to make troubl e for those who
don't share thei r vi ews on how thi ngs
shoul d be done; and t hi rd, the BBS
often contains messages of computer
equi pment wanted or for sal e, and I
s u s p e c t t h a t t h es e wo u l d b e
cons i dered bus iness-r el ated tr ans­
missions by the FCC and thus cou Id not
be l egal ly transmitted over amateur
radio (and it wou ld be impracti cal to tr
and segregate those types of messages
from the rest of the message base).
If the distance invol ved were longer, I
would suppose that we are probably
stuck wi th Ma Bel l, but due to the short
distance I can't help but think there
must b some way to avoid the tol l . My
fr i end and I can eas i l y talk for hours vi a
CB radio ( al though i t would be ni ce to
have a somewhat more pr i vate l ink and
no "ski p" interference), but it is my
(continud on T2P 18)
ZW Jm,³Æ7 Fa ¡J
NAM programmers have bui l t-i n software whi ch
� greatl y si mpl i fi es the process. The ESN pri nted
¬ on the I D pl ate ( i f in deci mal , convert to hex)
§ shou l d be f ound i n memory and wi l l be
� immedi atel y fol lowed by an 8-bi t checksum
� determi ned by the 8 least si gni fi cant bi ts of the
.� hex sum of the ESN' s four bytes. The old ESN
¬ data ( now copi ed i nto the NAM programmer's
� RAM) shoul d be replaced wi th the new ESN and
checksum. A new bl ank ROM of the same type
shoul d be i nserted i nto the programmer and
"bumed . " It woul d be advi sabl e to sol der a ZI F
( Zero I nserti on Force) DI P socket onto the l ogi c
board to accomodate the new ESN chi p and any
future versi ons.
Te NAM chi p i s usual l y al ready ZI F socketed
on the l ogi c board for easy repl aceent . I t , too,
shoul d be copi ed i nto the NAM bumer's RAM and
the ol d MI N replaced wi th the new one. The NAM
checksum shoul d al so be updated to ref l ect the
new dat a . Al t hough t he car r i er ' s system
parameters must al so be programmed i nto the
NAM, they can be l eft the same i f the NAM bi ng
changed had previ ousl y ben on the carrier now
to be used. Al l that needs to be changed in thi s
case i s the l ast four MI N di gi ts and checksum
( and maybe the exchange if they're usi ng more
than one) . An excel l ent wri te-up on NAM
programmi ng i s avai l abl e fre of charge from
Curti s El ectro Devi ces (41 5-964-3846) . Ask for
the May '87 repri nt from Cel l ul ar Busi ness
magazi ne. Bytek Corporati on ( 305-994-3520)
sl l s a good budget NAM programer for about
$500, and the operati ons manual (avai l abl e
sparatel y) expl ai ns i n detai l the meor maps,
par numbers, and programmi ng tehni ques for
most CMTs on the maret . Ti s se uni t i s al so
capabl e of programmi ng many ESN chi ps usi ng
the bi t-ei tor mode. Some carriers and thei r
i nstal l ati on agents wi l l provi de NAM syste
parameters on request , and some CMT sri ce
faci l i ties wi l l provi de NAM and ESN meor
maps and scheati cs of spei fi c CMTs for a
One coul d el i mi nate the ne for a NAM
programmer al together by programi ng and
i nterfaci ng a personal computer to the CMTs
ESN and NAM sockets. Another approach i s to
i nterface 2 banks of 8 hexadei mal thumbwhel
¡agc¡4 July, lº87 2H
si tches to the sockets, al though a computer
program woul d sti l l be needed to deteri ne the
proper swi tch set t i ngs. Ei ther of these two
approaches woul d al low qui ck emul ati on of any
CMT at wi l l .
Whenever a CMT i s used i n a cel l ul ar system
other than the one i ndi cated by the SI D ( Syste
'J) code i n its NAM, it is in the ROAM mode and
the ROAM i ndi cator O0the control head wi l l tum
on . A CMT can roam i n any syste i ts home
carrier has a roami ng agreeent wi th, and most
carri ers now have roami ng agreents with each
other. If there is no roami ng agrement , the
MTSO wi l l transmi t Orecorded voi ce message to
the CMT user wi th i nstructi ons to cal l the carrier
( the onl y cal l the CMT wi l l be abl e to make) and
gi ve his name, MI N, cSN .and Ameri can Express
Card number. Al l roamed cal l s wi l l then be
compl eted by the MTSO and bi l led to the credi t
card account. Fortunatel y, t hi s procedure i s
becomi n g l ess common as more roami n g
agreeents are made.
Usual l y, a carri er can onl y deteri ne i f a
roamer came from a syste wi th whi ch it has a
roami ng agreeent, not the credi tworthi ness of
that roamer. Consequentl y, many carriers have
been abused by roamers who've ben deni ed
srvice on thei r home syste due to non­
payment . Once the home carri er i s bi l led for
roami ng services provi ded by the roamed carri er,
i t wi l l noti fy same to add that ESN and MI N to
thei r MTSO's "negative verify" f i l e to prevent
further abuses. Several i ndependent companies
are establ i shi ng system sof tware and data
networs to al low Posi t i ve Roamer Veri f i cati on
( PRV) whi ch wi l l al low near real -ti me roamer
val i dati on by sharing data betwen carriers.
Beause of the many tehni cal , fi nanci al , and
pol i ti cal detai l s that sti I I ne to be resol ve,
PRV systes wi l l probabl y not be i n pl ace f or at
l east two more year. In the meanti me, even
fi cti ti ous ESN's and M I N's can roam i f they
fol l ow the standard forat , al though some
carriers are sharing roaer data on a l i mi te
basi s to prevent thi s.
