============== Page 1/1 ============== • • • •7 • 1 . W 0 our knowledge, no newsletter was ever published. I t appears that plagued with higher frequency harmonics, It Is better than a square sornaeof their subscribers did complain to the Postal Inspector and wave but worse than a sinewave. to the magazines, but none, to our knowledge, ever received so ' 4 • : _ rntieh.a.i a reply from them to any complaint against COMPUTEL, (D) TRAPEZOIDAL WAVE: A trapezoidal'. viaild can be generated or a refund. Apparently, COMPUTEL was allowed to continue Its by clipping a triangle wave. I n modern MIT ervi ment, trapezoidal ads in spite of complaints against It to the magazines! Although, waves are used because they are harder to T h u s , trapezoiwe have NO PROW, we suspect that COMPUThi. is an FBI or po- dal waves are preferred for Blue Boxing. lice scam used to produce mailing lists of people Interested In ' • ' • • 14!d2'":"4.; phreaking, and to e t phreaking pros to submit articles to learn of (E) SINEWAVE: Generated from analog ecripment;:the sinewave' new techniques. : asked us to submit articles. I f you know any- has no harmonies and, before the §dvent.31 t r a W a l 14F r t e s , thing about p l e a s e send to us and wasw a sthe preferred m s ' . • 'Waveform for all f a r .• to 2600.: (F) CLIPPED SINEWAVEr The cliPped-Sine wave closely resembles W A V E S F I A P E S ;• Most phone Color boxes require the generation of 'certain waveforms; the trapezoidal wave, and works as weld to accomplish their T h e pulses that make up these waver; ' ( G ) tinti4rCiSCILLAT6R.IVAVEzith raC A e firms can take, hit: 'num , § f waveshapes. . The various posal$e • bles the sinewave (some. 'slight distortion e n d waveshape0 are: • - : sinewave for boxirtg. • . SQUARE . W A ' C o n t i n u e d N e x Paget Square waves are-- the easiest to geneiiite digitlal circultat_4. Unfortunately, they are rich In hIgier fre-! " hannentd; sound harsh and are thus more risky to use.: The; risk in using square waves largely depends upon the method of coUpInto the phone Circuit - I f a direct, electrical coupling is maife__,. alt t h e 300 H z cutoff frequency of most phone. circuits will tent to do: some.ainoothing,it won'tdo enough,-to-snake a big differ -6; .ence.,,' If l l i t t ‘ b a by holding the box speaker to the phone: Mouthpiece c a l ' couplIng)- or by inductive couplingfiltering will be substantial and the resultant waveshatie will amroximatea wave. Although most phreakers prefer to- acoustically couple using ripped-off payphone earpi_eces, one can ptirchase an excelr!! lent inductive coupler from TRINETICS INC". 15107 Currant Mishawaka, 461, 46,544.L . • : . . " • - • • - • - • 'HP FILTERED SQUARES WAVE: Filtering ea the [sigh frequen car harmonics from a square wave produces *. ric-tootkwaye4lot nPrrnift•-•-used W.04;c1082; . ThIANGLCititaki-.3:A:tiriarigreweve:Caithegenera' s l o e PHONE COLOR Signet14- $6k-EXAllrXR,-2240 aricr othineostillator C h i S t i l l ALIFICATIONS ELECOSECU I A G E N Years ago, you pald a-arpise Visit osi Us becittise yaiclaitned Although every reitkinatle effort hidbeeri. made to provt c o o l - our TONE. DEAF publitaUm information was being, used by phone .1. Pfete and accurate information, we do not assume liability for any phreaks tO• rob the phone company. Althouffi your visit provided rj osses or damages whatsoever, either 'direct or consequential,' for clear proof' that our methods work; Your visit was obviously an an errors or omissions found herein.: PHONE COLOR BOXES Is temppl4. to intimidate us into ceasing H a i t i a n . B e advised that 'as is',, and for EDUCATIONAL PURPOSES ONLY: W e we Have the right to' publish y o u find herein under otsg:t.; _; e s t ; that Illegal devices of arit.: First Amendment; rights. I f , you are c o n v i n c e d of that fact E actuall ! ; ° . equipment at any time. , . nowiit can. only surae*VA4 you fire the shysters you fITYPIPY. • -' • i f yisen f C r . Is, ; p l e a s e let us know, CONCONS(.. hue competent atOrnc7s.... TIM NATIONAL CLEARINGHOUSEFurther b e advised that' if you wish- tar. visiVus a t e . ca�ra:rni FOR SURVIVAL INFORMATION.. PHONE COLOR BOXES. Ias PHONE-COLOR BOXES,. TONE DEMI' .and..-or any o u r other pta,.. as most' of our other' " 114tions) has benefited from substantrailo- liCitiOntc _we will; charge you $;,o00.qo .,per hour for our valuable forrnatiOnlittontr . i t t o S t r y . from TAP acid 2600.: Vk Hank tirna','. The time will 'include preparing for your visit, your visit, &id: t of these tine liCatiiins: fa the privilege of liberally quoting any. action. that we feel that your visit either directly or Indirectly L ...41 excerpt! from: their fine publiCationt., : • requires us to take. Any part of an tiourovill count as a full how. , : • ; • • ye alto require that Out • •••••• • • •-•'• If you have I h a r d -to-shit, invaluable, end-iirshock(flSchedule.:your• visit with us c a l e n d e r dayi in art r ing survival o r n i a t i c o of any type,please send it to us for iranCe in voritihsv ••••• ' view. W e are partiCulary Interested In innovative computer securi- • (2) Describe to us the exact nature and' scope of your visit, In ty techniques - particularly dealing with ATMs and Credit Cards, writing, and Improvements on the security techniques found. I f your infor- .. i n Provide us with identities of all of your people who will visit mation Is new and substantial, we are interested in publishing It In us, including their office positions, addresses and phone numbers. the future, and -you- want •compensation• for it, we will negotiate and the names of their immediate supervisors, hi writing. with you for the rights to publish your information. Please send us • ( 4 ) Accompany your schedule letter with a valid diedc made out all of the Information you have for our review, to the address below. to CONSUMERTRONICS CO. for at least $10,000.00 towards coverIf compensation is desired, please specify that intent in your cover ing resulting charges.- • letter. • (5) Agree that none of your personnel will carry any kind of weapon_„_recording.device or radio transmitter with them for this visit. Due to Iack of staff, we cannot provide advice to solve complex I n (6) Agree, in full, and in writings to cover ALL of our legal exdividual problems. F o r all inquiries, please send us a letter/note, penses resulting from any kind of civil action brought by you and-or and enclose a #10 SASE. Please do not phone. I f we are able to by us in which your visit Is referred to in testimony. help you, we will respond. . • any of the above (I)-(6) requirements are not fully agreed upon We are available as security and survival consultants for a fee. If honored by you for any visit, we will charge you $10000.00 per Please send us a complete description of your problem, and $25. and hour for our time (same basis of calculation as above), and the proviWe will perform a preliminary analysis of your problem for you, sions of (6) will automatically go Into effect as if you had agree and provide you an estimate. W e guarantee total confidentiality. with (6). We can handle virtually any problem relating to security and survival from software development to searches of any kind. 4 . . Whatever unpaid balance remains outstanding will accrue an Inter-i est of 1.5% per month. To "visit" means to visit any of us at any f4 We publish 70+ survival publications on energy, weapons, security, time inside or outside of our home, or to visit our home when unoccomputers, electronics, financial and medical. Along the same cupied. vein as PHONE COLOR BOXES, we also publish TONE DEAF ($7), VOICE DISGUISER ($7), TELEPHONE RECORDER INTERFACE Finally, be advised that should at any time your personnel appear ($7), COMPUTER PHREAKING ($15), ABSOLUTE COMPUTER life threatening or to endanger our property, we shall take whatever FILE SECURITY ($25) and CRYPTANALYSIS TECHNIQUES ($25). non-violent and-or violent measures be required to neutralize your Please send $1 for our SUPER-SURVIVAL CATALOG (free with actions. T O AVOID AN UNFORTUNATE MISUNDERSTANDING, $10+ order) to: CONSUMERTRONICS CO., P.O. Drawer 537, NEVER APPROACH US UNSCHEDULED OR I N ANY KIND O f Alamogordo, NM 88310. THREATENING, SHOCKING, SNEAKY OR SURPRISING MANNER1! 3 28 • 1 2 3 4 6 6 9 o Pots '700 900 A 11 0 0 — ^ 1300 1700 -. 0Z > 4 C 2 111 . 11111111 . 1111 1 1111 1111W. 103k 7 6 5 4 3 2 1 A 80388(top) C ffi I It 2 3# 900 - + ▪ i m m a l 1 1 0 0 _ • si= -1 L • .3 B 1 5 100k On-off Ok B 8038(top• ) - 1. __J . _L 8 2 k 8 1 0 11 12 1 4 4U0-tiNt-T-Battery 7- , u o i n Telephone 'Earpiece *in/Ms/L. Out -17 8 5ill4 31---'1442 1 0 -us 2600-" =1.1J O 741 Op Amp. . Top n V i e w s V+ f82k 1300— 0 0 8 1 0 11 12 1 4 ,As stated earlier, Blue Boxes are used to obtain free L D phone calls by manipulating MF signaling. T h e most popular Blue Box. circuit we've been able t o find is the "New Blue Box." T h e Intersil 8038CC Function Generator is the basis of this MF generator. By vary ing the external resistor, we change' the frequency o f the 8038. Distortion is about 1%. The diodes route the power supply voltage for different tones. Double-pole switches are available, and they eliminate the need for the diodes. Quiescent current is about 45 ma (mainly due to the 8038s), so power is kept OFF until the box is used. Tuning is easy. O n e plugs in #1 8038 in the #1 socket, and fine-tunes the #1 bank of frequencies. T h e #1 8038 is then removed, and the 02 8038 is installed in the 02 socket. Frequencies of bank #2 are then fine-tuned. A f t e r all frequencies are set, one plugs in both 8038s and is ready to go. Resistom-1/4 watt, 10% Voltaae Regulator LM-100, or L M -B00 Qp-Amp 741CV (National, Signetics, etc. ) Oscillator 8038CC (Intersil)available from Polypaks, Babylon & others. jaatterv-Eveready 411 or 417 15 volt. Capacitors are in Mfd. except 47 pf. .01 mid. caps are polystyrene or mylar. All capacitors are 15 volts or greater. Diodes-small-signal matched germanium, or silicon. Pots- 25k, 1 0 or 20 turn trimmers . NEW BLUE BOX SOME PHONE BASICS CONSTRUCTION HINTS There are two basic ways of dialing a phone: ( 1 ) Rotary dial. ( 2 ) Touch-Tone. Aside from the two electronic methods used to trans-! late your dialing efforts into actual numbers, there is no difference in the effects that they have on the phone system. The easiest means o f prototype construction is with wirewrap on perforated board. Mistakes can be easily corrected, modifications can be easily made, and construction can be done compactly. T h e trim i s shown i n these schematics should be 10- or 20-turn CERMET pots. Av o i d wirewound pots - they are too temperature sensitive. D o n ' t t r y t o skimp by using. single-turn pots or one trimpot to serve all frequencies as. fine tuning and insensitivity to vibration are critical. A l l resistors should be metal-film (not carbon), b e cause m e t a l -film resistors h a v e better temperature stability. Capacitors shown in pf should be polystyrene if at all possible. The banded end is the negative end. I f not prilystyrone, use mylar or mica capacitors wherever possible. There are two basic types of telephone offices thru which all calls are switched. T h e first is the Central Office (CO). The wires from your telephone go t o your local CO. F r o m there, i f your call is a local call, i t is swit ;hed to the destination phone i f served by the same C O , else t o another, local C O that serves the destination d�oonne then to the destination phone. The three-digit call prefix dethe CO that serves the destination phone. M o r e than one CO' occupy the same building. The number of COs in your community i s equal t o the number o f three-digit prefixes your local Bell serves. For L D calls, your call is switched to a Toll Office (TO). T h e TO connects distant COs to each other. Most COs• have a Centralized Automatic Message Accounting (CAMA) system. The•CAMA equipment records your number, the date and time, the destination number, and the duration o f the call (after call completion). ;This is used for billing purposes. The CO relays the LD number to the TO. T h e TO contains a sender, which sends by whatever route is easiest a series of Multi-Frequen-' cy (MF) pulses to another TO in the area that you called according to t h e area code dialed. These pul4ts are picked up by the sender, in t h e distal TO, which translates the three-digit prefix and connects you to the CO dialed. This CO then translates the remaining digits of the phone number and connects you to the line you dialed. When the destination phone is answered, a signal is returned all the way down the line to your local CO to say that the call was completed. T h e n , when either you or your friend ("phriend") hang up, another signal is sent to your local CO to say that your call was completed. C A M A then sends all this information to the billing office. Since AT & T broke up, L D calls are billed by your LD Bell billing office, and local calls by your local Bell billing office. One other thing about phones, the terms "tip" and "ring" are old terms that relate to the tip and sleeve of phone plugs. Just remem-, ber that "tip" refers t o the green wire, while 'ring" refers to the' red wire. Consumerhonics Co. 2011 CRESCENT DR., P. 0. DRIVE 537, ALAMOGORDO, NM 88310 Most o f these designs require CMOS IC, because CMOS draws far less current than T T L , and CMOS can be operated over a much greater voltage range. C M O S circuits are static-sensitive. O n e should ground himself t o earth ground thru a 1.0 M e g resistor (NEVER DIRECTLY CONNECT YOURSELF TO GROUND). A l l i n puts to any CMOS device MUST BE CONNECTED - to an input, to ground or to +V. A n y non-terminated inputs will cause circuit malfunction. A l l outputs need not be connected. It may seem silly to use a voltage regulator with battery power, but CMOS oscillator frequencies, and some other components, are sensitive t o voltage level and tone frequency stability is critical. I f one uses fresh alkaline batteries only, he can get away without voltage regulation. Else, voltage regulation must be used. We also strongly recommend using sockets for two reasons: (I) They make fine-tuning and repairs much easier. (2) Between box applications, one should pop some of the ICs out of their sockets to prevent unauthorized people from using the box and-or making hostile accusations based upon circuit design. THE MENACE OF ESS Electronic Switching System (ESS) is definitely the future wave in the Bell systems! T h e "Electronic" really stands for "ComputerControlled." I t is a menace to not only phone and computer phreakers but to all citizens. W i t h ESS, Bell will have total computerized control o f YOUR phone lines! N o t only will Bell have a record of every L D call you make, but o f every local and "free" call. A n d with massive computer memories, tremendous speeds and voice r e cognition technology, the future portends that Bell may also soon have a digitized recording o f a l l actual conversations made b y phone - recallable within seconds to any hooked-up computer terminal or printer anywhere in the world! Continued Next Page As it is, at least four Government agencies, plus the Soviets and per- 4 . haps a few other countries, can scan most of the country's micro- E . 7 0 ms 70 ms 3 5 3 5 3 5 . 35 3 5 3 5 9 5 9 5 wave phone transmissions to pick out conversations based upon cer- I 16. tain words and phrases spoken during them. F o r example, if you responded to a question from your Mom with, "I'll kill time by watch- 1 1 4 - - - I l i s t - - - 1 0 1 4 . 2 n d . 4 0 , 3 r d s , 4 . 4 t h . , + . 5 t h , ; 4 ing President Jones...", the "kill" and the "President" could trigger • a Government computer to lock in on and then record your entire conversation and create computerized files on you (and your Mom) files that would automatically be transmitted to Government Intel- 1 2 70 msec go msecil 80 msec;1 8 0 msec! ligence .agency computer systems under terrorist headings. A n d you wouldn't even know about i t ! Yo u r file could then get mixed up with that of a real terrorist, and transmitted to thousands of law 1;-;' enforcement entities. Before you know it, a Swat team is butcher- I 1 7m s0e c 8 0 msec ing you and your kids!! I t doesn't take much imagination to figure N out how gravely dangerous this situation is rapidly becoming!! When you drop in more than one coin, the beep-combinations are a p One of our most popular publications is the VOICE DISGUISER ($7). pended to each other, as far as waveforms go,-bu't the.total number It's clear t h a t many Americans a r e waking up t o this menace! of beeps indicate t o the operator the t o t a l number of nickel-units PHONE LINES ARE NOT PRIVATE - USE YOUR HOME PHONE TO deposited. F o r example, if you deposit a quarter, two dimes and a THE BARE M I N I M U M - NEVER F U L LY IDENTIFY YOURSELF nickel, the quarter waveform will be produced first, then the waveOVER THE PHONE - NEVER SAY ANYTHING CONTROVERSIAL, forms for two dimes (four, 80 msec beeps), then one nickel (one, 80 SUBJECT T O MISUNDERSTANDING O R I N JEST - NEVER USE second beep). T h e operato^vill count 10 beeps, indicating a total WORDS LIKE "KILL," "ROB," "DRUGS," E T C - USE A VOICE DIS- deposit of 50 cents GUISER IF AT A L L POSSIBLE!! Paranoia is fear over an imagin-; COUNTERMEASURES ary menace. T h i s menace is real and today! A n d don't phone us always write. Bell has implemented these countermeasures: PAYPHONE TONES Since ESS can record every key that you press, it will also record, very foreign tone that you "play" over the phone. I f you decide to! entertain your Aunt Mildred from Marfa, TX, with your rendition of Mozart, send her a cassette tape by mail! ESS also permits immediate call tracing. F o r example, if you were' to place an anonymous tip to your local police, all they have to do is tap a button on their console, and presto!, within three seconds,: they have your name, address and phone number on a CRT or prin-i ter! L o n g gone are the days when some hapless servant of Bell had! to rush u p and down mainframes t o record activated steppers! Long gone are the days that your private call was hidden among the tons of wires hiding other people's calls! L o n g gone are the days that a pennyless, free-spirited hippy could calf home to Mom from the corner payphone. ESS will make placing phone calls much faster, will cut down enormously on fraudulent calls, will permit direct dialing overseas, and will provide a myriad of other nice phone conveniences. B u t ESS can be too easily corrupted and abused by those in power, and like, creating super humans from recombinant D N A experiments, thisi technology is just too risky to our privacy_ and freedom. N O T ALLI TECHNOLOGY IS GOOD, A N D THERE IS NO MAJOR TECHNO14 OGY EVER INVENTED THAT WAS EITHER FREE FROM CORRUP4 TION OR FREE FROM DEFEATS! PHONE COLOR BOXES The four major phone color boxes are the Red, Blue, Black, and CF gat'al3ox: RED BOX The Red Box is an electronic device that mimics the pulsed beeps produced in payphones ("fortress phones") when one drops coins i n to it to make a phone call. T h e objective is to make free payphone calls. T h e Red Box may be an electronic oscillator that produces the right tones, or a high-grade taperecorder in which previously r e corded tones are played back. f o r recording, the taperecorder is connected directly to the phone line to record the coin sounds - riot acoustically coupled. A phriend calls from a payphone. When the' phreaker answers, the phriend deposits coins into the phone while "he ohreaker records the beeps. T h e nhriend can't hear the beeps because the earpiece i s muted during coin deposits. L a t e r, the phreaker plays back these sounds to simulate his own coin deposits. Note, that Red Boxes only work on single-coin-slot payphones - not on the old ones that have three round coin slots at the top. The tones' intervals are not generated by the coins pushing levers: on the payphone mechanism as most people believe, but by a small relay which reverses the direction o f t h e wheel that the levers cock. I n other words, when a coin is dropped by the operator, i t ' pushes a plastic vane lever which cocks a wheel. T h e coin then drops into the drop chute, and the signal goes thru a 70 msec delay to allow the coin to clear the mechanism. Then, a unijunction transistor (UJT)circuit pulls i n a relay solenoid, which unwinds the! wheel until i t returns to its start position. T h e number of times' the relay ticks, while pulling the wheel, is the number of beeps. I f the wheel went five notches forward, a switch drops, programming the unit to do 35 msec beeps (quarter). However, regardless of the coin used, the first beep will be delayed 70 msec to permit the coin to clear the mechanism. See the figures for the precise waveforms. These beeps are critical. If not precisely produced, fraud will most likely be suspected! I f a taperecorder is used, i t must be a high quality one that runs 7.5 IPS r faster. (1) ANALYSIS O F COIN DEPOSIT WAVEFORMS: M o s t amateur phreakers build oscillators that produce pulses o f constant width, and frequency may not be precise enough. Thus, the poor attempt to simulate the quarter will immediately reveal that the payphone is being boxed! However, if the beeps are almost perfectly replicated, this contermeasure is avoided. (2) C O I N SENSE R E L AY: B e l l operators can inspect the coir sense relay's pull-in current. T h i s relay is activated by the plastic vane which senses the presence of money. T h e coin sense relay cannot be made to activate anywhere in the system, except by the actual contact o f money with this vane. However, Bell can't use the relay t o verify money deposited until the operator drops the money into the phone's cache. S i n c e all of the money is droppe'., the same time, all one needs to do to beat this countermeasure to actually deposit one coin (or slug) because even a nickel deposi activates the relay the same as $10 in coins! Further, since the de posit for the first three minutes is automatically dropped and doe, not go thru the vane-relay mechanism, no seed coin need be deposit ed to use the first three minutes. When one makes a LD call from a payphone, the operator come on t o tell him what to deposit for the L D call. She then return the initial quarter. This resets the coin relay in the open position and removes the relay from the circuit. A f t e r one has made hi Red Box beeps, the operator need only to check relay continuity t verify i f money was actually deposited. I f the relay circuit is stil open, she will suspect boxing. (3) DIGITAL OUTPUT: W e have been told that Bell is upgrading it payphones to provide a silent digital data output to tell its comput ers precisely how much money was deposited. This is in addition t the coin beeps. When phones are boxed, only the beeps result. Th• absence of the digital output will alert Bell to boxing attempts. (4) ACCOUNTING PROCEDURES: E a c h call that is made from payphone requires t h e deposit o f a certain amount o f money These recorded deposits are accounted for a t the billing office on monthly basis, and a computer printout results. T h e compute, amount then is compared to the actual amount collected from tbpayphone. W h e n a payphone starts going short, Bell immediate checks to see if i t is because of an electromechanical failure in t h phone, operator error, data processing problem, external theft ci internal theft. I f Bell concludes that the shortage is due to external theft, or finds slugs or tampering evidence, i t then more closely scrutinizes activity a t that phone to determine a fraud pattern Phreakers, like everyone else, tend to develop habits, certain i0C? tions may be favorite hang-outs for "phreaker types," and certay payphones get the reputation of being easier t o rip-off (the w c gets around). B e l l security and the police will then stake out tr. phone. T h e clever phreaker always avoids predictable behavior, re petition and "popular" phones. (5) INCORRECT TONES: S o m e payphones use a dual tone (17" Hz and 2200 Hz), but most still use only (2200 Hz). The presence a d u a l -tone where not appropriate will trigger suspicions. S i r most payphones still use 2200 Hz only, if one doesn't know, it's sa er to go with the single tone. O n e can tell i f a payphone is dual single by having a phriend call him from it. Have him deposit coin. (or slugs). T h e phreaker will hear the tones and be able to tell. Continued On P. 7 PHONECOLORBOXES 4 5 00•111011•1110•011011011011•110000•1100•000•0011•11•1101110001100011•11011000110110001101100011•1101.80•••■•••11011e CONSTRUCTION: A l l ICs, except the SR, use only +9 VDC. T h e S R s o uses -9 VDC. B o t h the Vss and Vee of the 4051s should b e . . grounded. V d d is +9 VDC. T h e input to one unused SR should bets a This box has excellent stability with voltage and temperature. I t , grounded. T h e LED is needed although i t does use power - a t a I f * uses 9 common ICs-and two 9-volt alkaline batteries. Quiescent cur-, glance i t can tell if the data has been accepted or when memory is:a ■ rent is about 2 5 ma, use current is about 30 ma. T h i s Blue Box is' clear. t o ■ g capable of producing all 15 MF codes. Other codes, such as CCDE' • 11 and CCDE 12, can be included just by adding input switches and' CALIBRATION A N D USE: T h e r e are a few methods that can be g• 2 appropriate diodes, and wire up the respective outputs of the anaused to calibrate this box. A DIP switch can be added to the output • a l o g switches. of the SR to pull these lines up to +9 VDC. I f this is used, set the o W h e n a key is pressed, the diode matrix in Fig. 1 produces a bin-' switch to the code for the desired key (ex. "0101" for Key 5). Then ary code on Lines A -D, corresponding to the key pressed. N o t e that press the SEIZE Key t o enable the oscillators. O n e can also w i r e , : the code "0000" is not used here, i t is reserved for 2600 Hz. Whenup a 16-pin plug that can be used to replace the SR. Connect thelm 0 ever a key is pressed, the S Line also goes high, indicating a valid input pins to their respective outputs and substitute this plug f o r • a code on Lines A-D. the SR. When a key is pressed on the keyboard and the SEIZE-Keyl 2 I n Fig. 2, Lines A -D and S go into the 2519 - a hex 40-bit Shift is held, the desired tone is heard. ; • z Register (SR). O n l y five of the six SRs are used. T h e input of the To use this box, first clear memory by pressing the CLEAR Key.,•* • 6th. should be grounded. T h e S Line also goes to a debouncing cir-, Enter the desired numbers by pressing the respective keys. T h e 1•_ •acuit and schmitt trigger composed of the two inverters and associat-' LED should light each time a key is pressed to signify acceptance o f * n ed parts. T h e NAND gate takes either the signal from the schmitt' that entry. N e x t , call an 800 number and press the SEIZE Key f o i l • as trigger or the system clock and generates the clock signal for the, about one second. W h e n "Ker-chunk" is heard, one counts three"! e SR. T h i s is a neg.-going pulse of about 20 usec. Each time a key is. •• seconds, then presses SEND. O u t comes the merry tune! a pressed, the data at the input to the SR is shifted in. A n LED lights' The DEL Key is used when i t is necessary to separate sequences • whenever a key is pressed to indicate this. of numbers, such as for overseas calls (ex. to call "044 1 246 8000",i• • W h e n all numbers are entered, and one wishes to send tones, thei enter "KP 011 044 ST" then press the DEL Key and re-enter "KP12 • SEND Key is pressed. S E N D triggers % Flip-Flop (FF) formed by, 044 1 246 8000 ST"). When the SEND Key is then pressed, the first': .9 two NOR gates, and I t does four things. -It inhibits the, input cir-, sequence will be sent out, then the box will halt. Press the SEND ■ • cuitry from the keyboard so no more numbers can be'thtered; i t • Key again, and the normal sequence will be sent out. 3.0m.ngs the recirculate line o f the SR high so the data i v o o t lost' • • o . . e i t is sent, i t enables the output circuitry by w a y 1 4 the .E0' a 3 line and it enables the system clock to shift out the data. PROGRAMMABLE BLUE BOX a • W h e n data is shifted out o f the SR, i t appears on output Lines' LOGIC BOARDA • A, • A -D. I n Fig. 3, these go into two groups of analog switches. Each 31 group contains 16 switches. A binary code a t the input o f these • 4 • astl •to switches connects the corresponding output t o the Z input o f the • • 4051s (ex: if the code "0011" is present at the input, output Line 3 f:1 is connected to Z). T h i s places the correct resistor for the desired, le tc la tone in the circuit. L i n e 0 is used for generating the 2600 Hz tone., A s to 9 • Each shift of the SR thus places data at the input o f the analog 1wWlo aLswitches and selects the proper resistors for the two oscillator cir-1 cIs — 1 Inn rlo Rt. 7 : cults. T h e outputs of the oscillators are summed thru the two 3.3 wKohm resistors and sent to the phone earpiece. T h e tones are gat• e. ed ON and OFF by the NOT-EO Line. When all. the tones are sent, rtal toot • • ' N A wet the S Line goes from high to low and resets the send and clear FFs. *Tk Li.: • A few additional operational details: • jji• T h e CLEAR Key triggers its own F F (formed by the other two . ■ rOr o NOR gates), and does the same things as the SEND Key with two ■ exceptions: T h e recirculate line of the SR is held low, thus clear100i wing memory and the two oscillators are not enabled so no tones are a Produced. SAJ I • The DEL Key i s used to !delimit between sequences of numbers.' • ,• g g When pressed, i t clocks the SR without placing any data on its input. ■ • lines. T h i s fools the circuitry into believing that all. the lines have a been sent. NOl 'loot !do • T h e 2600 Hz tone is generated by pressing the SEIZE Key. T h i s in 1.29 NANO 4ott F. a Is the only key that does not use the common bus. When pressed,•it till',ftables the oscillators. A n d since the only data at the input to the slog switches is "0000" when M F tones are not being sent, the A *ax • top oscillator generates 2600. - r A : % Z i l a C t els !• • elk PROGRAMMABLE BLUE BOX rlIVEILTER 4041 • KENT IPART4.usT1 • a \4, tali . • • a • 7 ■ ■ .. • ■ • `*. ■ si frr i291 a • •*, ■ ■ ■ ■ ■ • ■ .' . .4. m a took t lfotc 100r ICOk 1 4 . • t IIM All =stators arc f watt St carbon film A. A. 6 12K.' • ' 4:361* 2 - 224401 o r o e i r . 1 - 2N2907 O F e g i v. 1 - 400 11 1 NAND NOR 4 2 - 4 0 4 9 INVESTOR 1 1 - 2 5 1 9 4 0 b i t h e x CR . 2 , I N • Kok e l i l K f • 5St .•. • ei • 26**01 • 21 • • All T A , O f • - T r rk S C ) IC • 11 0 o , . . 4 0 .eti. 5.1451 I - 1.11. IA* - 7, e r - 1 0 o r 2 0 t u r n SCK m e t trimpots - 4051 8 chal'n°1 a n a " f : K e y b o a r d , n w i t e h e s . I C 1 1 * ev1. • T 1 - . . , T . n 11CO sad . I I t I T • • Seise n o er- • 2N4tlot 1 - SS6 d u a l ' L a m e r I % 2 -1 0. 00 u- f .. o a p a c i t o r c 4 e 7 1 : 7 1 - . 1 01 ufu.f vier 10% 1 - 3 0 0 0 p f . polyntyrcnc 5 X 1 1 - 5 6 0 p f . p o l y s t y r ene . . 1 - - ■ • - Tr " f f i e t i - • • • • • • • , - . < , e o m i , 1 n a k 44:151 - 100 / r t t w t l w 0 C !L• 1: .4 n o . A v p i v i ; now 10 - 100X 1 -620K 1 - 1.221[ 1 - 220K • - 470K 1 - 270K 2 - 200K 2 - 150K 2 - 130K 1 - tlCK 1 - 71K 5 - 47K 2 - 2.2K 2 - 3.3K 1 - 1K 1 - Red LED 22 - 104142 c i r n a l d i o d o c : 1 or ecriv. 1 -263391 or aqii. 2 -4s 0 ■ ■ 111 4031 .MATRIA ■ ■ Di .. • -Az a • . • )1:0 cod T ••• 1 • • • _ V l t V Atallas Bauer >. c h I 9o U nockita. e t c . 1 1 1 6 1 0 4 1 6 1 4 9 2 0 , M O M O M O M O I S O U O U G M O O O M O D M M O M O I M M 0 2 0 1 1 , 1 • • O • W 9 1 0 8 0 1 1 • U N I O P...O- U. .O . UTMEMOMOMOIOOM . OMOMOMOROROi0M - OROMO AUTOMATIC,.BLUE BOX, The Automatic Blue Box is Similar to the Programmable Blue Box i except that more than one Opine bumber can be stored in it. I n this version, five 1 0 -digit numbers can be stored. E a c h number is produced automatically from the touch of a single key. Quiescent, current is 40 ma, and it uses a single 9-Volt alkaline battery. NUMBER ENTRY: Assume that the box has been cleared and a "1" (high) is in all 64 bits of each register. The switch enabling the k e y board is closed. N o w press KP; lines for the 1100 Hz and 1700 H z go low. A "0" (low) is placed on Pin 15 (Data In) of IC-9 and 12, but the data is not entered yet. A t the same time, Pin 4 of IC-5A and Pin 13 of IC-40 go low which drives Pin 11 of IC-14C low. This, in turn, makes Pin 10 of all the SRs low thru 1C-4A and IC-16B. This puts the SRs in data entry mode. Meanwhile, charge Is leaking off C3 thru R14 and, after about 9 msec, QD goes high and NOT-KD'I goes low. T h i s delay is to allow for contact bounce in the keyboard switches. Q D high drives Pin 2 (Clock Input) of all of the SRs high.' The data present a t Pin 1 5 o f a l l o f the SRs i s now entered. NOT-KD' went low a f t e r 9 msec which, thru I C -6A, ICs-17A-F, and I C s -21E-F turns O N t h e output amplifier (LM386), giving an audible click and lights the pulsing gate indicator LED. T h e LED stays lit as long as any key is depressed. The schmitt triggers (ICs-18E- F ) may be 4047s or 74C14s. T h e 4031 SR, unlike other CMOS ICs, has a large clock input capaci-, tance (Pin 2), so it works better when driven by more than one Inver /04m buffer output. RUN MODE: Assume that two 10-digit numbers each with a prefix of KP and a suffix of S have been entered Into the SRs. I will first describe the 1-of-2 Data Selector (DS) composed o f NAND gates, ICs-3B-D, and Inverting buffer, IC-16C. Tw o clock rates are used: 1280 H z supplied by the oscillator IC-23; and 10 Hz at the output (Pin 3 ) of t h e divide-by-128 counter (IC-20). T h e 1280 H z clock goes t o one input o f the DS (Pin 9, IC-3D), while the 10 Hz clock goes to the other input (Pin 12, IC-3C). T h e control signal appears, at Pin 4 of the NOR gate, IC-15B. When the control voltage is low, the output o f the DS (Pin 4 , I C -3B) follows the high-speed clock. • When this pin is high, the output o f the DS follows the low-speed clock. Now, press the R U N Key. 1C-4B's Pin 4 immediately goes high and stays high for 50 msec, and the output of the NOR latch compose of ICs-13C- D goes high which sends Pin 3 (IC-14A) low. A f t e r a !Ace rams 6BriekArag i s To e SANE AS THE 700 N. Giesesuram Aiwa a x c a n FOR 71113 VALU64 Of AA AND Re. s f i a 7 . 4 e L e Hfutwt Now, to play the numbers back. T h e next press of the RUN Key gets the first number. K P of the first number is at the output of the 1100 Hz and 1700 Hz SRs. The output of the KI+K2 detector is high, making trigger Input (Pin 6) of t h e reset generator low but this doesn't d o anything. T h e reset generator is negative-edgetriggered. L e t ' s press RUN again. A g a i n , we get the 30 msec d e lay- before the clock turns ON. T h e "No D a t a Detect" gates see data present at the SRs so the DS selects the low-speed clock. P i n 13 of the NOR gate (IC-15C) goes low and Pin 12 of the same IC-is also low because i takes 64 clock cycles before Pin 3 of IC-20 will go high. I C -15C then drives one input of all the output NAND gates high (ICs- I A - D and ICs-2A-B). P i n 7 o f the SRs IC-9 and IC-12 are also high so the output of NAND gates 1C- I C (1100 Hz) and IC-2B (1700 Hz) go low which turns ON the 1100 Hz and 1700 Hz tone generators. T h e output amplifiers and the "P" gate indicator are also ON so we have 100 msec of KP as per specs. K P Is 100 msec b e cause o f the 5 0 msec delay before the clock starts running (the reason for the 50 msec delay). Therefore, R2 and C2 should be chosen to give a 50 msec delay. !GI AUTOMATIC BLUE BOX' LOGIC BOARf ' Ilt 10K 'arm TONE GENERATOR V M S ••61 r i l i # P O N M P l e •"1"' N i c e J i n n t r e w Cele 50 msec, this turns the chick ON (1C-23, Pin 4), and drives Pin 1 of IC-6A high which turns ON the output amplifier and the P-gate indicator. A total of 24 digits have been entered into the SRs. Since these: are 64-bit SRs, the data is 40 bits away from appearing at the output. T h e two NAND gates (IC-5B and I C -4B) see all "P's a t the q output (Pin 6) of the 512s. T h i s thru I C -15D. I C -15B then selects the high-speed clock, so, a t a rate of 1280 Hz, data is stepped thru. the SR-s. After 40 clock cycles, two things happen, either of which will r e set the RUN latch and turn OFF the clock. T h e "End of Register" (EOR) counter (IC-19) has reached a count o f 6 4 ( I t also counts when numbers are entered), placing a high level on Pin 6 of IC-14B. Also, t h e K I + K 2 detector composed o f t h e 3 NAND gates (ICs2C-D and 1C-3A) has detected KP 1 a t NOT- Q output (Pin 7) of the 1100 Hz and 1700 Hz SRs. T h i s places a high level at the other i n put (Pin 5) and the NOR gate IC-14B. T h e negative-going pulse at Pin 6 of the reset generator (IC-22) triggers a 2 msec output pulse at Pin 10. T h i s resets the RUN latch, the EOR counter (IC-19), the divide-by-128 counter (IC-2C), and turns O F F the clock. A l l this happens in 81.25 msec, 50 msec delay before the clock turned ON plus 31.25 msec to shift 40 bEts thru at 1280 Hz. $55 R N I C S 0413 Mar 1410 • 1CSA la 700 ) s asom 7 100) • 1 0 K S • t S r E A R a a VOLUM, 161 1100) • ere 4 iloo) IRK 1600 ) TA I L ! VOLTAGE REGULATOR 3.113d13 RA 7000 ¶000 11000 13000 3 cox 2 2 0 K 1 6 0 k 1 S 0 K 1700 ) • ) LEAK wm ; Vo n I C et a l 150oo 1 3 0 K 17000 l i o t t 3COoo 7 SIC I 0 1 , 2 , 3 . 