To cal l a roami ng CMT, the cal l er must know
whi ch system that uni t i s i n, and cal l that
carrier's roai ng number. Roami ng numbers
(continued on page 20)
2600 Eoss New
York Tel
In late June, we at ?600got around
to doing
something we've been meaning to do for a long
time. We've mentioned before in these pages how
unfair it is that telephone companies
consumers a monthl y fee for using touc
h tones
They're not providing any additional se
rice or
equipment. The onl y real technological advance
they've come up with is a device that ca
n ignore
touch tones coming from nonpaying cus
Sounds more l ike bl ackmail than a
dosn't it?
So after having received about 25 ca
l l s from
New Yor Telephone virtual l y begging uS to sign
up for this "service" by Jul y so we would
n't have
to pay the "instal l ation" fe, we reached the
conclusion that enough was enough. On June 26,
we mailed a press release to every newspaper,
tel evision and radio station in New York S
e, as
wel l as state senators, state asseblymen, and a
whol e host of others we thought woul d be
interested. Wel l , as it turs out, many
of them
were. Inside of a couple of days we were
to al l kinds of media people and it would n
ot be an
exaggeration to say that many thous
nds of
people now know about this. The supp
ort has
been terrific. Nobody likes the idea of p
aying a
little extra every month for something t�
at's not
real l y there. And businesses, large an
d smal l
ÌW Msæ
M& �
MWl W.NY l¡W
lJ¡él ½l-W
For·|u�a |mvmNcYork ¡rmmm æm�t mt mmwm. W�
l m tmto æa v m momtnz umm. umtmn0v u w to �mwmm
mmæ mmæ&Wmæ Wlv d�g mæoi mt w
We m vc mnin oI trmiw. Or m .½. wb t mmææ
mm �ct m �c mWæmintn ænu ng m¨m¨ ×J
mmtV ¡l ol Immk �m>mnm Mmcxmzm0I mm
Ðæmteto� Mm �=m¤æ . II " æ uÞm Omw
mwm tnommiMw mu Mng mmæwmtm4 I mmdm1
MD º
1 uæm immæìu tmw. m mmæmæ tt æ 1U tmmm.
A wImdmmwt mtæI 6 wto o wma tmmmuJ æ
manmI t mt mm . �ums m
mm. LNmm�u¤Um . mæu æ æm :n agm�
1U tn tvmmmmtmtæoæ.
l & D mæmwmMÞlO m_' MF wæmm
ææm. | n w0__ <I__ ICto m�mæ•
mtnm MF :m ¡uWd0n tmmm mm••mæ uMw m
æv oV¬tban ×um . | a mm :wt mH tæ
tmt mmtn mmml W. mmt o m:sm. )
�ætwo iwot �1wmmwtm�æc�t N mmtn mæmtm
m O ¯4 n¤ 0m=rmm• =i¤·mWtLb5! IOwwõ wm
cm�w_IO _ol , __ muæb. h wtmwwtod m
mm mm |or mtmwam wmt. Tm• • tmc>o�Mto mm
tma tm mo ¥ "" �O "',II��_". h' • ¤t ng $x ¼a æmæ
m:n:mw. l�o mm abtt n to | l d wtnmwm æm mtæI w |m
m æJ) mc t 0ttl Þ i æ� m tmtmcmtH tmm æ
mHm. mmu mmmævn� Ior a w æ mn p""" I O� Wm æm
lt n mumì manz � on ºt wañ mtæ æü t Mwm
mmm+æ wm tmz >�m Hu x mævwwmæ
mto æv tmetm •.
¼ O =Om 4ZOZ CO Æ1B¥1D WBÅ4W¥
W¥O& & m:tu mCUø W mÆe:v CBTW OU L1 Døo
4 mm ut D� V M tmo� BZO ••
×u uo WCs V ÎO W¥ VOU A VÍW • o�wv=
~:m: Wø A IØIÆ or O £W�B WW¥ �
& m m oJtW EDz m ¶D~CD Dø Ì1 1&ø W1O w¡m
« ¯ �tm ««::o ¾ D �:ø¬ O W¥ C or
Ü&Øoo W Õ8 ÎZ V wW1 Ì0 ÓVBe M o:m CO
wu o¡::tm Y ror L T¬CO BZO O v wv
ox søomr ÌÝÞ7 ot::. T æWV c&ZØ ÏOX IB1G&Ø
OZ8 LB Å4 ror W :u. QX CÅBDDØ 0W» BD¥
Í VO G1OD¥1W W B&�Ø B & 0& ÎW W Õ Y
W � tt. oue ¬ •• C aoo:v.
% d1 W• WB æE±øz, p1••w ea:: tzt¶ì 970¬YÝ00
W am W • we �øWL±9.
alike, are flabbergasted when confronted with
idence that they're paying over $4 a month per
line for this non-service. Take a company with
500 l ines and this comes out to $24, 000 a year.
ot inconsequential.
And more recently, we were confronted with
additional evidence of wrongdoing. It seems New
York Telephone has taken to sending out undated
otices informing the customer that they are
about to be charged for touch tone service since
touch tones were detected on their line. Many
pepl e disregard this notice beause it l ooks just
l ike ai l the other pitches they've received to sign
up for touch tones. So they wind up being signed
up for something they never wanted. Think about
that. If touch tones were real l y a service,
wouldn't the phone company punish a "violator"
by stopping the serice, rather than signing the
person up for it?
We must be fair about this, however. New
York Tel ephone is not the onl y tel ephone
company doing this. But since they're local to us,
we fel t it onl y right that we tackle them first.
dds are your l ocal company is up to the same
trickery. If they are, it's up to you to make people
aware of it. Call your elected official s and exlain
the situation to them. Keep in mind that most
peple accept this s|0p|y 0Oðus0 they don't
understand what's actual l y happening. Tey're
thinking prcisely the way the phone companies
want the to. By letting people know they'r
being cheated and by getting the to say
something about it, we're taking the most
important step in reversing an unfair policy.