4 , 4011 Quad dual i n p u t NAND gate PARTS 105, 6 -Dual 4 i n p u t NAND gate I 1 107, 8 , 9 , 1 0 , 1 1 . 12-6031 6 4 b i t s h i f t r e g i s t e r LIST /013, 1 4 , 1}-2uad 2 i n p u t NCR g a t e 4001 1016-Hex i n v e r t i n g b u f f e r 4049 11017.-4050 Hex nen-inverting b u f f e r I018-74C14 Hex I n v e r t i n g Schmitt t r i g g e r b u f f e r /019,20-4024 7 stage b i n a r y counter 10214050 Hex nan-inverting b u f f e r /022,23-4047 Low power lionostable/Aetable s u l t i v i b r a t o r td.aff4 M4 a n a / M A wjipm. mn, ‘411116 at AsN 0,017 e t • :cm tc1•14 1.0•• Dag:. alE"111* •1•• 1.143 ms.of..14 Mee (PI 1 • leg 1V • I C a t 7 as 0 ) 411.1 ,c."20 ica'S 401.0.ATOA • 3 1671 a 4, I CA77 icas • 1 I 1CC1 &tit Pin 3 of 1C-20 goes high 100 msec after RUN is keyed. This turns OFF the tone genera-! tors and clocks the SRs to the next number. A f t e r 50 msec of silence, Pin 3 of IC-20 goes' low for 50 msec, and we get 50 msec of tones for whatever digit is after KP and so on for each digit until K P o f the next number i s reached. T h e n the KI+K2 detector output, which went low after KP of the first number was shifted past? again goes high, triggering the reset generator which stops the clock and resets everything. A second press of the, RUN key plays the second number in the same way. A f t e r the second number is played,' there are 40 bits of no-data so the "No Data Detect" selects the high-speed clock, which rapidly (31.25 msec) recirculates KP o f the first number t o the output of the .SRs and everything stops. The box is now ready to replay the first number. 700 r" ) 11 0 ji c:)woo 4 - 7 0 111 • 1 7 0 0 CLEAR MODE: When the CLEAR key is pressed, Pin 1 of IC-13A goes high. This is one i n put of the NOR latch composed of ICs-13A-B. T h i s drives Pin 3 of 1C-13A low which, thru 1C-4A and IC-16B drives Pin 10 low for all of the SRs. This changes the SRs from the recirculate mode to the data entry mode. A t the same time, the other output of the NOR latch (Pin 4, IC-13B) goes high. This, thru IC-15B, causes the DS to select the high-speed clock. T h e SRs are now clocked at 1280 H z with their inputs (Pin 15) all high. This loads a "1" into all 64 locations o f all SRs. Since the NOT-Q is used, the SRs are all cleared. After 64 counts, the FOR counter goes high (Pin 3, IC-19), and resets the CLEAR NOR latch. The box is now ready to accept new numbers. This device allows one t o practice whistling at 2600 Hz - the highest "E" on a piano. When properly fine-tuned, a chirp results at the end of whistle. Adjust oscillator frequency to 1500 Hz or less with C l bypassed. Adjust center frequency to 2600 Hz. Increasing C2 to 20 o f restricts bandwidth (BW) from 6% to 2%. B e l l BW is typically 4%. L D information can be practiced with by dialing any existing area code plus 555-1212, waiting for the LD sounds to come on, then whistling. 1400 M K 1 KEY MATRIX Continued From P. 4 The 2600 Perfector can also be used in conjunction with the pink noise countermeasure described earlier. A 3000+ H z oscillator is similarly built as the Perfector, but tuned to a 3000+ H z frequency. T h e output of the Perfector is connected to one end of a 500 ohm trimpot; the output o f the 3000+ H z oscillator is connected to the other end. T h e pot's center tap is connected to the phone's mouth piece (which is about 400 ohms). T h e pot's starting position is at the 3000+ H z position, and then gradually adjusted until the optimum 2600 Hz and 3000+ Hz mixture occurs. 41- irVOL. BLUE BOX• The Blue Box is an electronic device that simulates the tones generated during L D phone calls. B e l l still uses i n -band signaling in many places t o determine when trunk lines are free. W h e n one dials a L D phone number (whether rotary or Touch-Tone), the CO interprets the signals dialed to determine the destination. I t then searches the relevant trunk lines for one that is not busy. A trunk line that is not busy puts out a steady 2600 Hz tone. When the CO finds such a trunk, i t latches onto i t and terminates the 2600 Hz non-busy signal; i t then sends the called number or a special routing code to the destination TO. I f the CO can't find a trunk, it signals the caller with a 120 Hz busy signal. The tones it uses to send this information are the 1...jlti-Frequency (MF) tones. A n MF tone consists of two tones from a set of six mastones which are combined to produce any o f 12 distinct tones. asionally, one can hear these trunk tones, but they are usually filtered out. T h e s e tones are NOT the same as Touch-Tones. See the Table below for the specific trunk tones. Continued Next Pagel ULTIMATE RED BOX 5)0 1,041•611AtT • iota L1K 1+0001fsti—r ‘rsstly arts? t Lon= 1 7 1 10 CI 3.10 (It 111Jr otr " 4.0.49 2600 WHISTLE PERFECTOR (WHITE BOX) Tramilotor- liap 54, 510222, o r 81C3720 or equivalent C a p a o l t o r o - 15 vole or greater Tone Docodor- NEWT by Sipatlea, Fairchild, o r National . R e a l t o r s - 101, 1 / 2 watt dime rates while R2 controls the quarter rate. These rates can be adjusted with no effect on the numbers of pulses produced, which remain constant. This circuit does not produce t h e precise quarter pulse train as shown e a r l i e r. T o produce t h i s unique pulse t r a i n , another XR-2240 i s required t o produce the initial 70 msec delay and 70 msec pulse for the quarter. T h e n i t switches over t o the second XR-2240 to produce four 35 msec ON, 35 msec OFF pulses. This circuit uses- an XR-2240 programmable counter-timer. T h i s • Red Box i s different than t h e older versions, which produced a "time window" in which the user would adjust to allow the required' I. number of pulses to f i t in. T h e Ultimate Red Box version actually' counts to 1 (nickel), 2 (dime) or 5 (quarter) as required and will-not' permit truncated pulses t o occur, a l e incorporates the dual tones 1700 H z and 2200 H z . ( M o s t phOneT in the country will still respond to 2200 Hz). To fine-tune t h e two oscillators, disconnect one a t a time by r e moving one end o f its 15K collector resistor, and then tune the other oscillator (Q2) for its proper frequency (1700 Hz) with a frequency counter. D o the same with the other oscillator (Q2) to derive the 2200 Hz. O f course, It's not easy to determine the pitch of an oscillator that gates ON and OFF without using a storage scope, so tune by connecting the appropriate 15K resistor to +V instead for a steady tone. so i l k sAll ater. Ildocoadaa7 Posbbabotia 105 This circuit works well on +9 to +18 VDC. Tone frequencies are d e termined by t h e resistances to Pin 13. R I controls the nickel and Resistors - 1/4 watt, l a I Op-Amp - 741CV (National, Signetics, etc.) Capacitors are in mfd. Values above . 5 mfd are electrolytic, 15 volts or more. Observe proper polarity in these units. Diodes - Small-signal silicon, 1N914,1N4001, I Oroosal Oiegativa sal of 9 volt bailai7) or equivalent Pots- 50K, small 10 or 20 turn trimpots. Timer- XR-2240 made by Exar. Pushbuttons - Small, momentary, s . p. s. t. Good units made by Alco, Grayhill and C&K. N P N Tr a n s l a t o r Clair O. 8 Bottom Vi e w Imenem• l i m i n a l m e m e s i m i n i v i m m i i m o t e m i l e i i m o s o m o s e s e a s s i m e i m a c o m e s • m u m m i s i m m e m e n e m o u i s i m i n i voltage is nearly 48 VDC, the 10 Kohm resistor should start a t 12- 1 15 Kohms. I f the line voltage is low, 8-9 Kohms is used. BLACK BOX 8 • The basic Black Box is shown in (A). When the switch is opened, cur- To check out the Black Box, one lifts the receiver to his ear. A normal dial tone should b e heard f o r the "Normal" switch setting. l' rent and sound can only pass thru the resistor and capacitor. T h e Switching to "Free" should result in a 1-2 second dial tone followed 1111•purpose o f t h e resistor i s t o provide enough current so that the by the line clearing with the usual soft white noise. I f i t takes • phone mouthpiece c a n b e powered enough t o b e heard but not more than 2.5 seconds t o clear, i t means that the Box resistor is w enough t o tell Bell that the phone is in use. T h e purpose of the • •capacitor is to block DC while permitting the AC voice wave to be probably 1 - 2 Kohms too small because Bell's relays are behaving marginally. I f the phone doesn't clear at all, the resistor is probartransmitted. A l t h o u g h a 0.5 u f capacitor is usually adequate, i f ▪ one has a bass voice, 1.0 uf works better to allow less attenuation bly at least 2 Kohms too low. • of the lower frequencies. A non-polarized capacitor should be used, To static-check a manual ring-stopper, one picks up the receiver as • rated at least 150 volts. When the switch is closed, the phone acts n ,w c u -s ig fth e p .T ly a rm o h itc sclosed before and clears the line by switching to "Free." H e then hits the • and the phone is quickly picked up and hung up. Then the switch is ring-stopper PB switch. D i a l tone should result, and the line shook' • opened and the conversation can take place without having it inter- clear again. I f not, the circuit is wired wrong. rupted by rings. For a dynamic test, a phriend calls the phreaker from a LOCAL • I The circuit in (B) is from ABBIE HOFFMAN's STEAL THIS BOOK, payphone. W h e n the phone rings, he switches the Box t o "Free" '0 no longer available anywhere. E x c e p t for the use of the 100 u f and taps t h e manual ring-stopper PB ( i f the Box has a manual). t: capacitor and the 10 ohm resistor, (B) is identical to (A). T h e pur- The phone should stop rin&Ig. H e then picks up the phone and • pose o f such a large capacitor is to act as the "ring-stopper" when answers it and talks to his plWiend for a few minutes. H e then gets • one picks up the phone for the first time. This saves the step of the phriend t o hang up first. W h e n t h e phriend hangs up, t h e 1 picking up the phone fast and quickly hanging up. The 10 ohm resis- phreaker should hear the return of the phriend's coin and no new • tor i s used t o safely discharge t h e capacitor when the switch is dial tone. I f the phriend's coin is not returned and a new dial tone comes on, the Box didn't work. I f it didn't work, it could mean bad • switched back to "Free." (B) has three disadvantages over (A): • ( I ) A non-polarized 200 Volt, 100 uf capacitor is much larger wiring but it usually means that the ring-stopper surge is too long or •• than a 200 Volt, 0.5 uf capacitor. that Bell has installed some super-sensitive equipment on his line. 4 , JAM\ ( 2 ) A 100 uf capacitor is easier to detect by Bell than a 0.5 uf Alsd note that Black Boxes (as well as Blue Boxes) will not work spacitor. • ( 3 ) One could make the bad mistake of lifting up the phone in where ESS has been installed because ESS does not permit a direct connection between the origin and destination phone except during • ▪the "Free" position t o receive a n operator-placed L D call. ( B ) • • forces one to do a quick pick-up-and-drop to stop the ringing, and is the period that the phones are answered and billing is in progress. • more conducive to developing the habit of determining which calls In ESS, the ring you hear is one that is computer-generated by your local CO. .1:• to box. "1. -•_ • ▪(C) is identical to (A) except that two 52 Volt zeners, wired back- When ' y o 4 . s r a e t . . . t o ring, 105 VA C (20 Hz) is superimposed • t o -back, are also placed i n parallel. T h e phone is picked up after across t l 4 1 5 C Tip $nd Ring lines. I n the zener ring-stopper, •• the switch is opened ("Free"), and the ringing voltage avalanches when -the..cc....ibined voltages exceeds 56 volts, the zener conducts • one o f the zeners. T h e surge makes the line voltage sharply drop, more and More until enough current flows to signal the CO to disI which stops the avalanche and t h e ringing. T h e two zeners are connect t h e ringing (within a f e w milliseconds o f the first r i n g • much smaller than t h e 100 u f capacitor, t h e resultant surge i s pulse). I n some cases, the zener voltage may be too low so t h a t when i t does avalanche, i t will stop the ringing but it won't conduct • much sharper, and they are more difficult to detect. enough current to signal the CO. T h i s problem is corrected by us■ • ( D ) uses a PushButton (PB) ring-stopper and a battery to power the ing a higher voltage zener, perhaps at 70 volts. _ • •mouthpiece. T h e PB switch provides manual control over the surge i t • • • • • • 1 1 0 1 1 • 1 1 • 1 1 1 • • • • • • • • • • • 1 1 1 • 1 1 0 • 9 1 1 1 0 11 0 • 0 • • • • • • • r • required t o stop ringing. O n e starts with a sharp tap. I f that • doesn't stop the ringing, increasingly longer taps are applied. T h e • • purpose of the battery is to provide more power to the mouthpiece • •• to increase conversation volume. N o t e that the 6 Volt battery is in • To notify the destination equipment that it is about to receive rout ■ • series with a 240 ohm resistor. T h i s provides 25 ma of voice cur- • ing information, the originating end first sends a Key Pulse ( K F 14I rent. A 9 Volt battery (360 ohm resistor) or a 12 Volt battery (480 • tone. T h e digits are then sent. A t the end of sending the digits II ohm) can also be used. D o not use a DC power supply driven by an.• • the origination CO sends a STart (ST) tone. Thus, to call 914-3591517, the C O equipment sends, (KP)+9143591517+(ST) in MF tones. • A C voltage as severe hum can result. When the customer hangs up, the CO again sends a 2i.C. Hz tone v. li 1 : is a Black Box using a 56 Volt zener and a diode in series as the • signify a disconnect at the destination end. •• (E) ring-stopper. I n the "Normal" position, the ring-stopper and the RC' it are out of the circuit. When the switch is thrown in the " F r e e ! . NOTE: E a c h dual-tone lasts exactly one second with exactly o r ,>osition, the Tip and Ring will momentarily be shorted together t o i • second pause between each dual-tone. A n d both tones in each dua lb • stop the ringing. T h i s circuit reauires observing line polaritj. I n U tone must start and stop simultaneously. M F tones start three s • phones correctly hooked up, the i n g is red a p o s i t i v e . h e c k ! . conds after "offing" the line. I n modern systems, pulse shape trapezoidal - not square or sinusoidal. • anyway. l e II i s • • (F) is a variation of (E) to produce greater volume. A 1.0 Kohm pot. it To use a Blue Box, one usually starts with a call to a Black Boxer • is used to vary voice volume. The 10 Kohm current-passing resistor • phone service c a l l number, recorded message number, t o l l -ire. . : is not required. .15 number, o r distant directory assistance (NPA-555-1212, N P A • Area ode).. 8 0 0 numbers are preferred since Bell started supervis• : 1 • (G) is (E) but with an answering service connected. Please note t h a t . ing L D directory assistance calls, and Bell flags directory assis•• only answering devices equipped with A and A l terminals can be •_ tance calls over three minutes. long. "Supervising" simply means= • connected this way. Only the better machines have these terminals1 that, when the call is answered; the TO notifies the local office to • marked. I f not clearly marked, check out the schematic to deter- 4 begin billing. I f one "offs" a line that has "returned supervision t o t him," he will be timed out by his local CO, and he will lose the c i r • mine if and where they are at. N I • t 4 2 cuit within 15-30 seconds. a • (H) is another Black Box, this one with a built-in LED Snoop Lite. 1 . 1 Just when the call is answered, one pushes the 2600 button on his • (I) is a Black Box that is the same as (F) except a full-wave bridge • Blue Box. T h i s makes the destination CO equipment behave as 11 u • rectifier is used. T h e purpose of the bridge rectifier is to permit •• the call had been hung up, thus leaving the trunk to the destination hanging open. Injecting 2600 Hz for this purpose is also known as,i • the device to work regardless of Tip and Ring polarities. i s "offing." T h e phreaker then has about 1 0 seconds to enter in they •• • number he wants to dial (in MF tones: (KP)+Number+(ST)). T h e CO,i M • I (3) is a another working Black Box. •L i t t l e is known about this one. ' • equipment acts as i f this call was a normal one from another C O ' a a • (K) i s a table that describes t h e Ring-Tip voltages f o r various • and processes i t . S i n c e there are no USUAL billing records of.. these MF tones (except on toll fraud detection devices!), the user ist • phone conditions. • not billed for the call. When the user hangs up, the CO equipment; • I • NOTE: B e l l phone circuits normally operate from 48 VDC batteriesii simply records that he hung up on a free call. • and use a 105 VAC, 20 Hz ringing current. O n -hook voltage should.. • be 4 8 VDC. R i n g voltage should be the 105 VAC superimposed oni• COUNTERMEASURES •• the 48 VDC. O f f -hook Ivoltage should be 6 VDC.: Bell first discovered that Blue Boxes were being used in 1961, and • . • • Because there are substantial variations nationally in these voltagesn• implemented countermeasures i n 1964. T h e s e countermeasure • one experiments with the optimum Black Box configuration. Usual-111 have steadily increased i n sophistication and areas covered since • ly, the further one is from the CO, the less these voltages are. Byiri then. • measuring for the 48 VDC, one can estimate line resistance. I f the,. Continued Next Page, a m e m e m • a • m o m e n o m o m o m i p m e n e m • • • • • • • • • ■ • • • • • ••• •• • s e • ; • is B L A C K BOXES (F) 2 . 5 0 volt wooer 5 watts : Green Wi r e TELEPEIONE ANSWERING DEVICE D.11aSe 100 pie 1 am• N o r m a l 1 0 ohm DPDT 6.6-14 volt tatter, R.1 Edam net, audio taper with oo-off switch The standard 10 K ohm resistor is H a n s e l : 4 . The capadtor ;awes the = l b but blacks the DC voltage which results In an "on-book" condition. The 1 IC ohm lot gives you • level control for rasat voice. And speaktrg of Black Box modllicaticoa bereLa • circuit sent in bye reader from Brooklyn. N. Y. o n bow to connect a pbore annwerirg device to Ow Auto Black Box: DPDT R-10 KOMn resistor, 1 / 2 watt 0.1 MFD capacitor, 100 wvDC (H) o+ To rota 52 volt Zeners S,ISPST MOMENTARY R•101al S2 S P S T • c / 1 da/AT Czi/IFC0 l e e w w 0 c I O N - POLAR Do° 2 V e l T t o 4.44 1 . ED Consumertronics Co. 2011 CRESCENT DR. P. 0. DRIVE 537 ALAMOGORDO, NM 88310 Pas g v a a T t a v A T T z . E H E R Correct tone line polarity can sometimes be a hassle, especially I f your Black Box is a portable unit moved from room to rgom o r house to house. A n interesting solution to this probIelp fa the H I - P o l a r Auto Black Box : ZENER-56 volt 5 watt HEP Z 253? ,, FREE T o D ' F R E E . Phone BLUE BOX TONES Digit Freq.s (HZ) 1700+900 2 7 0 0 + 11 0 0 3 9 0 0 + 11 0 0 4 700+1300 5 900+1300 6 11 0 0 + 1 3 0 0 7 700+1500 8 900+1500 1100+1500 0 1300+1500 KP 1 1 0 0 + 1 7 0 0 ST 1 5 0 0 + 1 7 0 0 ? 700+1700 900+1700 ? 1300+1700 Disconnect 2600 ? = Unknown Uses Di_i a 1 5 • v e e r i AMP Z • C 4 v. g e v i a r r DIODE - 100 volt 01 amp ZCNER To Fong 0• FONE LINE "HORMAL.• R.10E OHM 1/2 watt NORMAL c „ i m f d e 100 „,de Terminals 3411 are connected together as are 5&5 but Ware fa Da connection between terminals 1&2. With the DPDT switch in the normal position the ringing voltage is across Bait phone ringer and ng.t across the "answering* diodes. On',y when the switch is put in the "free" position are the diodes placed across the line to.ntelnentarily 'answer* the phone for a few milUeeconds. Veannot think of a more appropriate time to build this improved automatic Black Bac VOLTS PHONE 9 COLOR BOXES Ma OHMS FREQ TIME DC - ON-HOOK 48 0 INFINITE O F F -HOOK 8 40 100-200 RINGING . . • .105 23 - BUSY SIG - - BLACK BOX RESISTOR 45 4.5 D I A L TO N E - - 20 - TOUCH-TONE TONES Digit F r e q . s (HZ) 1697+1209 2 697+1336 3 697+1477 4 770+1209 5 770+1336 6 770+1477 7 .852+1209 8 852+1336 9 852+1477 941+1336 941+1209 .# 9 4 1 + 1 4 7 2 7 The uses, if any, of all other possible frequency combinations are not known. - 480+ 620 60 IPM 10 Kohm - - - 950+ 440 - I M (1) LINE SCANNING: I n most large cities and populated states, most (if not virtually all) Blue Box calls are readily detected, as' the phone lines are now rapidly scanned by detection devices. T h e primary thing checked for is the presence of a pure 2600 Hz tone on a subscriber line (where i t has no business). A l s o , i f the M F tones don't t a k e o n t h e characteristics described above, m o r e sophisticated equipment will automatically flag t h e c a l l . I f a n equipment malfunction doesn't account f o r t h e out-of-spec. M F tones, Bell assumes that the call was boxed. O n a crossbar system, it drops a card. U n d e r ESS, a printer screeches quietly with the I = N M M I we NM full details and Bell security is immediately alerted. T h e basic a p proach of the scanner is to look for a 2600 Hz tone where one duos not belong. Bell then automatically records both numbers, time of day, du; ation o f call, and perhaps the phone conversation itself! I n some cases, Bell will then immediately call back and inform the phreaker that he has been caught, that he will be billed fully for the charge, and warned of the penalties for his crime. I n other cases (particulary payphones), Bell security and the police rush to the phreaker's location where he is sometimes apprehended i n the middle o f his boxed call! C o n t i n u e d On P. 11 i ' • /000: f 2-1.1ne Meese Hoz I f+ I I 1 ' , e q . BOXES' ! O T H E R 1 0 ' . B " . 4 11 r 1 10:1-14/. 6 RFE/J3 I I R e o r t l I T C I 1E 6RE8u. R E D 0 Ritmse * . — . 1 . 1 . - - s e e O D 03 © D I E BLUE 1 7 ---g u a r )WHI1 1—fR' 1 81 it I (AA (c) (B) I CHEESE BOX The Cheese Box is simply a conference line, or loop around. They are v e r y popular w i t h bookies f o r b e t -placing by phone. T h e i r clients call one number, the bookie calls another, and they are connected together a t a third remote location (the Cheese Box). T h e police won't find the bookie o r client a t either number. Cheese Boxes not only effectively eliminate call tracing but they are easy to build, and they still work! C a r e is taken so that phone calls don't exceed three minutes. 11-installed loops are limited because they often disconnect after certain time, the numbers must be called in a certain order, and they a r e o f t e n monitored and sometimes even charged. T h e Cheese Box can be extended to many lines, thereby creating conferencing, will permit either line to be called first, and it will stay on indefinitely. And the Cheese Box is FREE! Phone voltage is normally about 45 VDC. When the phone rings, an additional ring voltage of about 90 VAC (20 Hz) is received by the called party. I n (Al, the zener diodes conduct i f the voltage rises greater than 56 volts. A s discussed under Black Boxes, the zeners act as a ring-stopper. S o one can call and his call will be automatically "answered." H e then holds on (without being billed or timed) until someone else calls in to the second phone connected t o the Cheese Box. T h e second phone is then similarly answered, and the two phreakers are now connected together and can talk to each other. I f the calls are from payphones, upon their completions, the coins will be returned because Bell won't detect that a connection was made. The capacitors prevent the DC voltages on the lines from interfering with each other. Tw o are used since a DC connection to either side of the phone can affect each other. The zeners must be properly installed. I f not, no dial tone wilr result. (B) is a three-phone Cheese Box. ( C ) is a four-phone Cheese Box. • Phreakers normally like to include Cheese Box options with their Black Boxes. !though the Cheese Box is not a Call Forwarding device, it can be used in that manner. For example, a Cheese Box could be set up u s ing phones registered under fictitious names. T h e phreaker could call a second party, stating, "As soon as I hang up, call XXX-XXXX." The phreaker hangs u p and dials Y Y Y- Y Y Y Y, hooked t o X X X XXXX with a Cheese Box. T h e second party hangs up and calls XXX-XXXX. T h e r e might be several reasons for doing this. O n e reason would b e t o prevent t h e second party from tracing the phreaker's origin phone number, which would be impossible in the few seconds it would take him to instruct the'second party. Another reason might be that others will engage in the conversation at the Cheese Box location in a three-way conference. T h e disadvantage o f the Cheese Box in a Call Forwarding application over a Call Forwarding device is that the Cheese Box may require a prior instructional phone call. CLEAR. BOX, As explained earlier, the Clear Box is a box used to defeat the type of payphone used i n Canada and rural areas. I n this type of payphone the call is connected thru first, and you can hear the called party. H o w e v e r, the phone mic. is shorted out until you deposit the correct amount (you can make free calls to weather, 911, and some others). The Clear Box consists of a 4-transistor amplifier and a telephone suction cup induction pick-up. T h e induction pick-up is wired t o the OUTPUT of the amplifier, and a mic. to its input. T h e induction pick-up is attached to the rear of the phone. When the called party answers, the phreaker speaks thru the mic., arid his voice is inductively coupled t o the phone so that he can be heard. T h i s type o f payphone does not time out but will stay on indefinitely. The primary disadvantage with the Clear Box is that the volume is usually low and distorted. I. 0 El l a ypp, D Au cYcoivAtEcTer) rite-R1=.-WiRes_13±44g—cis-BOX NOT . . . . . . . . . . mr....inms mileimeam v e g a n The White Box gives you a better understanding of how Touch-Ton phones work, and you will also be able t o use tones in payphone that turn OFF their Touch-Tones after you dial your number. I n at: dition, there are phones at, airports, hotels and a t bank machine which have no dial on therrTand automatically dial a pre-programned number (usually a service number). T h e s e can be accessed 1; someone with a White Box t o enter a number or numbers befor the pre-programmed ones starts to dial, thus gaining control of V-. phone t o dial other numbers - even L D numbers. I n some phones after the pre-programmed number is dialed o r completed, o r a; error message ends, the phone reverts to a normal dial tone whic. makes i t accessible to boxing. Before White Boxes, phreakers use to tap out the new number, using the plunger, in the same mannt that a rotary dial works (ex: 9 taps = #9). Portable dialers costs about $30. Good ones that remember 99 nur bers, a r e password protected, and are smaller than a calculate • cost about $70. Often, they are available from LD services for Je• when you sign up for them. Yo u can build your own for much less. Tones made by Touch-Tone phones are not single tones, but di; tones. T h a t is, just as in the Blue Box, two tones are mixed togetz er (Touch-Tones use different tones than Blue Boxes). T h e y ar usually referred t o as Dual-Tone Multi-Frequency (DTMF) phone The normal Touch-Tone phone dials 12 dual-tones, but is capable dialing up-to 16 thru internal modification. The power required by a wired keypad is about 25 volts, but th; will operate well at as little as 15 volts, and work fine with twr: Volt batteries. T h e y are designed to operate with high-impedar phone-type speakers (earpieces) and phone lines, and they d o r work with standard 8 Ohm speakers. However, an 8 Ohm speaker required to obtain satisfactory voice volume. T o match the keyp, to an 8 Ohm speaker, one needs an audio transformer. T h e smai 1000-to-8 Ohm audio transformerfrom Radio Shack is recommen. ed (1273-1380). T h e y are about $2 each. B u y. a handful becaus they a r e very handy for all sorts of audio projects - particular!) phone circuits - including our TELECORDER device, see TELE PHONE RECORDER INTERFACE, $7. Y o u will also need two Volt alkaline batteries and battery clips, a small 8 Ohm speake and a small case to assemble these all into. SILVER BOX The Silver Box, a s stated earlier, i s a lineman's handset e • REMOBS (Remote Service Observing Systems). They allow Bell em ployees and phreakers to use the system to tap phones. B y using Silver Box and an ordinary Touch-Tone phone, one can dial direct!, into the RECEIVE ONLY portion of any customer's line (the mouth piece is disconnected). Silver Boxes work as follows: Dial the number o f a REMOBS unit. B e l l apparently puts them i the 555 information exchange (XXX-555-XXXX). A tone will the: be heard for about two seconds and then silence. I t is then necessary t o key in, with a Touch-Tone, a 2-5 digit security code, holding each digit down at least one second. I f the code is not entere within 5-6 seconds, the REMOBS will disconnect, and must be dia ed again. I f the code is properly entered then another tone will .! heard. A n y 7 -digit customer number can then b e entered ( r REMOBS can only handle certain exchanges which are prewired f. it, a n d usually one machine can't monitor a l l o f a m u l t i -C;. locality). The REMOBS w i l l then connect up t o t h e customer line. T h . phreaker will hear the low level idle tone. A s the monitored par._ dials, the phreaker will hear the number being dialed and the entle conversation! A t no time will the monitored party be aware the he has been tapped - there are no messages, clicks, strange sound:: etc.! W h e n the, phreaker is done listening to Customer A, he car key i n a single r e s e t digit" (usually t h e last digit i n the access code), which disconnects him from the monitored line and returns him to the tone so that he can dial Customer B. When the phreaker wants to quit, he keys in a single "disconnect digit," which discor nects him from the last line being monitored, and disconnects him from REMOBS so that REMOBS can b e reset and b e ready f o r another caller. L PHONECOLOR BOXES 10 Se e ' S O O G I V Z C I Ve r S C C O C I C O C e r. . . " 0 : 0 • Z o r o 0 . 3 0 0 0 r z c e z C e z a. 11 O n e method t h a t foils Blue Box scanner detection is t o a d d P H O N E C O L O R B o x E 5 some "pink" noise to the 2600 Hz tone. T h e relevant pink noise consists of frequencies above 3000 Hz; usually 3150-3500 Hz are used.' pink noise makes i t up to the local CO, where the Blue Box de-! most popular method is for the phriend t o call L D , using O• The tection is taking place, but is filtered out by the time it reaches the The Person-to-Person, and ask for a special name. T h e the destination end as LD lines are actually 300-3000 Hz bandpass call operator, is refused and hung-up, and the name alerts the phreaker to e x filters. an immediate L D direct call from his phriend. I n fact, this Since the CO fraud detection devices look for pure 2600 Hz on-, pect technique is widely used by many folks to signal a called party. F o r ly, the pink noise will prevent detection of the boxing effort. T h e ' example, when a travelling salesman arrives a t a destination, he TO also looks for pure 2600 Hz. T h e reason why both offices look, calls home Person-to-Person. I f he asks for one name, It means allfor a pure 2600 Hz tone for fraud detection and switching is that if is fine. Another means car trouble. Still another means illness. they allowed tone mixtures, music from a stereo could accidentally In fact, the person asked f o r can be a cipher for a sentenceterminate one's LD call not to mention trigger a raid on his home! , U long message, phone number, etc. I ' v e heard of one case that,, The Blue Box is modified.to add a 3000+ Hz frequency, which is whenever salesman "Bob" goes on a trip, he calls his wife "Sue" mixed in with the 2600 H z tone In any proportion, using a trimpot. back collect, Person-to-Person. N o t only is this call free, but from. The trick Is to create the optimum mixture of 2600 Hz and 3000+ the voice he call tell whether Sue is home. H e then asks o r a fictiHz so that only the CO Is affected. T h e mixture starts with a maxi- cious name that, when decoded, reveals the exact phone number mum of 3000+ H z component so that the line is not "of fed." T h e n that Sue needs to call him back direct on at a much cheaper rate. the relative proportion o f 2600 H z is increased until the familiar For example, t h e name, "Dr. David L . Tyler, 11," decodes t o the; "ker-chink" sound i s heard followed by the soft noise that comes area code, CO number and the last four digits of the phone number from an open L D line. A t that proportion, carefree Blue Boxing where Bob is a t . T h e "Dr." means that t h e C O number is the may be possible. fourth highest CO number in that area code ("Mr." is highest, "Mrs." 