ZoW July, 1987 Page l 5
Telecom Informer
they? While we're on the subject of
payphones in New York, we'd love to
know how someone has managed to
scrape a "religious" message into each
and every one of the payphones in New
York City and its surrounding buroughs.
If you look at the silver part of the
phone, you11 see at least one message,
usually two, to the efect of "Praise
God", "Love God", or "Thank God".
First of all, how do they scrape the
message into the phone? Does this
happen anywhere else in the world? And
wouldn't it be nice if all pa yphones said
"260" on them somewhere? Not that
we'd ever suggest such a
thing . . . . Congratulations are in order for
a Temple University ( Pennsylvania)
student who managed to add his name
to a list of merchants paid through a
bank-by-phone savings account. He
made $21,120, which he transferred to
his account. Of course, he was caught.
Otherwise, how would we know about
it? .. . l n other rude behavior: Jerry
Edward Gastil, a San Diego ham radio
operator allegedly jammed the two-way
radio system of the local FBI office. He
"caused music and other sounds to be
transmitted on the FBI frequency,
interfering with regular FBI
transmissions, " according to the feds.
They also said i t caused them some real
embarrassing problems. And no motive
has been found . . . . Our subscribers in
Alaska have long been complaining
about their inability to access most
nationwide 80 numbers. Beginning later
this year, Alascom will connect Alaskan
callers to all wester U. S. and
nationwide toll-free numbers. One less
thing to complain about . . . . Cincinnati
Gas and Electric is giving meter readers
hand-held computers that will help
locte meters and tell whether to expect
a dog in the yard. It sounds like a device
they'd use on Star Trek to scan a planet
for life forms. It's more likely some sort
of a database that keeps track of who
has dogs and who doesn't. . . . Hotline
Fagc 16 JuIy, 1987 2óW
(continued from page 8)
numbers for stool-pigeons:
80-CALL-SPY is for those who want
to report somebody for espionage,
80-BE-ALERT is for turing in drug
smugglers, and 80-USA-FAKE is for
reporting phony imported merchandise
to a Customs agent. . . . I n overseas news,
the numbers to connect directly to
AT&T operators are: from Australia:
014-881-11; from Denmark: 0430-
0 10; from England: 080-89-0 11; from
France: 19 (wait for dialtone) 01 1; from
Hol land: 06 (wait for dialtone) 022-9111;
from Sweden: 020-7 I 5'1 I ; and from
West Germany: 0130-010. AT&T
operators can also be reached directly
from these countries: Bahrain,
Colombia, EI Salavador, Guatemala,
Hong Kong, Japan, South Korea,
Panama, Phillipines, and Spain. From
these countries, though, you have to use
dedicated phones, usually located in
airports. Andfom the United States,
you can reach these countries' operators
at no cost: England: 80-45-5667;
France: 800-331-1323; Hong Kong: 80-
992-2323; Japan: 80-543-051; and
Panama: 80-872.106 . . . . 0ur London
correspondent has also discovered that
it's possible to call toll-free 80 numbers
in the U. S. simply by inserting 83 before
the 80, such as 0101 83 80 874 40.
The 0101 is the interational access to
the U. S. from the U. K . . . . ln England
there are a number of organiztions that
regularly track down published
telephone numbers of hacker electronic
bulletin boards to fnd out if their own
network telephone numbers are listed
there for hackers to exploit. If they are,
they change them immediately. Hackers
are retaliating by encrypting the bulletin
boards . . . .There is a group of German
hackers calling themselves the Computer
Chaos Club. They reportedly have links
to environmental and animal protection
activists. They target large companies
with questionable ethics and create
mayhem on their computer systems,
either by obtaining data or sending fake
errors to users.
D I D Y O U K N O W ?
I . A ² ° foot tel ephone pole weighs an average of I 000 pounds?
2. The same pol e costs us approximately 57° . 00 to set i n t he ground.
². That we have more female empl oyees t han mal e ¯ I 24 female,
ô4 mal e.
º. \Ve have an average of 5¹ ° 6i nvested for every telephone i n service.
` . Our ent i re terri tory encompasses approxi mately 2 ° 0 square mi l es.
0. More telephone cal l s are made on stormy days than duri ng clear
1. An extension telephone costs l ess than 90c a month.
o. ô2, 000 loal cal l s are made dai l y on a normal busi ness day.
9. No matter where you telephone from or to; your voice travels
both underground and aeri al ly, and i s ai r conditioned duri ng its
travel s through our cables.
I 0. An extensi on tel ephone in color makes an excellent and thoughtful
gi ft for bi rthdays, anniversari es and special hol i days.
I I . Almost I 0, 000 changes i n telephone equipment wi l l be made by
our i nstallati on force during the year I 960.
I 2. We l i ke to give you servi ce wi th a Di al .
Ol|lcars and ÏmDI Oyaas at annual OutI nz I n I J Ja.
lromanoIdIocaI tcIcphonccompany`spropaganda.TbiswaspublisbcdmÜ6 ¡9`s.