'w • is second, "Miss" is third). T h e "D" in "David, the "L" in "L." and (2) ACCIDENTAL: K e e p in t h a t Bell sometimes discovers the "T" in "Tyler" are -the first three digits of the phone number. boxed calls purely b y accident. B e l l personnel have the LEGAL The total length of the name (11) minus 5 is the last digit (6). The' right t o eavesdrop o n privat4 conversations, purportedly t o "test 1 "II" means the second area code in his list. Since Bob and Sue have the quality of the line." S o , the next time you tell your girlfriend identical lists of area codes and their CO numbers, Sue can deteron the phone how you would like to prove your love for her and you mine the area code and the CO number from the "N" and the "Dr.," hear a strange giggle, you will know a t least what the hand of one and the last four digits from the name itself! Bell employee is doing at that moment! Another method used t o assure a phriendly call is to have the calling party sing or whistle into the line while it Is ringing. T h e (3) LONG CALLS: I f the phreaker uses a payphone, and his call is called party then picks up the phone on "Normal" and hangs it up no longer than a f e w minutes, he usually gets away with It. A n d within 1 / 2 sec. - while listening for this signaling. R i n g i n g may there are even rumors of certain special test numbers that hook i n - stop. O r he may use a phone tap to listen in on the unanswered to trunks thus avoiding the need f o r 2600 H i and t h e risks o f line. Knowing that i t is a phriendly call, he then toggles to "Fr detection. and quickly lifts up the phone again. Probably the most effective way that phreakers defeat the pen Another method is to instalian infinity-bug-like device that xi.1111, alties associated with this serious crime is to operate in pairs from! automatically alert the called party o f the phriendly call (thru an' payphones. P h r e a k e r # 1 boxes his call, then immediately hands external LED or buzzer) to box the call. I n the March and April over his Blue Box to Phreaker 02, who promptly disappears into the 1984 issues o f R A D I O ELECTRONICS (two-parts series) a r e the crowd. I f Phreaker #1 is then caught, he simply states, "What's g o - plans to a device that, among important legal uses, can be applied ing on? S o m e guy I don't know Just now asked m e to hold this as such a device. T h e RE device can also permanently put an end' phone for him." Since no box will be found on Phreaker #1, i t will' to unwanted phone calls - regardless of the source! T h e way thel be impossible to prove that he boxed the call. Phreakers have been! RE device works is that when a permitted party calls you, he uses known to use this technique to test the limits of Bell security. a tone generator or whistle t o signal the RE device. Yo u r phone! then starts to ring as usual. However, if he does not produce this • (4) O U T-OF-BAND SIGNALING: B e s i d e s t h e i n -band detection, tone within 10 seconds, your phone never rings and he is automatischemes, Bell has also begun to gradually redesign the network us- cally hung up on. Y o u also have the option of switching this device ing out-of-band signalling. This is known as Common Channel Inter- ON or OFF as you please. office Signaling (CCIS). S i n c e this signaling method sends all of, the signaling Information over separate data lines, Blue Boxing is (2) The Black Box 'only works where crossbar switching is still b e impossible under it. C C I S is still not totally implemented, and, u n - ing used. I t does not work where ESS is used, because, under ESS, til i t is, some. Blue Boxing will take place. S t i l l not converted is there is no direct hookup between the caller and the called party Canada, WATS numbers and rural areas. except during billing. Although ESS is being Implemented nationally, i t will be beyond the year 2000 before completed. Y o u -can tell (5) ACCOUNTING METHODS: Another method that Bell uses t o if you have ESS by picking up your phone. I f dial tone is immediate, detect Blue Box fraud is that, by its very nature, i t means that the ESS is installed - Black (and Blue) Boxes are useless. I f dial tone phreaker must g e t t h e TO t o switch him from an "unsupervised" takes about 1/2 second to come on, they should still work. (free) line to a "supervised" line. U p o n offing an unsupervised line to dial a supervised one, a record will be generated o f the call. (3) The "Free" position tends t o terminate all local calls. Thus,' Therefore, a supervisory record generated by an unsupervised call local callers might have to phone again. can be easily flagged as Blue Box fraud! O n l y the dumbest phreak. • ers Blue Box from their homes. (4) Calls longer than 15 minutes are especially risky. Bell especiPl-; ly screens long-duration calls for legitimacy. . • • • • • -. `..01 The objective of the Black Box is to obtain free LD phone calls, but' (5) I f one has extension phones, all of them must have Black Boxes' it works differently than the Blue Box. When you call someone LD, connected t o them. A n d they all must be simultaneously switched you are billed from the moment they answer. T h e CO knows that into the "Free" mode for "Free" use.. I f even one is placed in the' you answered an incoming call by a certain amount of DC current "Normal" mode during a boxed call, b?liringvill automatically begin. that flows thru the phone. T h e objective o f the Black Box is to eliminate the o f f -hook current taLstop the billing but still permit (6) One advantage with the Black Box is that i t allows one to moni-. tor his phone lines while not alerting folks who may be using it u n enough current to allow talking. t & known to you - such as tappers, phone company personnel, etc. Black Boxes are the simplest to build. T h e simplest ones consist of COUNTERMEASURES a toggle switch, resistor and capacitor wired in parallel with each other in place o f a section o f the green or red line. T h e toggle As we stated, the implementation of ESS, line scanning for inapproswitch has two positions, "Normal" arid "Free." T h e "Normal" posi- priate low resistances and A C voltages, and analyzing calls based tion shunts the RC network. Normally, the switch is in the "Normal" upon their longevity a r e methods that Bell uses to detect Black position. W h e n a phriend calls, the phreaker, who has the Black. Box calls. I n the scanning method, OFF lines are scanned to detect Box, switches t o t h e "Free" position and picks u p t h e phone. any unexpected activity. I n fact, 'Blue and Black Box scanning are Switching to the "Free" position must be done either before or with- usually combined functions. • When a Black Box is suspected, the s e in 1/2 second of off-hook condition. I f later than 1/2 second, bill- curity procedures used are about the same as those used for Blue ing will have started and the call will be terminated automatically. Boxes with the addition that the detector may force the off-hook After finishing the phone call, both parties hang up, and the switch condition to automatically start billing. is toggled back to "Normal." Also, one result of Black Boxing can be the appearance at the CO of a phone continually ringing. Ringing that persists for more than a Some operational quirks and problems: few minutes is also investigated as a Black Box call. M o s t Black' (1) The call must N O T have been placed thru an operator. I f so, Boxes built today have ring-stoppers so checking for long rings is one is at risk of discovery. T h i s leads to a dilemma because? unless' easily defeated. one is absolutely assured ahead of time that a phriend is calling dir-1 ect, he wouldn't know prior to activating the Black Box whether or. Continued Next Page not the call was placed by an operator. 0 - B L A C K BOXI KNOWLEDGE + PRACTICE = SURVIVAL! I 2 MISCELLANEOUS CIRCUITS Consumertronics Described below are a number of miscellaneous phone circuits. F o r many m o r e , r e f e r t o TELEPHONE ACCESSORIES Y O U C A N BUILD, 1976, and M O R E TELEPHONE ACCESSORIES YOU C A N BUILD, 1980r both by Jules Gilder, Hayden. Yo u can also refer to many phone projects described i n RADIO ELECTRONICS and the now defunct POPULAR ELECTRONICS over the years. W e also strongly recommend o u r TELEPHONE RECORDER INTERFACE ($7). 2211 CRESCENT DR., P. O. DRAWER 537, C o . A L A , 40GORDO, NM 88310 I SOLD FOR EDUCATIONAL PURPOSES ONLY I PHONECOLORBOXEp 1 2 T h e TELESWITCH is not foolproof. A persistent callSECRET EXTENSIONS' COMMENTS: er can activate the circuit function. That, in itself might be useful. Bell tests for how many extensions you have on your line by measuring t h e capacitance o f t h e line thru each phone's ring circuitry. You may not care for Bell to invade your privacy this way. The solution is t o wire two back-to-back zeners or a transient suppressor in series with the ring circuits in all of your extensions. Avalanche voltage should be at least 52 volts. Choose devices with low capacitances - no greater than 50 pf. Yo u r extensions will then appear as open-circuits t o Bell, but w i l l still respond to the 90+ VAC ring voltage. If someone is using the phone to harass you, it's likely that he will ring persistently. T h e output relay could automatically activate a recorder to record all persistent callers. T h i s could be used in conunction with a hook-up to record while the phone is still ringing. his could reveal comments the harasser makes to himself or others between rings - comments he would believe to be unheard. NO A - n BASIC LINE RELAY i coverAcTf.m."7.0" OU. v Mord R4- I D R E D AP O O M = Name LM! VOLLS LAY t a i PREMa TESTING: Y o u can get ycibir phone to ring by picking the receiver up and dialing your number. Hang-up just as ringing begins. Yo u r phone should then start ringing. Y o u can also build a ring simulator by rectifying and filtering I 2 0 VAC, then switching it at 20 H z u s ing a high-voltage transistor. A 556 dual-timer IC can be easily wired so that its first section produces a square wave (2 seconds ON, 3 seconds OFF), and this square wave gates the 20 Hz oscillation of its second section. B y doing this, you can fine-tune the TELESWITCH to ignore all call attempts up-to a certain number of rings. CS tops off its charge during rings. T h e high output of Pin 3 of ICI turns Q3 ON which shorts C4 to ground thru R8 to remove almost all residual charge on C4. When the threshhold voltage is reached, BASIC LINE RELAY! ICI times out - Pin 3 drops to zero, which triggers IC2 at Pin 2 to The Basic Line Relay allows you t o remotely perform and control begin timing. A zero at Pin 3 of ICI also turns Q3 OFF, which a l functions. L e t ' s say that you're called out of town to do a demo for lows C4 t o charge up. W h e n IC2 is triggered ON, its Pin 3 goes your bra company, and there's nobody t o feed your goldfish! Yo u high, turning on Q4 and thus the Output Relay. T h e required funccall your home, and by doing so you activate this device. I t then tion is performed thru the contacts of the Output Relay. C 4 chargdispenses food so your fish don't starve. T h e relay activates only es up thru R7 and P1, and when i t reaches its threshhold voltage, during ring, so the number of relay closures or total duration of clos- Pin 3 of IC2 goes low, Q4 shuts OFF and so does the Output Relay. ures is depended upon the number of rings of the phone. If the phone is not ringing after function completion, C 2 and CS g.; slowly discharge thru R2. A f t e r about 1 0 seconds from the last 1 cycle, these charges will be low enough that the ringing from •,,', THE TELESWITCH ring phone call will again trigger ICI ON. I f the phone continues ' Granted, the Basic Line Relay may be overly simple. Y o u r fish atonew ring after function completion, the charge o f 5 prevents QO might get too much food i f others call and activate the relay. The from being pulsed ON again, thus Pin 2 of I C I can't be retriggered best way to prevent this is to add to this circuit a timer, a tone d e - ON until the ringing stops for about 10 seconds. T h i s prevents u n tector, or number-of-rings detector (counter) so that only you will wanted multiple activations due to a continuous ringing. know how to activate the line relay. EXTRANEOUS CALLS: O n the other hand, you don't want other The TELESWITCH uses the timer approach. T h e 7555 timer ICs calls to your home or business to trigger the function. Since almost shown are low-powered CMOS versions o f the common 555 timer. everyone hangs up by five or six ring cycles, the circuit must time Two 555 timers or (one 556 timer) can be used in its place. P r i o r beyond that amount. W h e n calls consisting of the usual few rings to ringing, output pins of both I C I and IC2 (Pin 3) are low. Q I , Q4 occur, ICI is triggered ON as before and its Pin 3 goes high. Unless and Output Relay are OFF. C l is charged up to +V, which can be enough rings occur to charge C3 to the threshhold point, I C I won't 9-18 VDC. R 3 is selected for the desired ring time before activa- time out. R e c a l l that IC2 is activated only after I C I times out. tion begins. P 1 is adjusted t o the required O N time (IC2) of the After the rinsing stops, C 3 and C5 will start discharging until C3 function desired. reaches nearly zero volts. Successive calls that come more than 3, FUNCTIONAL USE: T h e objective of this circuit is to not activate about five seconds apart will not have a cumulative timing effect. 41 IC2 until the phone rings for a certain period of time, perhaps after 10 o r 2 0 rin§ s. ) W h e n the phone starts t o ring, the first ringing With Pin 3 (IC1) now stuck high, more battery current will b e drawn. T h i s might be useful t o indicate that a t least one person pulse pulses t h r u C2, which shorts Cl to ground. The dumping. of C l triggers I I ON thru Pin 2. Output Pin-3 then goes high. When called you after your last circuit activation. However, you can u n Pin. 2. goes high, i t turns ON Q1, which turns OFF Q2, thus remov- -stick Pin 3 by installing another 7555 (to be called IC3) (or other ing the short across timing capacitor C3. C 3 then charges up thru timer) t o time concurrently with I C I t h a t will reset I C I thru its, repeated closures of the 48 VAC Relay thru R3 until the threshhold Pin 4. T h e collector of Q1 would be wired to Pin 2 of IC3 to trigger it. O n the other hand, a high at Pin 3 of ICI can be used to a c t i voltage is reached (1.1xR3xC3). vate an answering machine or tape recorder. of N A tom Nal o w um awe Rs THE TELESWITCH oift!f4ev .1142221. GREEN 0 0 1 . 1 S 3 As with other boxes; smart Black Boxers don't push their luck b making LD calls over 15 minutes. The shorter, the safer. 0 ilTPUT FuNcrioNAL ' ' , IN1 CF BO', OUT Fur + V — . R . 3 k .ol = 2N22?..z., 04 03 00 A C a l l -Forwarding or "CF" Box is one that permits one to make LD call thru a LOCAL phone that has a CF Box installed. T h e loc phone is called and i t answers automatically, without ringing. T : LD number is then dialed by an automatic dialer hooked up to t : CF Box and a second phone line. W h e n the L13 call is answer- the two phone lines are connected together. T h e old-style way doing this was to use two payphones to call two parties, then ta. or rubber-band the handsets together in the "69" position so t h the two parties could talk to each other while neither being able trace the other. CF Boxes have these advantages: (A) Call origin is almost impossible to trace. (B) The intermediate phone - not the call originator - is for the LID call. N o need for risky Blue or Black Boxes - the I_ call is placed like any legal LD call! Continued On P. 1 hold music M e o n hold basic snoop l l t o • Bed Red e Phone Line R1 Green ( A ) Line Green RED complete o l r n a l l L.(c) Ll T o Phone Green 2E Vt4 0 Phone LIDeed I-- P i • . 16R From Audio Output R 2 Transformsr TO PHONE I Al 111 Green I I I L2 4 1 1 1 1 1 1 1 4 72311-41 (G)1 OTHER CIRCUITS Phone Line Green Ll. L2 .9413 or 49 DAD Cl . 6 0 0 Btft1/15 volts Z - 1 0 Volt Zener Dlode.1 watt Rl - 1 0 0 ohm/1 watt Ra . 1 0 ohm/2 watt (A): T h e Hold Circuit allows you to put a call on hold by switching, SW1 t o t h e hold position. T h e Hold L i t e t h e n blinks w i t h ring, current. R3-10K ohm/1/2 watt . C2..1 Mfd./103 volts 13W1.DPDTSwitch SW2-MomentaryiNeT 8W343FCTIlwitch . . (B): M u s i c -On-Hold is adapting the Hold Circuit t o play music intoi the line. (D) . 'TO PHONE LINE 47 (0117 colILG) TO "NAME CALLER" DIALING CONTACTS CALL FORWARDING' 0 0. 0 Ni • Tina motnit 1---- To "NAME CALLER" - • S T A R T SWITCH, 1111b (F) MATERIALS, Cl. 1.0mfd @ 400.9TC* 'PARTS LISTI a u - . 4P.DT Relay. 1 1 5 vac c h i t . T1.! Audio i s o l a t i o n xmformer.'aprii.:600 ohms imped.• 100 t o 200 ohms DC Res. MI. T i m e r Motor. 1 1 5 VAC 60 CPS SW1a., F i r s t section o f timer w i t c h , n e t f o r aprox 3 min closed. 1 0 sec. open (dUN to c i r c u i t configuration, timer w i l l s e l f -index t o "open" p o s i t i o n o f t h i s switch).: SW1b. Second section o f t i m e r switch. s e t f o r minimum possible duration "on". I n d e x e d t o .close a f t e r SW1a has come out o f detent. T h i s i s t h e c r i t a i r r a c t o r i n choosing I I t y p e o f t i m e r. " o n " duration must be ICIAS. than time required f o r "name c a l l e r " t o f i n i s h d i a l i n g . ADDITIONAL ITEM REWIRED, BUT NOT SHOWN, 1. e a . b u t t e r y powered "Name Caller" d i a l i n g machine or equiv. NOTE' Over- r i d e disconnect switch (Tone Sens. Relay?) may be connected at point x -x. PHONECOLORBOXES 1 3 Consumertronics C o . S O L D FOR EDUCATIONAL'• 2011 CRESCENT DR., P. 0 . DRAWER 517, , PURPOSES ONLY; ALAMOGORDO, NM 88310 (C): T h e Basic Snoop L i t e consists of a bulb, capacitor and zenerl in parallel w i t h each other; a l l in series with the phone fine. T h e zener prevents disconnection should the bulb burn out. T h e capaci-i tor shorts out r i n g current. T h e bulb draws no current when the; phone is on-hook. W h e n the phone is lifted up, the DC current thruj the 100 ohms o f phone circuit also goes thru the bulb, and the bulb lights brightly. (D) COMBINED C I R C U I T: M u s i c -On-Hold i s combined w i t h thei Basic Snoop Lite. (E): A better Snoop L i t e . P I i s adjusted t o about 7.0 volts OnHook, which drops t o about 1.1 volts O ff -Hook. T h e output o f the 4011 is low during On-Hook and high during Off-Hook. Q1 conducts when its input is high, during O ff -Hook. 13-1 can be adjusted to just barely t u r n O F F t h e LED during On-Hook t o detect Black Boxes and SOME sophisticated bugs. F o r greater sensitivity, C I should be reduced t o 0.001 o f or less. L E D activation w i l l indicate a boxed o r bugged call, or fluctuating line voltage. N O T E : T h i s device will NOT detect all modern bugs. (F) CALL FORWARDING DEVICE: T h i s n i f t y device allows you to place a local or L D call thru an intermediate phone. C a l l forwarding devices have legal and illegal applications. T h e y are used, f o r example, by businessmen so that after-hour calls will be automatically transferred to their home. A n d they can be used by phreakers to place L D calls. W h e n one calls in, t h e r i n g voltage activates ELL', and FILI switches. R L I ' s "A" contacts switches its activation to the 110 VA C line. I t s "B" contacts activate a timing motor or electronic t i m e r. T h i s b o t h s t a r t s t h e N a m e C a l l e r D i a l i n g Machine (NCDM) or similar, and times S L I ' s activation. W h e n the NCDM i s activated, i t immediately dials t h e destination number. "C" and " D " are optional, and are only needed should you want to also t i m e the entire call. I f you want t h e c a l l t o n o t b e timed, then jumper these contacts. T 1 isolates the DC from Phone #1 to. Phone 112. A Cheese Box configuration w i l l also work. W h e n Tim-1 ing Motor M times out, the 110 VAC power t o RILL i s broken, and* all contacts return to their normal positions. This version of a Call Forwarding device is not totally satisfactory because i t requires t w o phone lines, and preprogramming o f the! auto-dialer. N e w e r circuits we have heard o f (but n o t seen) r e -I quire only one phone, and, when they are automatically answeredo the destination phone number can be sent using a Touch-Tone pad.! The caller then hangs on, the CF boxed phone dials the destination' phone, then connects the t w o in a time-multiplexing scheme when! that phone is answered. W e were unable to acquire any schematics.! If you have one, please send i t t o us w i t h functional description, immediately f o r f u t u r e editions. W e w a n t t o devote f a r more' space t o C F Boxes, s o please send us whatever information you have on them. (G) REMOTE RINGER: T h e Remote R i n g e r uses a Sonalert f o r the ringing. S i m i l a r l y t o Secret Extension, t h e Remote Ringer is practically undetectable by Bell. G r e a t for outdoors, garages, sheds, etc., accessible to phone lines. 2011CRESCENT DR., P. 0. DRIVE 537, C o n w m e r f r o n i c s _ C o . A L A M 0 0 0 R D O , NM 88310 ' COMMODORE 64 PHONECOLORBOXES 1 4 ATARI 1 POKE 82,0sPOKE 7 3 5 , 0 2 OPEN 4 1 1 , 4 , 0 , " K s ° 5 0 P R I N T " ATA R I B L U E BOX PROGRAM" 51 P R I N T " 0 - 9 = M F 0 - 9 " 5 2 P R I N T "K=KEYPULSE" 5 3 P R I N T " 8 = S TA R T " 3 4 P R I N T * S PA C E BAR = 2 6 0 0 H Z O N / O F F " 55 P R I N T " Y o u m u s t p r e s s t h e s p a c e b a r t w i c e " 36 P R I N T " f o r t h e p r o g r a m t o w o r k c o r r e c t l y . ' " 6 0 REM 140 D I M N $ ( 1 ) 144 GET * 1 , N 145 N a m . " 1 4 6 L E T Nii=CHRS(N)m? " ; 150 I F Name" " T H E N " 2 6 0 0 0 M " I N G O S U S 2 9 0 1 6 0 F O R LOOP=1 T O L E N I N , / 1 7 0 I F L E N ( N S ) = 0 THEN 8 0 T O 5 0 0 1 9 0 C H A R = A S C f i N t ( L O O P, L O O P ) ) - A S C ( " 0 " ) , T R A P 2 0 0 , RESTORE 3 6 0 + C H A R S 1 0 . 8 0 T 0 2 2 0 2 0 0 I F N S ( L O O P. L O O P ) = " K " T H E N RESTORE 4 6 0 . 6070 2 2 0 2 1 0 I F N S ( L O 0 P, L O O P ) = " 8 " T H E N RESTORE 4 7 0 s 60T0 2 2 0 2 1 5 C L R . B O TO 6 0 2 2 0 READ A , B , C , D 2 3 0 POKE 5 3 7 6 0 , A I P O K E 5 3 7 6 2 , 8 1 P O K E 5 3 7 6 4 , Cs POKE 5 3 7 6 6 , D . 2 4 0 POKE 5 3 7 6 7 , 1 6 8 : P O K E 5 3 7 6 3 , 1 6 8 2 5 0 FOR A = 1 T O 1 5 : N E X T A 2 6 0 POKE 5 3 7 6 7 , 1 6 0 s P O K E 5 3 7 6 3 , 1 6 0 2 7 0 N E X T LOOP 2 8 0 C L R . GOTO 6 0 2 9 0 SOUND 0 , 0 , 0 , O I P O K E 5 3 7 6 8 , 1 2 0 3 0 0 POKE 5 3 7 6 0 , 8 11 P O K E 5 3 7 6 2 , 1 s P O K E 3 3 7 6 4 , 0 1 POKE 5 3 7 6 6 , 0 3 1 0 POKE 5 3 7 6 7 , 1 6 8 1 POKE 5 3 7 6 3 , 1 6 8 3 2 0 G E T * 1 , N t I F N < > 3 2 THEN 3 2 0 3 3 0 POKE 5 3 7 6 7 , 1 6 0 : P O K E 5 3 7 6 3 , 1 6 0 340 Ns="" 3 5 0 RETURN 3 6 0 D ATA 1 6 5 , 2 , 8 0 , 2 3 7 0 D ATA 2 4 0 , 4 , 2 1 0 , 3 3 8 0 D ATA 2 4 0 , 4 , 4 0 , 3 3 9 0 D ATA 2 1 0 , 3 , 4 0 , 3 . 4 0 0 D ATA 2 4 0 , 4 , 1 6 5 , 2 4 1 0 D ATA 2 1 0 , 3 , 1 6 5 , 2 4 2 0 D ATA 4 0 , 3 , 1 6 5 , 2 4 3 0 D ATA 2 4 0 , 4 , 8 0 , 2 1 4 4 0 D ATA 2 1 0 , 3 , 8 0 , 2 4 5 0 D ATA 4 0 , 3 , 8 0 , 2 4 6 0 D ATA 4 0 , 3 , 8 , 2 4 7 0 D ATA 8 0 , 2 , 8 , 2 4 8 0 FOR A = 1 T O 7 0 0 : N E X T A C A L 4 9 0 NEXT LOOP 5 0 0 CLR:SOTO 6 0 -510 REM - - - B Y. D E V I O U S XEVIOUS - a m m o m m a m m e s e e m e m s a t o 111111 M I I = OM i m m i a m m o s m a s s a m e m e m e m i m a I = COMPUTER PHONE BOXES There are two basic types of phreaking using a computer. B y far, the largest is Computer Phreaking - that is, using one's computer to invade other private and commercial computers for mischief, mayhem and madness. S e e our COMPUTER PHREAKING ($15). Computers are also used for Phone Phreaking. The newest approaches to phone phreaking is using one's home computer a s a sophisticated and programmable box. S o m e phreakers are also buildin hand-held Brown Boxes using microcomputer chips. 3 8=54272 6 DIM B ( 7 ) , A ( 7 ) 10 F O R L S = S T O S + 2 4 : P O K E L S , O s N E X T 20 POKE 8 + 5 , 6 4 s P O K E 8 + 6 , 1 0 0 25 POKE 8 + 1 2 , 6 4 1 P O K E 6 + 1 3 , 1 0 0 3 0 POKE 8 + 2 4 , 1 5 4 0 FOR T = 1 T O 7 5 0 READ A t T ) , B ( T ) 60 NEXT T 7 0 P R I N T ' U S E 1 - 0 FOR D I G I T S 1 - 0 " 8 0 P R I N T " U S E K FOR K P s U S E 8 FOR S T " 8 8 P R I N T " U S E + F O R 1 1 : U S E - FOR 1 2 " 9 0 P R I N T " U S E L FOR K P 2 " 9 5 P R I N T " P R E M S P A C E BAR F O R 2 6 0 0 H Z " 100 P R I N T ' P R E T H E APPROPRIATE KEY A N D THE TONE W I L L B E E M I T T E D FROM T H E T V " 11 0 G E T ASs I F A f = " " T H E N 1 1 0 120 I F A e = " S " T H E N T=51U=6 125 I F A $ = " L " T H E N T=411.1=6 130 I F A t = " K " T H E N T = 3 , U=6 140 I F A t = " + " T H E N T=2i1.3=6 150 I F A l t = " - • T H E N T = 1 s U * 6 152 I F A i i = " 1 " T H E N T = l a l l = 2 154 I F A f = " 2 " T H E N T = l i l 1 = 3 156 I F A S T M M T H E N T = 2 : U = 3 158 I F Alli="4" T H E N T = 1 . U * 4 160 I F A S = " 5 " T H E N T = 2 : U = 4 162 I F A a = " 6 " T H E N T=31U=4 163 I F A $ = " 7 " T H E N T = 1 s U = 5 164 I F A l l = " 8 " T H E N T = 2 : 11 = 5 166 I F A l i = " 9 " T H E N T = 3 : U = 5 168 I F A l l = " 0 " T H E N T = 4 : U = 5 169 I F A S = " " T H E N T=7111=7 170 POKE 8 + 1 , A ( T ) I P O K E 8 , B e r ) 175 POKE 8 + 0 , A ( ( / ) : P O K E 8 + 7 , 8 ( U ) 180 POKE 8 + 4 , 1 7 e P O K E 8 + 1 1 , 1 7 190 G E T Z S I I F Z a m a " T H E N 1 9 0 2 0 0 POKE S + 4 , 1 6 s P O K E 6 + 1 1 , 1 6 2 1 0 GOTO 1 1 0 5 0 0 D ATA 4 4 , 0 , 5 7 , 0 , 7 0 , 0 , 8 3 , 0 , 9 6 , 0 , 1 0 8 , 0,166,0 5 1 0 REM T H E ABOVE D ATA STATEMENT MAY HAVE.TO B E ADJUSTED T O G E T . T H E EXACT TONE. TI 99/4A z FROM BASIC. 0: CALL S O U N D ( 1 0 0 , 1 3 0 0 , 0 , 1 5 0 0 , 0 ) 11 CALL S O U N D ( 1 0 0 , 7 0 0 , 0 , 9 0 0 , 0 ) 2 . CALL S O U N D ( 1 0 0 , 7 0 0 , 0 , 1 1 0 0 , 0 ) 3 : CALL S O U N D ( 1 0 0 , 9 0 0 , 0 , 1 1 0 0 , 0 ) 4 : CALL S O U N D ( 1 0 0 , 7 0 0 , 0 , 1 3 0 0 , 0 ) 5 : CALL S O U N D ( 1 0 0 , 9 0 0 , 0 , 1 3 0 0 , 0 ) 61 CALL S O U N D ( 1 0 0 , 1 1 0 0 , 0 , 1 3 0 0 , 0 ) 71 CALL S O U N D ( 1 0 0 , 7 0 0 , 0 , 1 5 0 0 , 0 ) B. CALL S O U N D ( 1 0 0 , 9 0 0 , 0 , 1 5 0 0 , 0 ) 91 CALL S O U N D ( 1 0 0 , 1 1 0 0 , 0 , 1 5 0 0 , 0 ) L S O U N D ( 1 0 0 , 11 0 0 , 0 , 1 7 0 0 , 0 ) KP. KP2, CALL S O U N D ( 1 0 0 , 1 3 0 0 , 0 , 1 7 0 0 , 0 ) i l l CALL S O U N D ( 1 0 0 , 7 0 0 , 0 , 1 7 0 0 , 0 ) 12: CALL S O U N D ( 1 0 0 , 9 0 0 , 0 , 1 7 0 0 , 0 ) S T: CALL S O U N D ( 1 0 0 , 1 5 0 0 , 0 , 1 7 0 0 , 0 ) N C. 0 z. 0 0 as 0 0 MN N I ME M I M I I = Min ME NM NM QS DS EN ME M I CM 631101111111111UMI- 1211 MR These Brown Boxes will consist o f a Blue Box, a Red Box and a White Box at the minimum, and will perhaps double as calculators. To date, we have not been able to find a home-built microprocessorbased box design. I f you know o f any, please send us a copy for future editions. As f a r a s computers go, t h e three most popular have a r e the TI 99/4A, the TIMEX-SINCLAIR computers, and the APPLE computers. T h e AMIGA computer looks like it has great potential for boxing. T h e T I and TIMEX computers are popular because they are small and compact. SOLD FOR EDUCATIONAL PURPOSES ONLY More important, the TI can also play up-to three pure tones, plus a fourth noise tone, simultaneously. Programming the TI for sound is not difficult. A l s o , i t s audio output are taken from the rear. Audio output is the DIN pin located at 9 o'clock; it's ground is right beneath it. Since it produces sharp square waves, one should round them o f f by inserting a 0.1-0.33 of capacitor across the audio output, or by feeding it into an active filter buffer stage. The APPLEs are popular because they can be easily hooked-up to the APPLE-CAT Modem. This modem is like any other modem, except that it has a few nice features. I t can dial numbers and has: an auto-answer, like most, but, besides dialing in pulses, it can dial numbers in. TOUCH-TONE, and it can receive TOUCH-TONE data!, This allows one to use his computer from any phone without a terminal, by simply using TOUCH-TONES instead of a normal carrier.! Also, it makes breaking into SPRINT a lot easier. The APPLE-CAT Modem is expensive, about $250. Included herein are three popular computer programs for Blue Boxins, which we've derived from 2600, donated by a Ford Prefect. Enjoy. PHONECOLORBOXES 1 5 tap is totally silent. With a Silver Box, one could silently tap anyone's line. UK BOX: A Blue Box with United Kingdom tones. CHEESE BOX: A home-built conference line, or loop-around. • BUG BOX: Any phone bug. ORANGE BOX: A device, when hooked-up to the phone, displays or records automatically the phone number of the originating phone. This legendary box is rumored to be copied from a similar device used in a special SONY answering machine. We have been unable to verify whether or not such a device actually exists in any offthe-shelf form - including in SONY equipment. I f you have any i n formation - schematics, etc. - please write us immediately! PHONE SCAMS l a Continued F r o m P. 121 RIPPING—OFF PAYPHONES. CF Boxes can be secreted anywhere (except payphones), but they' In a publication, it is difficult to explain precisely where and how re primarily secreted on multi-line commercial phone circuits (not much o f something to apply, particularly when variables exists. Inside the actual phones), and are dialed after hours. Commercial, Obviously, the more practiced the phreaker is, the more he can accomplish. N o t every experiment will lead to success, but some phone circuits have these advantages:. High phone charges are less likely t o :raise suspicions. may lead tosuccess far beyond expectations. Many large corporations are ripped-Off for .$ Thousands monthly. : 1 WI .Pinpointing suspects I s -;:difficult should the -CF Box be,' Phorie'-boxing is riot the only way that payphones are ripped-off! Some other methods: discovered. • . . - ..•04C) 'Normal phone use late at:snightlip.in most cases, is non-etds-i. ••• - , : , HUBBLE—BUBBLEi tent, l.so accidental 'discovery :.ls'-.rare..„-A C F Box . was recently sthin layer of wellchewed bubble gum (syrup or honey) IsPlaced shown on an episode of MIAMI VICE. :-:,.'''''=''. - • • ' orOund..ihe.•;edges Of a quarter. T h e quarter is then immediately 'Its should he noted that, wit1;:theIncreased security BellhLIrriPle- frozeri *o garden the gum. Shortly after removal from the fridge, mented .against other types of 'botting'.:.the CF Box is becortriqgthe just-As.:tilegum is becoming tacky again, the quarter -Is placed in a payphone,-:A phone number is dialed that one knows will not be box;'....of••••choice :1: .,. for ' .phreakers . . . 7,..* .-, i''..!!!';',..:',.!.‘:!.:: .'''1.7.:• t.... answered. -This permits the gum to become more sticky and to a d here to the innards of the phone. The phone is then hung up, and the coin is not returned. Subsequent users of the phone will be u n Other important boxes (I didn't name them Ma'am :'just reporting able to obtain coin returns because their coins will stack up behind the *_gummed-up quarter. Then, the next day, the phreaker returns to the phone. H e uses one or more of these methods to break-up Ppon,g,spx: •COmbines the, lanctiori of Red and Blue Boxes. • pia quarter. jam to receive a slot machine-like return: 417 He tlams his fist or some other hard object into the body of; Sidi BOX: Combines the function' of the -Blade and Blue -Boxes the,phorie to shock the quarters loose. • (S&M ii:Sacki-Masochism z Black & Blue). :1 -'..•'•••.:.'-'.. - • • • • , • , 42) He snakes piano wire into the phone and maneuvers. t to pop -• Off the_stetic quarter. BEIGE Bak: Any device thrisiCtiWitnitate 0 Model ss3ITeletype to a 3prays a solvent, such as WD-40, thru the coin slot to dis-. remote computer terminal designed !,9 receive -TeletYPC data.. - - I :Waite the the gure's adhesive. . .. _OTHER :BOXES WHITE* acdci , A '-Tokilrone lei.PidlIti keys), or any device that imitates a-TouCh4one key pad. - -•...;•• : • i ' ' .'' " ' . ' ' -' Different techniques have been used. I t has been reported that, dur= -ing ' c a l l s ; if the quarter jams the coin-sensing relay into the ON position, multiple cjuarter deposits will be indicated, thus relieving GREY BOX: Imitates a Touch-Tone pad With 16 keys or with 1633 one..ef 'using o risky 'Red Box to simulate coin deposits:: This is Hz included. ......- ",-; . ' ... • ........--." ....:-..-.... .... - ".....!.7 •: ;:.: - - - • done' by'aiugng the quarter (or slug) to snag onto the vane that activates -the relay, then, after substantial credit-has been given for BROWN Box: Combinei as inaeirblheiboxes as possible,-but with' the numbest-of "quarters," the jammed quarter is made to release as Purple and Grey at the minimum: Because of the Brown Box's rom-: above if it :doesn't fall off by itself. This method has been known plexity, it is usually either generated by a computer or a controller-'. to work just by heavily spitting onto quarters. Thus, one could tell type oircUlt. Most Brown .Soxes use crystal oscillators is guaran., the.Operatori-'5o that our conversation remains ;undisturbed, I'm gotee 4requency stability.i ; -.,,1'.',,:•• - :•:,•-•.,•:.:. . '..s.:, ..: .-. "...--....... ... -to :dePosit.this handful. of quarters into the phone. Please let .,"-- .. %,.4. : • .7-, • , - • : . . : ' -:',-..-e'i:.'.' :•.;"-. ',.:-..;'-'-.:7....i ,:". ' . .-... . . 1 . , ing me•iaiow when They' ve all been used up and you need more." YELLOW BOX: sik..airriple 2600'HZ:generatoi. Also called the "Capt.!.. .. Crundt Whistle" and the!"2600.Perfector:" -,-- • . • - --A:.variation Of this method is to place the gum into the coin slot. Then, with a penknife, the phreaker works the gum deep inside the MUTE. BOX: Any destination device that makes conversation possi-• phone and out of •sight. Subsequent coin deposits will then pick up Me while. making Tell think that tile called party never answered., the gum, and do as before. The Bleat-Sox Is the best 'known -;Mute Sox, but there are alto' Another variation is to use syrup honey. The syrup or honey container is heated in a pot of boiling water to increase its flow. I t is GREEN BOX: Used in conjUnction with the Red B034 the called par- then sucked-up into a syringe heated in the same water. The syty Can :useAhe Green Box Ito:return initial coins. to the party caning' ringe is insulated. -The syrup or honey is then injected into a phone froriNiVisine booth:- Not aideloi.any calls over three minutes, nori vein Vet. noks it-cools down and evaporates, i t becomes sticky as hell.. injecting water into the coin slot will dissolve the syrup or LD calls made rthru iris Ess." honey and release the stuck coins. CLEAR BOX: :Used primarily In Canada'and thruout rural America,'. . • , " . • • the w o r k s ,on-"pOst-say" type payphones. I n these pay- Still another variation Is using wads of paper. A half-inch or larger; Phone-g1.9ne .pays after the, connection it made. Although he can square of stiff paper or index card is folded in half, then with a key near the., p a r t y , he can't speak to' hem until he deposits his or small screw driver, jammed into the phone (bent end first). I t money:_,,•' :This problem is Icleared up" by' inductively coupling intol- may help -to dampen (but not soak) the paper first, or to coat it; the payjohorte's circuity: with syrup, honey, wax or gum. Then, coins deposited are jammed by the paper. A f t e r a while, the phreaker returns and unjams the SILVER-80X1..* 'Better known as the Remote Observation System' phone as described above. I f the paper is too large, not even the (REMOBS) or. a Lineman's Handset. Sometimes confused with the, phreaker will be able to unjam it. Beige Box.'',The Silver -Box permits "authorized" telephone employ-1 • ees to dial into private phone lines from anywhere, and then, using, WIRE CROSSING an ordinary Touch-Tone phone, tap into a private phone line's: Another popular method is to cross the green and yellow payphone receive-only circuitry. Since the mouthpiece is not hooked up, the ines. This is done by using a sharp screwdriver or a carbide glass '' , -"am",,efairmor-a7. SOLD FOR EDUCATIONAL PURPOSES ONLY PHONECOLORBOXES 1 6 drill b i t t o ream a hole i n t o t h e plastic light cover used i n payphones. A darning needle is then inserted t o extract the green and ye o w lines. T h e y are switched w i t h each other. W h e n one l i f t s up The phone and deposits his coin(s), a busy signal is returned. H e then hangs up and expects his refund. T h e refund does not result, but ins;ead, piles up inside the phone. When the phreaker returns, he re-4.-osses the green and yellow lines, and all coins are then r e tur(ted lat once. Sometimes i t takes putting i n a dime t o trigger the, relay t o make the return. Phreakers have been known to rip-off phOnes -at $75+ per click. Bell is on the look-out for this scam Consequently, most phreakers take care to only apply i t to popular phones on a busy night (ex: Frid a , Saturday o r holiday), only f o r a day o r so, and never on the same phone twice in a month. BAD C A L L CREDITS, When you make a payphone call and you get the wrong number o r the phone phouls up, you are entitled t o either money back from Bell o r credit. P h r e a k e r s often t e l l operators that a payphone at such-and-such location and so-and-so number cheated them out of "X" value o f coins, and t o apply t h e credit f o r t h e current call. Although t h i s scam doesn't always w o r k , i t works enough t h a t phreakers still use i t . M o s t operators today will require your name, address; and home phone number to send you a refund. Consequently, this .cam is not as popular as before. THIRD PA RT Y BILLING You can bill a payphone call t o your home phone. Phreakers often take advantage o f this by claiming that they are low in cash (just robbed,( etc.), and c a n ' t make a call unless billed t o their home. TheYttien provide someone elses phone number. B e l l operators now ask f o r personal information to verify that you are the person you claim tO be - like what is your Mother's maiden name. COLLECT CALLS TO PAYPHONES MULTIPLE CLICKS L In partS o f the country t h a t have NOT gone ESS, this method a p pears to work: Calling/collect t o a payphone i s an old scam t h a t doesn't usually work today because payphones are identifiable b y their numbers, and operators seldomly accept collect calls to payphones. The phreaker dials a t o l l -free L D phone number direct. A s soon as he fleaes a click, he pushes down the hang-up button several times, try quickly, for several seconds. A local operator should come o n ...) the line as this is one method of signaling for operator attention. The, phreaker states that he was calling a toll-free number, and that something must have gone wrong because the next thing he knew, he Was talking to the operator. A t that point, the operator should ask't.he phreaker for both his phone number and the destination number.,'The phreaker gives the operator a number-other than his, but wittj, the same prefix (not a payphone number) as the origination nurriber. U s u a l l y a known non-operatirtg number o r one owned by _ hil-Iltrc'orittfrenetny i s provided..