ZM July, 1 987 Page 17
(continued fom page 13)
understandi ng that you can' t l egal l y
t r a ns mi t dat a vi a CB r adi o ( and,
unfortunatel y, he l i ves fai rl y cl ose t o a
Canad i a n Depa rt ment of Commu n i ­
cat i ons l i st eni ng post ) . We have
thought a l ot about vari ous methods of
accompl i shi ng what we want to do, but
everyt hi ng seems to have some snag
We have t u r ned up some r at her
cur i ous t hi ngs i n thi s quest t o send free
data. For exampl e, a company cal l ed
El ectroni c Systems Technol ogy ( 1 031
N. K e l l og g St r eet , Ke n n ewi c k ,
Washi ngton 99336, phone ( 509) 735-
9092) makes a dev i ce ca l l ed t he
" ESTeem Wi rel ess Modem" . From
what I can tel l , thi s devi ce i s a cross
between a Termi nal Node Control l er
( a s u s e d by t h e h a m s ) a n d a
t r a n s c e i v e r . I t t r a n s m i t s o n 24
channel s i n the frequency range of
72. 040 to 72. 960 mhz. I t i s l i censed
usi ng "FCC form 574" ( under "Part
90" of the FCC regul ati ons, I bel i eve).
And when I fi rst heard about t hi s uni t. i t
was be i ng used to t r ansmi t dat a
between t he United States and Mexi co.
I ' m tol d that i t can be l egal l y used i n
Canada as wel l , but what I ' m not cl ear
on i s whether i t can l egal l y be used for
cross-border traffi c beteen the U. S.
and Canada. Al so, i t appears that thi s
u n i t i s i n t e n d e d f o r b u s i n e s s
appl i cati ons, and i t seems that i t mi ght
not be possi bl e to l i cense it for what
wou l d b a s i c a l l y be c o n s i de r e d
" h o b b y i s t " u s e ( d e s p i t e t h e
t r a n s m i s s i o n o f t h e " b u y / s e l l "
messages that are forbi dden on the
amateur band) . I f you feel that I am
wrong i n any of these assumpti ons,
pl ease feel free to chal l enge them. I n
the meanti me, there i s one further
obstacl e-each wi rel ess modem costs
over $ 1 . oo! I can' t i magi ne why the
cost i s so h i g h when an a mateu r
Termi nal Node Control i erlTranscei ver
combi nat i on ca n be pu r chased f or
Fagc 18 JuIy, lº87 ZM
under $400, but I can' t afford one ( and
we' d need at l east two! ) .
I have been tol d t hat i t wou l d be
tota l l y l ega l to shoot l aser bea ms
across t he r i ver . But nei ther of us are
up on a h i l l ( and t hus "l i ne of si ght" to
the other) and besi des, such common
l ocal occurences as fog and very l arge
l ake frei ghters sai l i ng by cou l d easi l y
di srupt communi cati ons.
I t' s real l y frustrati ng that we shoul d
have to go through a l l of thi s to try and
obt a i n t o l l - f r e e co mmu n i ca t i o n s
between two l ocati ons that are l ess
than fi ve mi l es apart. By al l r i ghts, i t
shou l d be a l oca l t el ephone ca l l
between Saul t Ste. Mar i e, Mi chi gan
and Saul t Ste. Mar i e, Ontar i o. But ( my
personal opi ni on fol l ows) the Mi chi gan
Publ i c Servi ce Commi ssi on shoul d be
r enamed t he "Mi c h i gan Tel ephone
Company I ncome Protect i on Com­
mi ssi on", because they consi stentl y
seem to favor t he i nterests of t he
t e l e p h o n e c ompa n i es ( es pe c i a l l y
Mi chi gan Bel l ) over t hose of tel ephone
consumers. One of thei r recent act i ons
was to procl ai m that there wi l l be no
new Extended Area Servi ce areas i n
the state of Mi chi gan, and that i n fact.
some exi sti ng Extended Area Servi ce
may be di scont i nu ed i n t he f ut ure
( Extended Area Servi ce is the phrase
u s ed to d e not e t o l l - f r e e c a l l i n g
between t el ephone exchanges i n
near by l ocat i ons) . Ther e a re other
areas al ong the U. S. /Canada brder
wher e tol l - f r ee ca l l i ng is i n effect
between to exchanges on opposi te
s i des of t h e l i n e ( Sweet g r a s s ,
Montana/Coutts, Al berta a nd Poi nt
Roberts, Washi ngton/Vancouver, B. C.
are to that I know of) but we a
e not so
I n fact. not onl y is it a l ong di stance
cal l across the border, but we can't
even uti l i ze the servi ces of any of the
a l t er nate l ong di st ance compan i es.
Wi th t he excepti on of AT&T, none of
(continud on D02C22)
FOR SALE : ATARI 1 30XE Comput er ,
ATARI 1 030 modem, 1 050 di sk dr i ve, 1 3
i nch Sha r p col or TV, Koa l a Pad, word
pr ocess i ng, gr aph i cs and t el ecommu n i ­
cati ons software, manual s. Li ke new. Send
phone # to: Box 571 , Forest Hi l l s, N11 1 375.
pl ease send your best tel ecom ut i l i ti es to
Ma r k S. , 1 1 1 48 Bu r kar d Ln, Rough &
Ready, CA 95975. If I get enough together, l
wi l l return your di sk wi th other peopl e' s
submi ssi ons.
publ i c domai n software for the Appl e I I
fami l y. Two doubl e si ded di skettes ful l of
communi cat i on and deprotecti on uti l i ti es.
These programs were combed from the best
BBS and cl ubs nati onwi de. Send $ 1 0 cash,
check, or MO to Mark B. , 1 486 Murphy Rd. ,
Wi l mi ngton, OH 451 77- 9338.
WANTED: Techni ca l data for pay phones,
dot mat r i x p r i nt er s, a nd/or modems.
Look i ng f or schemat i cs a nd t heor y of
operat i on. Cal l ( 205) 293-6333/6395, 7 to
4 CST. Ask for Ai rman Parochel l s. Cannot
accept col l ect cal l s.
TAP BACK I bbUEb¯compl ete set (vol . 1 -
84) of hi gh qual i ty copi es shi pped vi a UPS or
f i rst cl ass mai l for $ 1 000. Over 40 pages
of TAP mater i al i ncl udi ng schemati cs and
speci al reports. Checks/M. O. to "P. E. I . "
Cash, M. O. shi pped same day. SASE for
sampl e. Pete G. , P. O. Box 463, Mt. Laur el ,
NJ 08054.