` Tilt "Operator ttiefi dials the t o l l free number from her station. T h e phreaker then uses his Blue Box " i 0 ' t h e trunk, and proceed w i t h his normal Blue Box c a l l . 0 Bell discover this Blue Box effort, the records will show t h e ' pholl tjrigination number. The' mdst costly and popular phone rip-off is the phone credit card scarh. i B y hook or by crook, phone credit card numbers are found, and, within a short period, they a r e spread t o many people "with connections." T h e victim may get an enormous phone bill, in some cases, exceeding $100,000! W e g o i n t o much greater d e t a i l in, CREDIT CARD SCAMS ($7). PHONE CREDIT CARDS ;.,.• I M O U T H P I E C E STATIC The: phikaker uses a sharpened screwdriver or other sharpened tool to Lsorel a small,hole into the mouthpiece of the payphone (about a quartedinch from the edge). H e then inserts one end of a 6!' piece of w i r e into t h i s hole, and touches the other end, t o a grounded metal gbject (ex: phone body) creating static noises. T h e static noises s"muiate coin deposits and result in free calls. Although this methodiis very crude, I've heard that i t still works! i,.•I DISK SERVICE MANUAL 11•15RINTER & PLOTTER* COMPUTER PHREAKING inters a n • p otters a r e c o s t y, w t • • t e r e t i • t p According t o t h e FBI, less than 5% o f all DISCOVERED comtween c o s t , q u a l i t y a n d c a p a b i l i t y ! . t R i t PLOTTER puter c r i m e s r e s u l t i n c o n v i c t i o n ! C o m p u t e r c r i m e , o r Disk d r i v e s M T b e p e r i o d i c a l l y c l e a n t d a n d l u b r i c a t e d , Phreaking" costs $ B i l l i o n s p e r y e a r, a n d i s c l e a r l y o n e o f M A N U A L describes: And r e p a i r e d a s needed. M a l f u n c t i o n s c a n b e devastating i n (I) T h e p h y s i c a l s p e c i f i c a t i o n s , f e a t u r e s , a n d c o n t r o l the m o s t dangerous - y e t most p r o f i t a b l e a n d least risky - of lost programs, data and t e x t ; loss of business; upset customers; codes o f popular p r i n t e r s and p l o t t e r s . all crimes! C O M P U T E R PHREAKING describes in detail: down t i m e . Y O U c a n m a i n t a i n , t r o u b l e s h o o t , a n d r e p a i r drives W I T H O U T EXPENSIVE O R D E L I C AT E E Q U I P M E N T ( 2 ) Printer a n d p l o t t e r i n t e r f a c i n g , problem areas and h inrface.Mostcan( l ) D o z e n s o f computer c r i m e methods. Schemes include: d a .S m re tc w o Input Tr a n s a c t i o n Manipulation, F i l e A l t e r a t i o n S u b s t i t u Ork D I A G N O S T I C S O F T WA R E - o f t e n i n s i t u a n d i n l e s s be memory-upgraded t o save Y O U much t i m e and expense. tion, U n a u t h o r i z e d S o f t w a r e M o d i f i c a t i o n , C o d e B u s t i n g , tittle t h a n i t t a k e s .you t o r e m o v e , p a c k , s h i p , r e c e i v e , u n (3) M a n y c o s t -saving tips and recorkirriere..ations in the p i , Wiretapping, E l e c t r o n i c Trespass, e t c . M a n y a c t u a l e x a m 'Pac5r., r e -install, r e -configure, a n d r e t e s t drives sent t o d r i v e chase and operation of p r i n t e r s and plotters, ples - d e t a i l e d case history based upon actual c o u r t records ,repairshops11 S h i p p i n g drives i s r i s k y ! I f you w a n t t h e job (4) C i r c u i t d i a g r a m s o f X - S W I T C H E R S . I n d e p e n d e n t l y of a m a j o r group! W h y / h o w Government, business and finandone r i g h t , o n t i m e , and a t m i n i m a l expense - D O I T Y O U R switch o n e f t w o p r i n t e r s o r p l o t t e r s . t o o n e / t a r o computers cial institutions are easily v i c t i m i z e d by savvy Phreaks! -SELF! O V E R 1 0 0 L A B E L E D P H O T O S A N D I L L U S T R . A without disconnecting e i t h e r. S c h e r r i a t i c s p f Centronics P a r (2) Numerous c o u n t e r m e a s u r e , p r o t e c t i o n a n d s e c u r i t y -.TIONS O F S TA N D A R D -BUS A N D MICROFLOPPY allel, RS-232C and 2 0 ma C u r r e n t Loop. t schemes - p a s s w o r d s t o p u b l i c k e y e n c r y p t i o n m e t h o d s . DRIVES, A N D S P E C I A L D R I V E S ( A P P L E , C O M M O D O R E , (5) A d d i t i o n a l s e c t i o n s d e v o t e d t o P R I N T E R T Y P E S , State-of-the-art techniques. F o i l even the sharpest Phreaks! SONY)I!: PLOTTER T Y P E S , E X PA N D I N G M E M O R Y, I N T E R FA C I N G , (3) D e f i n i t i o n s o f popular c o m p u t e r c r i m e t e r m s , i n c l u d c h a p t e r I : G E N E R A L C h a p t e r I I : O P E R AT I O N A D ELECTRONIC T Y P E W R I T E R S , R I B B O N R E -INKING ing P I R A C Y, T R O J A N HORSE, L O G I C BOMB, T R A P D O O R , : w e e a r T I P S . C h a p t e r I I I : E R R O R MESSAGES ( a n d w h a t SECRETS, P A P E R , P A T C H I N G ' S O F T W A R E , S P E E D GODFATHER, M U T A N T , Z O M B I E , B O D Y S N A T C H E R , thLi-y m e a n ) . C h a p t e r I V : DIAGNOSTICS T R O U B L E RATINGS, BUYING S T R AT E G Y, and RS-23:2C PROTOCOLS. SILENT A L A R M , CHEF SF BOX, C A N D Y M A N , CODE 10, e t c SHOOTING ( h o w - t o , step-by-step). C h a p t e r V : M A I N T E N Learn how t o become a computer crime fighter! C o m p r e (6) B U F F E R S , SPOOLERS, M E M O R Y UPGRADES, E L E C rehapter V I : SPEED A D J U S T M E N T. C h a p t e r V I I : hensive, illustrated, frank. O N L Y I S . TROGRAP1i1C, T R A C T O R - F E E D , D I R A N D P A N E L .R-TE.HEAD A L I G N M E N T (includes hysteresis a n d e c c e n t r i SWITCHES, D O T- M AT R I X , D A I S Y W H E E L J E T , LASER, cs ) . C h a p t e r V I I I : E L E C T R O N I C S & R E PA I R S ( i n c l u d e s F L AT- B E D , R O L L E R -BED, D R U M , ; WORDPROCESSING, c o r r e c t power/ground system w i r i n g ) . C h a p t e r I X : M I S C E L DATAPROCE.MING, C A D / C A M , T I M E - O U T P R O B L E M , LANEOUS R E PA I R S (TOO S e n s o r, TO O E n d S t o p , S e c t o r omputer c r i m e i s r a m p a n t a • increasing. A n n u a l p l a I n t y T V. Ranges 1 4 1▪0011 moIre.s. M o . C WWI and COV~I..111aStlf ComPnweir clascrane0 N i l o N g * Vo w E c k u s e s C " . • a " F,41a in 'mosey Schwas K w and T a d . ' A N A B S O L U T E M U S T FOR E V E RY O N E C O N C E R N E D ABOUT C O M P U T E R S E C U R I T Y 5 2 0 DOZynS 0 1 l o r p l • r O g I a t i l e . t • c w • C o m p a r e , S e c . r. T / n W i n o a s a n d lips R u e 01/. M`1,110.0001 P.0110101.1. BAS. C O A L S O w c • C o d o P u s $ 1 , 0 0 0 C I P H E R C O N T E S T Inca . k . T. 7 b • R C/14. C.uNerreal. Manual • 51S W M . ! • Dna • • 525 CRYPTANALYSIS TECHNIQUES 5 P u n y rui M e n u • Carron Cryoto P r o p was im OAS. C O M S a u t e s G o o k io M o N n k O W N ' -Socuee" h . " 0 " , E u m p l a f Riscommemored . n t e n S r e s a g a . . . . 1 G O M P U T T M A s e c u o m r y a B. N a B. P 4 6 3 1 M a n u a l • 5 1 5 M a n u a l • D i s k ' - $25. AUTOMATIC TELLER MACHINES A I M C r, m e s 4.15.1.4s. Siwarmly. Komerataliners I D O marnakla clinic:row • horn R e g I 10 G a i t s Caws INslyymy. L m y cey.nleff 1 , 0 1 1 M 0 S O N Y * / C 1 0 0 ° . 1 0 0 0 1 0 1 Y v y r e y A T M , ymyYMIWYntouS 10 ' O W yrtM/fh 5 2 0 THE -GOLDFINGER- A T M A D D E N D U M : N e w Dyn-O-Bkle TH1. R n o k , . F . p a e 5.20 B a n M a r K A A $ 3 0 • a e o r r - s W a n c l a 0 0 ( 0 . SALVER. P L AT I N U M . C O R R E A , ALUTINNUAL_Rwerca• a i l Menaniagnenc . p , • - T r W M * O t i s = o r m o w n S i m p l e . • t art Vmey THE ASSEMBLY LANGUAGE DEVELOPMENT SYSTEM THE "SILKWOOD" 5,311 y . m p l e e f f e c l e v e Rwatanan DYYMIO• 1.01101, .000Q1C1•10.Y.,10Y1400LaseHns.o.knk..P '41101 P f o l o C I r n,YoN11,1 KW-HR METERS A S M . C O M : P o u r e r RY D 1 0 9 11 0 0 1 0 1 C . . " ' S ' • 0 . 1 0 1 Y 0 0 1 , Language Sourae Code LAO 4 P.unni•LaleavOteGYOGASSIT Out m i n 14Pesr.../11.110Oirf for AL O n k r. ^ ' • ^ t ^ 0 E X E S O A T A . C O M : C o m m LrE C O s . FYN I . M . 6010 BASIC D ATA matermanla I P • a m 0 e 6 ▪ n , N y l o y l yndurbM1 ( 0 1 2 5 0 1 n o i r e q u e e i r Mans nenn,H • o . K I P C e n w r q y nyYyri moms, 'AMA StandAid, D e m a n d M e h r a O.y y kletyyf 0 V g y p 1 , . . e Mymyy o w • • • c r o p 343« • O T U T O R I A L : O n n o . b 0 0 1 1 0 0 0 0 0 1001. P . R . &I. %Lonna' ...to BASIC end CIMPOPed.. BASIC 01001....•• A I S O 4.1.CoSs.11 C . F O R T R A N . a n d PA S C A L . l o v e . , 54..e.0 0 0 . 2 IDO .4. IC M Y, POOR MAN'S SUPER LASER 5141y01ft W M . and vane. f e d Ines D I M . • 1 2 5 -1,U11 R 0 0 ..AMY f a n s l l Y y 0 . , Y 11 s 4 S . 0 0 SyS4y00. a v a i . p o r, t a r p m n g p r e c . s e n e s f . . 1 a i a r m a . . n , M..51110q1Apny s t g n 4 1 , Y 9 a n d C o m m a . y 1 , , 0 . 9 1 scoynut 0101041.11. e a t W‘Cludr1 o f I f , *I'S fal 1001003 Ins N A M 1 0 0 1 a n d a s s . c . vied 5; ,t/o. s o 4 ' • s b 0 0 1 n a . . 1 . 8 1 • 6 0 comoa1.01e P r o g r a m a W O R O P 11 0 CE:58014, TYPESETTEROATA PROCESION SPREAD. S N E E T. . . . 1 BASIC P R O G R A M P R O C I I I B O R I R u a ICO•rt . . . h a p D O C ...no Movom Nyy P i a Dolt cd “ 0 . 0 . 0 1 * O N A I N C L U D I S H I A m k V A M O Y A TED SOURCE O t a . • A sups/ goals Oarosare 525 TECHNICAL RESEARCH SERVICES swo cornea/net owsKin * r a t e s 4.Y.10ms• ACC imam, by M I 6 s u m c l Lhodal . . 0 rs0drygmo0. s o Y . A . • 0 1 0 . 4 0 1,1I Ay A l a n 1 . 2 5 non. rytyrylatir f r y , /. wy1•01011,00•AsyS1 , o . . S i s .1Y1 •- 0 4 D INTEGRATED SOFTWARE • K o o s . a t w o l L 1"3" kiv...1 r a C G A k G A v G A ! Z S " . 3 $' • m a H o n ,To / O W 3 1 . . • 1 1 A . 1 1 / / CONSUMERTRONICS 2 0 11 C R E S C E N T DR. P . O . D R A W E R 537 A L A M O G O R D O . N M 11 3 1 0 iso• • • • •43.0. • M O R E • • 1 + e P • H e • O • • N .. PHONE ; BOX 0 1 RCUITS27 • v (2)) • E 0 • • • LINES • • • • + 6 - 1 • 0 4///-• • 2 • 4 0 • • • • • • • V • 0 • • • • • • • • +6-12V • • • • • • .0 • 470 L E D • to 0 . 2 2 2N3390 • • • • • • • • 1N4002 • • . • • • tomb\ • • 10 7 • • .4 Reader !contributions of • additional phone ;color boxes: 1N4002 100K . . . e 4 031 • • sit # r ANOTHER BLACK BOX: This one Is supposed to work best to Great • 1.0. B r i t a i n . Usually good for at least 3 minutes of phree phone use. The • •2• SPST is opened after the rings start but before the call Is answered. I f • the call Is from an operator, payphone, or you wish to make an o u t - • 620•1 • going call, close the switch. • • 9V SPST • • %. • I . . . D v PHONE • L I N E S 3 c . . 39. • • -•••••••—. • • • 311. • ) • • •71.1 • • • C 3 • 7 • f 1 • . C 2 3 5 1 5 1 • • i • a • l . mie - # • . . . XTAL g . - V • 0 I f C S , im",, f f ' A ,,fir : 1 7 3 t6111 1 1 . • /tam VG. ...—.- A4SY 7 . COMPUTERIZED GREEN & BROWN BOX: This nifty circuit lends i t self to oP and oC control Of the desired tones.. ri 4 * . . . r. • f', AlG O fillemVivt ; . , 8 •• - . - - V 1 0 )r 1 0 1 I F 77...- . . . i..21• 6 . - 0 = 7 4 4 , i a . i f t o 4,5c i P I N 2 + • 0 14007CA••4 c . 3 , 4 - - - M . - - - - , • • !Um # • 4 I 4 5 % t . I • • e r V . 8 0,/i. ........ a 4 ' 2 l i 7 Pin #s shown don't refleci p;n loc4+ions. II ,, 8 Pr . 4 • ilk "44 0. . • • • • • • # # s to• f A 1 0 11 . 1 • • • • • • • • 6.r-si•• I p 98•—••••1 F - - - Zcoo 0 0 1 0 1 1 1 1 , . 4 ;or 1 4,6 o ia t3 - pter• t o , . 1 . 3 2 0 4 0 0 1 0 0 11 0 his-4 700 1 0 1 / 0 0 0 1 . Dan*-4.404 . R e C t . 4 e y e l o o n s - / o f / 000l . F a t .7.` 2 0 4 ; 4 # 2 1 / = 6 0 4 / 0 . .0 ,Flo♦ 3 I D . 01010010 /7o0 0 1 0 0 1 0 0 0 a • CV•2•0) f • e r ) t 900 1 4 1 0 0 / 0 1 0 Iron ° M o o ° , 130o 0 1 0 1 1 1 1 1 4o toile I roe P1+++0 ibco4t • " . C. . — V "q i f • 4p 0 Z zg •• • 1 4 1 7 3 # # 4 4 ( 0 • • • " c ' 4,,,,Pa, vow< o f ,,.. N 4 6se 10 !Aqua of code • • • • ANOTHER RED BOX: I C I generates the proper burst while IC2 generates the required rate and duration t o n e for each burst. I Sod• r 4009 Z.47 1 N 4 0 0 2 • • PHONE STATUE; INDICATOR: This circuit monitors phone status with ♦ an LED. The LED is OFF for on-hook, flashing for ringing, and ON f o r ♦4i dialing and off-hook. • 1St # # +6-12V 4 1°M MCT-2 (MONSANTO) 4009 • • • • • • 100K • 33K • • • • • • • • • • • • a l • • • • • • • • • • • . • • • - • • • • • • • • • • • • • . 0 . v. 0 ,...,— o • • • • * o w , • • 6 a • • • , • • • . • 1 'Jo • Z U 8---. • • . • 430 - • 411. 4113, MISCELLANEOUS CIRCUITS FROM EARPIECE These p h o n e c i r c u i t s p e r f o r m a v a r i e t y o f o t h e r c r u c i a l f u n c t i o n s : 470K 4 •5V AUDIO OU PCg oN RE ENABLE .58 MHZI1101 X TA L ENVELOPE TEST PIN OUT1 BOX ADDENDUM OUT2 COUN OUT3 CLEAR 4.--1,11JSY" PHONE CIRCUIT: T h e r e are c e r t a i n t i m e s t h a t you don't w a n t .o or can't answer the phone, while, at the same t i m e , you don't w a n t t o be b o t h e r e d b y incessant r i n g i n g o r give t h e impression t h a t y o u a r e out. Y o u could put t h e phone o f f -hook, but t h e n you get those i r r i t a t ing buzzing sounds and "please hang up" messages, and anyone c a l l i n g you m a y be t o l d t h a t y o u r phone i s o u t - o f - o r d e r. T h i s simple c i r c u i t makes y o u r phone a c t l i k e i t ' s busy. Y o u h i t t h e "Busy" PB w h e n y o u don't w a n t t o be bothered, and the Reset PB when you are again a v a i l a ble. S i m p l e ! I t ' s also very useful to mislead burglars casing your place, to discourage harassing and o t h e r unpleasant phone cans, t o r e s e r v e the phone f o r you so t h a t when you need i t someone else won't be using it, a n d t o assure a n u n d i s t u r b e d r e s t . ceCNIZINIZIMG RCA PHONE JA 0 . 3V 1 0 . 0 0 1 8 60/600 OHM TRANS. 120 0.005 ECG9914 Ea:19914 PHONE L I N E I N P U T M AT C H E R : M u s i c sounds s o p o o r l y o v e r t h e phone because, i n most cases, t h e m usi c g e n e r a t o r is poorly m a t c h e d to t h e phone c i r c u i t . S a m e w i t h t h a t c o l o r b o x y o u m a y h a v e b e e n using (shame on you!). P h o n e lines are 600 ohm. T h e r e q u i r e d t r a n s f o r m e r (shown) is a 60 ohm/600 ohm one, but any 1:10 audio t r a n s f o r m er w i t h 40-75 ohm i n p u t w o r k s w e l L A l s o , i f t h e r a t i o exceeds 1:10, load t h e o u t p u t w i t h a p a r a l l e l 1 0 K , 20- t u r n p o t . and tune I t f o r t h e best sound. T h e ECGs a r e CMOS A N D gates o p e r a t e d in t h e i r l i n e a r (amplifier) r e g i o n . C o n v e n t i o n a l A N D , N A N D , B U F F E R a n d INVERTER CMOS gates w i l l also w o r k (TTL doesn't work). T h i s c i r c u i t also helpe smooth out harsh square- w a v e tones produced by the t y p i c a l el cheapc) 555 c o l o r box, a n d i t i s s i m i l a r t o o u t p u t c i r c u i t r y used i n modems. S o , t h e n e x t t i m e y o u c a l l your A u n t M i l d r e d in Waco f o r a recital she c a n now t r u l y appreciate how bad y o u r voice r e a l l y is. . 4 VA L I D ' r D ATA C A L L PROGRESS DETECTOR: T h i s circuit is used in conjunction w i t h c o l o r boxes, To u c h t o n e keypads, a u t o - d i a l e r s , m o d e m s , r e m o t e c o n t r o l l e r s and alarms t o d e t e r m i n e when the phone is e i t h e r ringing; busy o r o f f -hook. W h e n t h e o f f -hook c o n d i t i o n I s d e t e c t e d , t h e d a t a / recorded message i s t h e n t r a n s m i t t e d . T h i s c i r c u i t I s c o n n e c t e d d i r e c t l y t o the input leads of the phone's earpiece. N o t e t h a t the 470K r e s i s t o r i s c r i t i c a l because i t ' s used i n t h e i n t e r n a l bandpass f i l t e r. OUT1 Ls h i g h f o r r i n g i n g , O U T 2 f o r b u s y, a n d O U T 3 f o r r e o r d e r. 0411'1-3 a r e l o w f o r d i a l t o n e and h i g h f o r o v e r f l o w (excessive noise l e v e l o r talking). T h e Va l i d D a t a o u t p u t Is high when the chip detects the r i g h t o f f - h o o k c o n d i t i o n s f o r d a t a t r a n s f e r. Although t h e f r e q s . used f o r d i a l t o n e , ringing, busy and reorder (depending u p o n e q u i p m e n t ) , t h e i r O N / O F F d u r a t i o n s a r e u n i f o r m . D i a l t o n e is a continuous tone pair. R i n g is ON f o r t w o seconds and OFF f o r f o u r. B u s y is ON f o r a 0.5 second and OFF f o r a 0.5 second. R e o r d e r (a phone company supervisory f u n c t i o n ) is ON f o r 0.2 seconds and OFF f o r 0 . 