DOCUMENTATI ON on el ectroni c & di gi tal
PBX' s and swi tchi ng systems. Wi l l i ng to
t r ade/pur chase. Al so l ooki ng f or Be l l
S y s t e m P r a c t i c e s a n d o t h e r s u c h
paraphernal i a. Wri te to Bi l l , c/o 260, PO
Box 752B, Mi ddl e I sl and, NY 1 1 953.
32K MODEL J ÜÜ. U1 - Rom I I , dri ve, TS­
DOS, spr eads heet , modem cabl es, AC
a d a p t o r s , b r i ef c a s e i n c l u d e d , g ood
condi t i on, $ 1 200. New, ma ke a n off er .
Tandy 200 versi on of WordPerfect 4. 0
$ 1 50 or trade for 1 20 or 240 baud
exter nal modem. I BM PC & XT &AT versi on
of WordPerfect 4. 1 and MathPl an 2. 1 . $250
or trade for 1 20 or 240 baud external
modem. Cal l ( 803) 24- 6429 or (803) 233-
5753. Ask for Paul .
WANTED: Looki ng for a good used 5 or 1 0
megabyte hard dr i ve for the Appl e I I seri es
of computers. I f you are sel l i ng one or know
of anyone that is then send repl i es to: Bri an
F. , 1 003 W. Mai n, Apt. 3, Ottawa, I L 61 350.
TAI WAN ! Al l Ta i wa n comput er s and
accessori es ava i l abl e for di rect shi pment
for cost pl us shi ppi ng pl us 3% (quanti t i es of
50 0r more) . Gi l es, PO Box 1 2566, EI Paso,
1 7991 3.
I NEED I NFO on a power suppl y made for
Western El ectr i c by ACME El ectri c Corp. i n
1 9 7 1 . I t i s d e s i g n a t e d : R e c t i f i e r
Semi conductor Type-J87233A-2 LI . I nput
i s 208124Ov, output 48v/30a usi ng' SCR' s
as control el ements. Any i nfo wou l d be
a p p r e c i a t e d . A s c h e ma t i c wou l d be
wonderf ul . I ' l l be gl ad t o rei mburse copyi ng
costs. J. Kl ei n, 1 2330 Taki l ma Rd. , Cave
Juncti on, OR 97523.
FOR SALE : Texas I nst r ument "Afe i s­
per ur i ter" ( Si l ent 70 seri es) i ntel l i gent
dat a t er mi n a l . Ma ny uses. Reasonabl e.
Contact Ted K. , PO Box 533, Auburn, N1
1 3021 -0533.
are i nterested in enl ar gi ng our col l ecti on of
ci rcu i t di agrams for i nteresti ng el ectroni c
devi ces. Send l i st of what you want/have
and a SASE to: J. R. "Bob" Dobbs, PO Box
4, Shawnee Mi ssi on, KS 66202.
ZbÛÛ MEETI NGS. Fr i days at 5 pm at the
Ci t i corp Center i n the Atr i um-1 53 East
53rd Street, New York Ci ty. Come by, drop
off a rt i c l es, ask q u est i ons. We' l l be i n
P h i l a de l p h i a on J u l y 3 1 at t h e Ga l l ery
Shoppi ng Center . Turn page for di recti ons.
Questi ons? Cal l 51 6- 751 -260.
somet hi ng to buy? Or trade? Thi s i s the
pl ace! The ZOÜÜ Marketpl ace i s free to
subscr i bers! Just send us whatever you
want to say (wi thout maki ng i t too l ong) and
we ' l l p r i nt i t! On l y peopl e pl ease, no
busi nesses!
Deadl i ne ÎDf August issue: 8/5/87.
2ó0 JuIy,lº87 Fagc lº
(continued from page 14)
vary, but are usual l y in the forat : ( NPA)XXX­
ROAM, where N PA i s the carri er' s area code and
XXX i s the MTSO exchange. Cal l i ng that number
wi l l retur a di al or ready tone, after whi ch the
roamed CMT' s ful l MI N shoul d be entered i n
Touch-Tones. After a few seconds, the mobi l e
uni t
wi l l ri ng or the cal l er wi l l hear a recordi ng
stati ng that the mobi l e uni t i s out of range.
Te l o c a t o r P u b l i c a t i o n s ( 2 0 2 - 4 6 7 - 4 7 7 0 )
publ i shes a nati onwi de roami ng di rectory for
travel l ers wi th cel l ul ar phones.
Cel l ul ar Tel ephone technol ogy offers phone
phreaks compl ete safety by al l owi ng mi l es of
phys!cal separati on from the wi re pai r, and by
offeri ng thousands of l i nes to choose from. I n
addi t i on , al l thi s i s possi bl e f rom j ust about any
l ocati on , even from a car, boat , trai n , or ai rcraf t .
I t i s these characteri sti cs that are attracti ng a
sophi sti cated new breed of phone phreaks who
wi " enj oy u n p recedent ed conven i ence and
scuri ty.
catchi ng phreaks
(continued from page 1 0)
800-932 800-942 800-952 800-962 800-972
800-982 800-992
( Other exchanges can be used by l ocal phone
compani es-New Jersey Bel l , Mountai n Bel l ,
etc . )
So for the record, don' t use 800-877-8000
( U S S p r i n t ) o r 8 0 0 - 9 5 0 - 1 0 2 2 ( MC I )
i l l egi ti matel y. 800-345-0007 ( US Spri nt) and
800-624- 1 022 ( MCI ) are much less dangerous.
(continued from page 3)
digital switchig was caabl of
preaks and hackers din't get i and
show them.
Hackers have, through the hel of
2ó00, exposed entrament schemes that
shady idiviul engieered for reasons
of greed and visions of glory.
In ÍYöO. a bulleti board system
belonging to 2ó00 was raied by lw
enforcement authorities on the shabbiSl
of pretexts. Before we were arou, they
woul hve gotten away with it without
any problem. But we were able to draw
attention to the absurdities and
misconceptions. And the average person
This month we embark on another
educationl caaignprovig to the
average person that the phone
company stouch tone fee is a farce. We
have thefacts and now we've attracted
attention to this matter. The next coul
of months will be interestig.
They'll be other capaigns in the
futureand more mistruths. But,
looking back on our back isues, we can
see that what we've already been
through hasn't beenfor nught.
We hope you tke the opportunity to
further uderstand our uique worl by
examinig what are surely on the way to
becoming historical relics. It certaily
woul give us more space to move
around i you di.
Directions to the 2600 Meeting in Phildelhi
at 5:00 PI in the Gallery Shopping Center.
m 30th Street S tatlOn � where Amtraks come in), go upstai rs (if you'e ever seen
Wl�ness, you may rec

gmze the men's room) and follow the mmp to the SEPTA

m towards center city. Take this train two stops to Market Est. (NOTE: This
nde costs $ 1 . 50 but the conductor doesn't take tickets until after Market East. So
don 't ma�e it obvious where you're going and you `llget a free ride. ) At Market East,
go upstalfS to the Gallery Shopping Center and go to the lower level. Look for
people with 2600 buttons wandering around. See you there!
Fagc 20 JuIy, l987 2óW
' Í -
' ¯
! i ·
¦¦ ¯
. .
¦ l
.. ·¹|

! |
• ¨
' .
· . '.'
¬ ¯ r

¨ ¯
¯ �
- **
· .

|| J
| | ¯
. ¦
: |
| '
¦¦ ´
. '.'
' | �
J ´
from The Veteran Cosmi c Rocker
i |
¬ � ÷ - ¬ -¬ ¬! � - ~ - - --! , |
'� .� ¯� '�
v -� ¬; -¬

¬ =



. .| `.
*°¬ ®°*


'·- `·-.
¨ � ¯¯
·¬ :�
i i
' ! |

·. 0i ´ · - . ` ¨¯¯ ¯� ¯· = ( ¯� .. �
¯· `� ¨� ` ¯. .¯ .¨ . ·¯. ¯ � .| ·-
` ¯. " ¯¯ ´¯ ¯ ¯ ¯ �` � '� '· . |
• � ´ � ¯¯ ´- .· ¯ . ¯�¬ ´ ¯¯
' .
� ¯ · '¹ .. ' '·�' ''' ¯ ¨ `. ¯
; � :�: j G :�;: E: �(� �(� g�: :S: li ¯.·
:¦ ¨
"-', ,'-', .. --, ,'-', ,'-', ,'-. ,.., ,'-. ,'-', ,'-. ,'-', i !
? ¯ ¯� ¨¯· ¯¯ ¨¨ ¯¯· ¯·¯ ¯�· ¯�· ·�·�· . ! ¯
·¯ :S: IS: ::�) ::S:: ::S:I ::7: (S= :S: ::;:1 'S: !: -¸_¸º >·
¨.´ ´
. *.' '-.' ·
'=' °._° '-' '.° °-.' ¨..°
·i ¨
i| .¯. ¯_
H --
i : .


´ ·.¹
` �
- ·¯
·¯ ´:
¯ �'
. :
. ,
]| i�
." ¯
- · ·L
:- ¹
~ c
~ .
. ~
' L·

. ¯
¬ ¯
¬` · ¬
� I
' |
. |
: :
! Ì
: :
' '
' |
: |
| !
: :
'. u
' |
. |
· -
. l
·¯ . l
. | |
.¯: ' |
` ¦ .
· ¯ 1
* ¯ ¦ ¦
¬ ` ` ¨ u
¯ ¦
: ¦ |
2M July, 1 97 Fagc21
(continued/rom page 18)
the other carri ers offer servi ce here
(too sparsel y popul ated, they cl ai m).
Thi s despi te the fact that our l ocal
c e n t r a l of f i c e swi t c h h a s b e e n
converted for "equal access". Yes, we
got a bal l ot from Mi chi gan Bel l , wi th
only one choi ce (AT&T, of course-I
thought you onl y got those ki nd of
bal l ots i n Russi a! ). I guess I shoul dn' t
compl ai n too much-there' s an area
about 50 mi l es from here where there
i s no phone servi ce at al l (the fol ks
there tr i ed to get the MPSC to order a
phone company to give them servi ce,
but the MPSC deci ded i t was j ust too
' costl y to r un l i nes i nto thei r area, once
. aga i n protect i ng t he pr of i t s of t he
phone company).
The FCC recentl y had a proposal
before i t to create a "Publ i c Di gital
Radi o Servi ce" that woul d have been
j ust the thi ng for thi s type of appl icati on
( assumi ng that the Canadi ans woul d
have approved a si mi l ar servi ce), but
they turned i t down. I ' d l i ke to know
why some frequency somewhere can't
be set asi de for thi s ki nd of servi ce. I
hope the next ti me they wi l l gi ve us a
few measl y khz at l east.
Perhaps there j ust i sn't any way to do
what I want to do for a reasonabl e cost,
gi ven the present state of l egal i ti es i n
t he U. S. and Canada (certai nly i t i s
technologicaly possi bl e) , but i f you
have any suggesti ons, pl ease drop me
a l i ne. Any assi stance that you can
provi de wi l l be very much appreci ated.
You seem to have realy thought this
out pretty carefully. Keep in mind,
though that legality is a rather hazy
concept these days when it comes to
electronic communications. What's
legal today may not be tomorrow and
may already not be in someone else's
Alhough we'l most likely get al
kinds of suggestions from our readers,
these are a couple of options you may
Fagc22 July, 1987 2M
want to explore. If you can both get
access to network mai l through
Arpanet your friend might be able to
upload what you want and you could
cal up later through your node and
download hyou can figure out a way of
linking Telenet (USA) and Datapac
(Canada), you could also cut down on
telephone charges, especialy if you
both have local dial-ups. Although PC
Pursuit (the service that alows you
unlimited data cals for a set fee per
month) has no intention of ever going
to Canada, you can trick it by dialing an
alterate carrier's access number and
afer waiting an appropriate amount of
time, entering your authorization code ·
and number, just as you would if you
were using your own modem to place a
cal through an alterate carrier. This
at least allows you an alternative,
although it's not much of one. Also,
check out the various tol-free options
on alternate l ong di stance com­
panies-there might be a fairly cost­
efficient answer there.
Finaly, try being realy vocal about
this. Forget the computer business­
cal your elected officials and tel them
you have a friend or relative who's only
five miles away and you're sick of
paying through the nose to talk to
them. Apparently that worked in other
towns-it seems like something could
be done in your case. Make it known
that the other companies refuse to
serve your community. And if al else
fails, you can always mail disks.
NV 1 1 95J-0099
2600 BACK I SSUES (continued from inside front cover)
PRIVATE SECTOR RETURNI NG-Back onl i ne soon but many questi ons on sei zure remai n; THE BASI CS: DIVESTITURE: WHAT
HAPPENED?-an expl anati on of that whi ch |sconfusi ng the populace; FLSH. AT&T steals customers, Domi nican bl ue bxers. computerized
hoky catcher, Fal wel l attacked by computer, an astronomical phone bi l l , di al -a-porn update. phone bo th victorious; LEIERS: Getting credit
from a l ternate car ners, t r aci ng methods. mobi l e phones. Man i toba r ai d; ZbUU I NFORMATI ON BUREAU-bl ue box programs;
SYSTEMATICALLY SPEAKI NG: confusi ng payphone, cabuse software. centrex features i n your house. VAX BbbU,overcharge hunters;
VMS: THE SERI ES CONTI NUES-more on security features; I T COULD HAPPEN TO YOU! �what happens when hackers have a fight; DIAL
BACK SECURIT-holes i n the systems; FLASH: abuse of party l i ne, uni que obscene caller, news on pen registers, reprters steal Swiss
phones, pay phone causes pani c; LETTERS: aski ng questi ons, bl ue bx corrections, Computel compl ai nt, BBS security; ZbUINFORMATION
BUREAU-assorted numbers; SYSTEMATICALLY SPEAKI NG: Sprint and US Tel merge, write protect tabs wrong, Bell Atlanti c choses MCI.
cel l ul ar phones in Engl and, infrared beper, electronic tax returns, acoustic trauma; AN OVERVIEW OF AUTOVON AND SI LVER BOXES-the
mi l itary phone network and how your touch tone phone can play along; AN AMERI CAN EXPRESS PHONE STORY-a memory of one of the
btter hacki ng escapades; FI NAL WORDS ON VMS-security devices and assorted tips; FLSH: hacker zaps computer marquee, Soviets
deni ed computer access, cal l i ng the shuttle, new ways of steal i ng data, computer password forgotten; LETTERS: corprate rates. defeating
cal l wai ti ng. ri ngback numbrs. where i s BlOC?, credit where it's due. special dnumbr; THI S MONTH AT ZôU. Private Sector's return,
Computel and Compuserve. Telepub Bb, a postal mi racle; SYSTEMATICALLY SPEAKI NG: Jammi ng satel l ites. TASS news service, Soviet
computer update, di al i ng the yellov pages, Nonhern Telecom to destroy CO's. more phones than ever; RSTS FOR BEGI NNERS-basic
system functi ons, logi n procedures; MOBI LE PHONES: THEORY AND CONSTRUCTION-how to bui ld your own mobi l e phone; FLSH:
Bri ti sh phoneboth wedding. another l arge Spri nt bi l l . bad tenant databases. car breathalizers. phone phreak fi ned. Marcos phones for free;
LETTERS. blue bx coing, electronic road pri ci ng i n Hong Kong, UNIX bugs, more on AE hacking; A STORY OF EAVESDROPPING-from
World War I I ; THI S MONTH AT ZôU.transcripts of Private Sector raid, more on Compute!; SYSTEMATICALLY SPEAKI NG: b \ / to b divided.
Congress choses AT&T, Baby Bells don't pay AT&T bi l ls, equal access d numbrs. data encryption. DA fai l ure. AT&T loses its zero;
EXPLOITS I N OPERATOR HELL-haraSing operators from Alaska; THE COMPUTEL SCOOP; FlSH: Bel lcore publ ications go publ ic, US and
France link phones, computer grammar. shower phone. cel l ul ar moem. htgh tech parki ng meters. Congressi onal computer; LETERS:
forei gn phone systems. Russian phone b, numbrs to dial on a blue bx. Boston ANI. Cheshire Catalyst. CNA. ways of answering the
phone; ZbU I NFORMATION BUREAU-Autovon numbers, alternate phreaking methods for al ternate carri ers; SYSTEMATICALLY
SPEAKI NG: Wrest lemani a pins Bel l . sting bards on the rise, American Network fears hackers. free pay-phones plague Ne Jersey.
disposable phones, hacker terrorists; COMPUTER CRI ME REVIEW-a review of the repon from The Nati onal Center for Computer Cri me
Data, HOW TO HACK A PI CK-An i ntroducti on to the Pick operati ng system and ways of hacking i nto it; NOTHI NG NEW I N COMPUTER
UNDERGROUND-review of a new bok; FLASH: New York's new computer cri me law, a 6ô,dZ9phone bi l l , hov big computer crime pays,
publ i c phone secrecy. Capitol Hi l l hacker. Ci tibank money games; LETERS: Engl i sh phreaki ng. ways of tri cki ng sting BBS' s, called party
supervisi on, ZôU Phun B. Captai n Midni ght, RCI; Zb INFORMATION BUREAU-some phone numbrs; RESOURCES GUI DE;
SYSTEMATICALLY SPEAKI NG: Hands across Telenet. cal l i ng Kiev, Nynex bumps off Southwestern Bel l , stock market crash. cell site names.
Videophones; VI OLTING A VAX-Trojan horses, collecting passwords, etc., etc.; THE FREE PHONES OF PHILLY-Skyline providing
completely free service from pay phones; FLASH: town crippled by telco strike. prisoners make i l legal cal l s. hacker degrees. New Jersey tops
taps, ex-fed is tapped, water company wants customers' soial security numbrs, computers strike agai n. feeral employees "tracked";
LETERS: ASSOCiation of Cl andestine Radio Enthusiasts, IT correction. NSA. more on VMS. T elecomputist. a 9bUtrick; ZôUI NFORMATION
BUREAU-World Numberi ng Zones; SYSTEMATICALLY SPEAKI NG: AT&T sell i ng pay phones, automated operators, cel l ul ar di al -by-voice,
new Bri ti sh phone service, no data protection for Hong Kong, CongreSSional fraud hotline, federal phone fai l ures, I ndi ana telco threatens
AT&T; KNOWI NG UNI X-sending mai l and general hacking; A TRIP TO ENGlND-and the fun thi ngs you can do with phones over there;
FLSH: Phone fraud i n governor's house, Bi g Brother, Tettec fights back. vandal ism, 9\ \ calls: LETTERS: shutti ng O systems. legal
BBS's, VAXIVMS tips, ZbU I NFORMATION BUREAU-a l ist of telcos, a l ist of area Cand number of exchanges; SYSTEMATICALLY
SPEKI NG: USSR computers, ATM's i n Chi na. NYCE, 1 blue bxes, government phones, rural radio phones; SOME FACTS ON
SUPERVI SI ON-answer supervision expl ai ned; RCI & DMS- l o BUGS; ANOTHER STI NGER I S STUNG-Maxfield exposed agai n; FlSH:
NSA drops DES. hackers on shortwave. Bi g Brother traffic COP. crosstalk saves a life, I ndi an phones, video si gnatures. FBI shopping l ist.
ai rphone causes confusion; LETTERS: Captai n Midni ght. annoyance bureau. SL- l switches. credit. PBX' s, SOword-numbrs. publ i c CNA's;
ZbUI NFORMATION BUREAU-Winnipeg numbers; SYSTEMATICILLY SPEAKI NG: Sprint overbi l l s, AT&T ranks 4 \ , portable VAes, cal l
rejection; DEATH OF A PAY PHONE-nasty busi ness; TRASHI NG: AMERICA'S SOURCE FOR I NFORMATION-st i l l moretacties; FlSH: FBI
investigates coffee machi ne. CI S copyrights publ i c software; Navy sofare. HBO encrption. I ndi ana "Fones· ' ; LEIERS: Numbrs. telco
harrassment, Puerto Ri can telephones, Q' s and Z's; ZôUI NFORMATION BUREU-Overseas numbers; SYSTEMATICALLY SPEKI NG:
Electroni c tax returns. software makers crash BBS, I CN. Ultraphone. ESS i n Taiwan, NSAwants new chi p; I CN-MORE THAN A BARGAIN­
a look at one of the worst phone companies in the world; MASTERI NG THE NElORKS-communi cati ng on Arpanet. Bi tnet. etc. ; FLSH:
Reagan tonures patients. FBI angers parents. Q and Z controversy; LETTERS: Telenet hacki ng, ANI 's, B1 \ . 9/b problems; Zô
has too many customers. new payphones, ni ckname l isti ngs. computer college; A LOOK AT THE FUTURE PHREAKI NG WORLD-Ce� l ul ar
KNOW ABOUT; FLASH: Avoiding rejection, phreaks tie up ci rCUits. North Carol i na hackers. i nternati onal hacki ng. payi ng for touch tones,
wiretaps; LETERS: Equal access dnumbrs. strange numbers. I ri sh phreaking. di sabl i ng cal l wai ti ng; ZbUI NFORMATION BUREAU­
Netmai l si tes; SYSTEMATICALLY SPEAKI NG: Free directories. fi ngerpri nt | Usystem, navi gati ng with CO' s, sweeping for bugs.
Al l issues now in stock. Del iver withi n 4weeks.
D 1984 $25 D 1985 $25 D 1986 $25
2600 Back Issues
P. D. Box 752
Middle Island NY 11953
(your address label should be on the back a/this/arm)
2H JuIy, lº87 lagc23
CELLULR FRUD ø ø ø ø ø ø ø e ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø 4
HOW PHREKS ARE CAUGHT ø ø ø ø ø ø ø 6
TELECOM I NFRMER ø ø ø ø ø ø ø ø ø ø o ø ø ø ø ø ø ø ø ø ø ø ø 8
N.Y. TELEPHONE EXPSED ø ø ø ø ø ø ø ø ø ø ø ø ø 9
LETERS ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø 1 2
2600 MARKETPLCE ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø 1 9
SAUDI ARIA BBS'S ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø ø 21
Middle Islan, N1 1 7åUåJ.

Sign up to vote on this title
UsefulNot useful