3 seconds. This c i r c u i t uses a s t o c k c o l o r TV c r y s t a l (3.58 M H z ) . To i n i t i a t e the c a l l progress d e t e c t o r, y o u t e m p o r a r i l y g r o u n d C l e a r. O t h e r pins o f i m p o r t a n c e are t h e Envelope, Enable, Te s t , A n a l o g Out and Counting. The Envelope pin l e t s you d e t e c t and s w i t c h on oddball responses ( u s e f u l f o r demon and w a r g a rn es dialers). T h e Enable pin lets you turn ON/ OFF O U T 1 - 3 and E n v e l c p e , a n d i s grounded f o r O N . T h e Te s t pin Is used only f o r testing only, else ground i t . T h e A n a l o g Out pin produces a f i l t e r e d a n a l o g signal and can be used f o r r e m o t e s u r v e i l l a n c e . T h e C o u n t i n g pin l e t ' s y o u c o u n t t h e d u r a t i o n o f t h e t r y f o r r e c y l i n g t h e C l e a r. 35V ZEN ER 35V R E L AY 4EX 581 o r 4E 30-8 (ITT SEMICON) PHONE t I P H O N E 12 ..11L-3112111116MMIVIPE1 +3-9V ZN4250 2N4870 PHONE LIGHTS PHOTO' D A R L I N G TO N 2N5777 (A) PIRYIND D A R L I N G TO N 150K 3 3 0 K (13) PHONE LIGHT MONITOR: T h i s c i r c u i t is used t o detect i f a phone b u t ton ( o r other) l i g h t is ON and t o buzz w h e n e v e r t h a t occurs. N o hard connection i s m a d e t o t h e phone. FIRST- P H O N E - L I F T E D P R I O R I T Y: I t ' s a n n o y i n g t o h a v e s i x e x t e n siorus and, every t i m e you get a phone call, e v e r y member of your home/ ,4 business goes t h r u t h a t same, t i r e d r i t u a l o f l i f t i n g and replacing phone extensions. O r r u d e l y d i a l i n g o u t w h e n y o u r engrossed I n a converse- 4 tion w i t h your in-laws.. W i t h t h i s c i r c u i t , once one extension is l i f t e d , all t h e o t h e r extensions are a u t o m a t i c a l l y disconnected. T h i s c i r c u i t also i m p r o v e s s e c u r i t y b e c a u s e b u g / e x t e n s i o n e a v e s d r o p p e r s a r e locked o u t . T h i s also e l i m i n a t e s t h e p r o b l e m o f having extension bells ding a l l o v e r t h e p l a c e w h e n a n y e x t e n s i o n d i a l s o u t . The t r i g g e r diodes used have a b r e a k d o w n voltage of 33V. T h e diodes on t h e f i r s t e x t e n s i o n l i f t e d t h u s c o n d u c t . U p o n l i f t i n g t h e r e c e i v e r, the l i n e v o l t a g e d r o p s t o 5 v o l t s , p r e v e n t i n g t h e diodes on t h e o t h e r extensions f r o m c o n d u c t i n g u n t i l t h e o f f - h o o k e x t e n s i o n i s hung u p . Using t h i s m e t h o d , a p r a c t i c a l l y u n l i m i t e d number o f extensions can tr, he u s e d w i t h n o i n t e r f e r e n c e b e t w e e n e x t e n s i o n s . I n f a c t , s e v e r a l „ extensions c a n share t h e same d i o d e I n t e r f a c i n g . T h i s a l l o w s you t o 4 w i r e y o u r e x t e n s i o n t o one s e t o f d i o d e s a n d / a l l o t h e r extensions t o 0, another set so you don't have t o w o r r y a b o u t unknown and subsequent connections I n s t a l l e d t o bypass t h i s s e c u r i t y. The c i r c u i t p a r t o n t h e l e f t i s u s e d i n l i e u o f t h e i n t e r n a l ringe,(which a r e d i s c o n n e c t e d ) f o r a d i s t r i b u t e d r i n g e r ( a l a r m ) s y - e • 1K LED 1M 0 . 1 6-11V PHONE COLOR BOX A D D E N D U M GREEN or RED ?HOME LLNE N.r� • 6-12v RELAY SPST 2N3906 SOLD FOR EDUCATIONAL PURPOSES ONLY 5 PHONE LINEN 2243206 13 • 10 0.0047 STERR PHONE JACK 4.7 K 4027 0.22 r.0047 T V K E Y B O A R D / C O M P U T E R I N T E R FA C E FOR A U T O DIALING: T h i s c i r ut uses a c a l c u l a t o r (non- m a t r i x t y p e ) keypad o r c o m p u t e r o r c o n Lroller input t o a u t o m a t i c a l l y r o t a r y - d i a l phone numbers. O p e n i n g the NC SPST s w i t c h is equivalent t o goi ng on-hook, w h i c h p e r m i t s you t o s t a r t a new c a l L T h e L E D Is used t o i n d i c a t e t h a t the number is being c o r r e c t l y d i a l e d . F o r c o m p u t e r use, t h e P B s c a n b e r e p l a c e d w i t h analog switches (ex: 4016, 4066) t h a t are c o n t r o l l e d by the computer's data/address l i n e s . 3.3K H A N D S - O F F P H O N E C I R C U I T: T h i s i s a n e x c e l l e n t a l t e r n a t i v e t o a Speakerphone u s e s s t e r e o e a r p h o n e s a n d a n e l e c t r e t c o n d e n s e r g mike- -MP C H R O M ERICS ER-21623 K E Y PA D D 130 0.02 •12,1 4.1K r i e L ED 1.5 K Replaces g — - Thins:former 1 K Olih when Mizieot needed n 100K 100K + 2' 1 2 V 41 8 . 1 2 v 0.047 SK3638, CIE246, 2N5061 o r RS276-1020 SCR 0.05 4 5-6K 10K 5 5 —11.awfF OHM AUDIO I N 100K 5K RS273-1380 5 R1 LENTIL., ADJUST ••• 6 L AT C H PB N.O. 470 PHONE _LINES I N 4 0 0 2 O 0.01 -0//aXkli H O L D / M U S I C - O N - H O L D : T h i s c i r c u i t uses a mu si c s y n t h e s i z e r m o d ule ( a v a i l a b l e in several tunes), sound- g e n e r a t i n g chip o u t p u t , c a s e t t e or o t h e r audio i n p u t t o provide music o r special- e f f e c t sounds t o those you have on hold. I f you w a n t t h e H o l d f u n c t i o n only, t h e t r a n s f o r m e r can be r e p l a c e d w i t h a 1.5K resistor. O r you can use a s e l e c t o r s w i t c h to s e l e c t e i t h e r H o l d o r M u s i c - O n - H o l d . R I should m a t c h t h e SCR TOUCHTONE ENCODER: T h i s c i r c u i t produces the required dual tones used by Touchtone phones. E a c h 555 produces a tone depending upon which b u t t o n Is pressed on the m a t r i x keypad. T h e t w o tones are mixed at t h e 741 I n v e r t e d I n p u t a n d a m p l i f i e d . T h i s w e l l - k n o w n c i r c u i t Is c o m m o n l y m o d i f i e d f o r c o l o r box uses. To do t h a t , the resistors in the resistor ladders t o both 555s are changed t o d u p l i c a t e color box freqs. used. 1K ON/OFF N.C. P B -_ . MAGNETIC N.O. •9V --SWITCH SK3638, C3E246, 2N5061 o r RS276-1020 SCR MISSED C A L L I N D I C ATO R : I f y o u a r e e x p e c t i n g a c a l l , b u t c a n ' t be there t o g e t I t , t h i s s i m p l e c i r c u i t w i l l t e l l you t h a t a t l e a s t someone t r i e d t o c a l l you.. N o h a r d w i r e d c o n n e c t i o n is m a d e t o t h e phone c i r c u i t . Y o u s i m p l y t a p e / g l u e t h e m a g n e t i c r e e v i s w i t c h t o t h e phone's bell coil. W h e n a call arrives, I t m o m e n t a r i l l y closes the s w i t c h , which a c t i v a t e s the SCR and turns the lamp ON. C a n also be used to a c t i v a t e a recorder o r answering service. EN4148 (2) PHONE SPEAKER CIRCUIT: I f you Just w a n t t o Listen, this c i r c u i t w i l l let y o u d o j u s t t h a t . • . . . . . . A A ' A A 1 A, A A . A . •••.. . . . . . . A . . \ \ . . . PHONE LINES (D) 4.7K .12V IK 0.47 •12V 8 1N4002 ' • (A) 10S 1 N 2 01N2069 6 9 • 2V PHONE COLOR DUDE_ BOX 2146110 ) P H O N E LINES MCT-2 (MONSANTO) 8 CHIN 680 RS276-116 PHOTOCELL Ae PHONE'S PIEZO D U T r i p is D (E) B U Z Z E PHONE LINES ‘ l i / ilitLED1111,1 5Kgo RI 2.7K C34012- Adjust RI For Desired Light/Dark Intensities g 180K (MOTOROLA 2.7K PIEZO SOUNDER (B) REMOTE R I N G E R S ...tHONES —11 The following are circuits that can be used to replace/supplement bell or piezo sounder now used as your phone's ringer. M o s t ph ringers can be completely turned OFF thru a built-in volume cont Else, disconnect the current ringer to replace It. 6 I . s'ir— ' r MC 34017-X (A) This plain vanilla remote ringer uses an optical coupler for 1 isolation, and a 555 to produce the desired ringer tone. A 556 (or 555s) can be used so that one 555 section Is used to increase/decre the ring time of the other 555 section, or to produce dual tor (MOTOROLA) HONE LINES 6 . 2 K (C) MOC3010 10K 6A, 400 wvoC TRIAC R6276-2000 6 NEON PRONE LINES IOK VOLUME CONTROL PIEZO SOUNDER a ! 1144002 Ig20-100 TrArr 117 VA 220 4 39 PF (B) This circuit produces a warble. There are three versions of MC34012 chip. The MC34012-I warbles at 800-1000 Hz, the -2 at 16 2000 Hz, and the -3 at 400-500 Hz. C l Ls, respectively, 1000 PP, 500 and 2000 PP. Phone line polarity is not Important because the chip a built-in bridge rectifier. I t also features transient protection direct drive for piezo sounders, and does not require external poi' You can vary E l and Cl to produce the warble most pleasing to you you are a country bumpkin like me, you can produce a turkey cat using a C l of 100 PF and a R1 of 68K. Then, you can get your ph calls at the barn even when the frost is on the pumpkin. LAM? (C) This circuit uses another, similar Motorola device, to provide external warbler ringer. T h e three versions of the MC34017 use same C l values for the same treq. ranges. F o r more Inforraatior the MC34012 and MC34017, ask Motorola (Phoenix, AZ) for Appll Lion Notes AN933 and AN937, and the May 1988 issue of MODE ELECTRONICS, which Includes plans for a theremin ringer. PHONE LINES (D) This circuit Is designed specifically for Mallory Sonalerts. Le going t o the internal unit are clipped o f f and reconnected to replacement Mallory Sonalert: (1) BC-18, 3500 Hz, 70 DB, Soft. (2) BC-628, 2900 H z , 80 DB, Medium. (3) 8 C -616N, 2900 Hz, 95 DB, Loud. 200V (2 HIIAA1 0231322 ± 1000 117VAC (E) This circuit automatically cuts OFF the phone ringer during night. A photocell is wired In series with the ringer. When light the photocell, it conducts, and the ringer can ring. When darkened doesn't conduct and the ringer can't ring, instead an LED is used Indicate ringing. To install, a lead to the ringer is cut and the photo, (with 8" leads) is wired to both sides of the cut lead. A 1\2" hol carefully drilled into the phone's upper case PSIS, and the photoce Inserted and glued into place using silicon rubber cement. The phor then placed under your night reading lamp or near a lighted window skylight. 444 PHONE LINES PHONE COLOR BOX A D D E N D U M 7 ----wilywav-pF-4-w,1747,;,M 0.001 5.6M 117VAC 117VAC 10 TCM 1520 (T1) •9V I'S *9V PS ti 2.2M S 120/6VAC 100K 1 0 0 0 1000 (J) r lb a f t W O 5 0.01 7 LOW POWER L A M P S U P TO 12 WAT T M O C 3 0 1 0 HIGH POWER LAMPS UPTO 300 WATT PHONE LINES 10 470K 1 100 M 1N9t4 116-12V RELAY Y E L L O E N T 10K PIIONE LLN ES N O R M A L 1N 4002 I N4002 LN4002 t r N.C. N.C. N2222 CONTROLLED FUNCTIONS • • (K) 12 6n/ LED (L) C O N S U M E_R'T Ft.0 2011 Crescent Dr., P.O. Drawer 537 Alanogordo, NH 88310 Y (OPTIONAL HOOKUP) 1.1.36.1111.11, (F) T h i s simple c i r c u i t is used t o replace/supplement the phone r i n g e r with an LED. (0) T h i s c i r c u i t is s i m i l a r t o (F) except t h a t t h e new r i n g e r is a plezo sounder. F o r combined resuts, combine both c i r c u i t s in the same box. (H) T h i s simple c i r c u i t uses an o p t o - l s o l s t o r and a t r i f l e t o d e l i v e r the ring t o a 20-100 w a t t Lamp or o t h e r load. R i n g d e t e c t o r s o f t h i s t y p e applicable t o phone- c o n t r o l l e d a n i m a l feeders, s e c u r i t y checkers, (J) T h i s i s t h e e l d e l u x o version o f (1). C a n be used t o c o n t r o l l o w power and high- p o w e r loads. A s long as the phone keeps ringing or the r e c e i v e r Is o f f - h o o k , t h e l i g h t w i l l l i g h t s t e a d i l y. I t also remains l i t a f e w seconds a f t e r r i n g i n g stops or y o u hang-up. I t ' s ideal as a phonec o n t r o l l e d n i g h t l i g h t , a n d a s a r e m o t e phone c o n t r o l l e r. (K) T h i s Is another simple ring- a c t i v a t e d c i r c u i t t h a t uses a CMOS and relay. (L) T h i s c i r c u i t Is a simple ringer r e p l a c e r t h a t is wired inside the desk phone's b o d y a n d i n s t a l l e d s i m i l a r t o t h e p h o t o c e l l described above. (I) T h i s c i r c u i t is a m o r e c o m p l e x b u t m o r e r e f i n a b l e v e r s i o n o f (H). • P H OP N H OEN ETESTERS These c i r c u i t s are used t o t e s t and r e p a i r phone c i r c u i t s : MODULAR PLUG M TRICOLOR O D U L A R PLUG phrlend c a l l you up. W h e n y o u r phone is ringing, the LED should pulse and b e y e l l o w i s h (due t o A C c o m p o n e n t ) . Conversation p r o d u c e s a v a r y i n g , y e l l o w i s h L E D o u t p u t . A good source f o r m o d u l a r plugs and o t h e r phone c i r c u i t r y hardware is R A D I O SHACK. W e p r e f e r M A R L I N P. JONES & ASSOC., P.O. Box 12685, L a k e P a r k . FL, 3 3 4 0 3 - t h e y a r e o f t e n less t h a n h a l f p r i c e . PHONE LINES ES B L K RED GRN Y E L (A) • R I Depends Upon LED Used (A) T h i s c i r c u i t uses a t r i c o l o r LED t o test the phone line. I t is shown with a m o d u l a r plug. A l l i g a t o r c l i p s o r h a r d w i r i n g w o r k just as w e l l , and any o f these three methods can be used to hook up any phone c i r cuit. P l u g I t i n t o any phone j a c k . i f t h e LED l i g h t s green. t h e j a c k is wired c o r r e c t l y (le: g r e e n l e a d positive); i f red, t h e j a c k is 'A :rull i n reverse (le: red lead positive). I f the LED does not l i g h t , i t means t h a t the phone ,ack is dead, a handset has been l i f t e d , t h e r e is an a c t i v a t e d i n f i n i t y bug on the line, o r something else has loaded the line down. I n fact, t h i s s i m p l e d e v i c e i s a n i d e a l c o n t i n u o u s m o n i t o r f o r b o t h d e f e c t i v e phone c o n d i t i o n s a n d I n f i n i t y bugs. Tb t e s t t o see i f y o u r phone's o f f -hook f u n c t i o n s , l i f t t h e handset. The l i g h t should extinguish. Tb t e s t f o r ring, dial your own phone number, t h e n hangup Just as the rings s t a r t . Y o u r phone t h e n s h o u l d s t a r t r i n g i n g . I t n o t , h a v e a (B) ( C ) !4.1:11.P (B) T h i s c i r c u i t uses a s i m p l e c e n t e r -scale 50 uA (analog - not d i g i t a l ) m e t e r t o m o n i t o r t h e phone l i n e . O n -hook w i l l show a high r e a d i n g , o f f - h o o k a low reading, r i n g a pulsing reading, and conversation a v a r y ing r e a d i n g . C a n b e u s e d l u s t l i k e t h e L E D t e s t e r, and, i n f a c t , w e suggest w i r i n g b o t h t e s t e r s t o g e t h e r. (C) T h i s c i r c u i t uses a n o r d i n a r y 8 o h m t w e e t e r I p e a k e r and a p u s h b u t t o n s w i t c h t o t e s t f o r d i a l t o n e . W h e n t h e s I v i t c h Is pushed t h e speaker's low Impedance loads the l i n e to simulate the o ff -hook c o n d i tion, and dial tone r e s u l t s . T h e PB f u n c t i o n can be a u t o m a t e d using a 555 c h i p and relay t o p e r i o d i c a l l y t e s t the line, say during s t o r m s when the phone lines are d o w n and y o u need help b u t you can't p i c k up t h e ohnnw e v e r y m i n u t e t o r I p t p r m I n e I f t h e lineA q r i r m r 1 t • . • • • % . . . 1.16 . . . 'SECURITY These nifty phone circuits are used for surveillance and eavesdropping purposes, and their countermeasures. F o r much more info. and circuits on phone bugging/tapping, see our TELEPHONE RECORDER INTERFACE (68) and SECRET & SURVIVAL RADIO (S20) manuals. For much more info. on computer surveillance, see our COMPUTER PEIBEAKINO, AUTOMATIC TELLER MACHINE, ATM ADDENDUM, and BEYOND VAN ECK PLIR.EAKING manuals ($20 each). 9V BATTERY "h. . 1 . ' S . , . 'N. " I s . 4 6 : INDUCTANCE PICK-UP: This simple surveillance device is used with an inductance pick-up coil to monitor phone conversations and data. The coil can be a Lafayette 99E10340 pick-up coil, or it can consist of about 200 turns of fine enamel wire around an iron core. An old relay coil of about that size also works well. I t is placed near the phone r e ceiver for best results. The first 3900 stage is a high gain amp. The second stage is a unity-gain buffer amp, which output can also be used to monitor computer data. •12V 10M .1 V 8 01451 INDUCTANCE P1CK—Up 2N4401 to 1 K 1018 1/4 SPY . 1 . 1 . 0 , 4 , HANDSET P H O N E SPIED RED, GREEN U P O N •12V 10m 3900 QUAD A M P SIMPLE PHONE EAVESDROPPER: Most phones use only two of the four lints going to it (Green and Red). I n this circuit. the spare Black and Yellow lines are fumpered across the phone's speaker lines, with a 9V battery and 10 uF capacitor in series, and wired to the speaker on a remote handset. The circuit will work without the battery and capacitor, but the extra loading may cause suspicions. See also the NES900 circuit described herein. A variation of this technique is to connect the qff.4kPr of &speakerphone to_a spare pair, and then wire it at the monitoring end t o a low-impedance mike preamp, recorder, etc . C O N S LIME.EtTIRO N I C S 2011 Crescent Dr., PA. Drawer 537 Alamogordo,NM 88310 3900 QUAD AMP ANTENNA PHONE LINES 47 PF BUGS/TRANSWITERS: (A) is a radio bug/transmitter that is normally tuned between 108 MHz and 110 MHz (upper FM, lower aircraft). Use with care and don't violate FCC rules. (B) is a line-of-sight Infrared bug/transmitter. F o r maximum range, use a large LED or LED 4 . 7 K cluster and a lens for the transmitter; and a cluster of sensors, lens and IR filter for the receiver. W i l l transmit thru glass. SOLD FOR EDUCATIONAL PURPOSES ONLY (A) PHONE RECORDER SURVEILLANCE: (A) and (B) are fairly equal to each other and the $29 Archer (Radio Shack) TELEPHONE RECORDING CONTROL. They are adequate, but detectable and destroyable phone recorder interfaces. PHONE LINES _A, LED' 4Ir (OPTICAL " X &SITTER) (B) PHONE LINES • 5V 10K 0.47.200V E •5V 5 RECORDER MIKE INPUT 0 15V ZENER 0.47, 200V a. 220 (13) 100K 2N2907 2N2222 8 PHONE COLOR BOX ADDENDUM T RECORDER REMOTE 2 TT TT2lo TT3 TT4 TOUCUTONE NUMEIKEt DETECTOR: This neat circuit detects whether a certain phone number was dialed. TT1. TT2, 1T3, TT4 connects to the sequence decoder inputs inside most Touchtone phones. Great for checking up on a suspected family member, business associate o r employee! The outputs can be recorded for pen register-type uses, or to activate an alarm, remote indicator or recorder. I PHONE LINES +V 7 .+V 330 4-'11 100K 2N4402 RI LED (A) 1K SPDT 470 5K ••••••••• 41--411+gy SK3638, 0E246, 2N5061 or RS276-1020 SCR LED (B) BUG/EXTENSION DETECTORS: (A) uses a 741 as a comparator, while (B) uses the trigger circuit of an SCR for signal change detection. Another difference is that (A) activates only while the bug/extension is connected, while (B) can be made to stay ON even if the bug/extension is later disconnected (It also serves as a missed-call indicator). Bugs (some) and extensions tend to load the line. When they do, the properly s e t detector w i l l immediately detect this loading and activate. Either can be used to detect on-hook or off-hook loading. 'lb set (AYs cut-off, adjust E l to just cut-off the LED. To set (B), set R I all the way positive, then adjust R2 to turn the LED ON. Then adjust R I more negative to turn the LED OFF. Continued from P. 2 ORANGE BOXES One color box that has gotten a lot of attention Is the Orange Box (also known as the Killer Box). There have been many rumors about its existence. We long ago lost count of the number of promises from phreakera about Orange Boxes. One more promise and I'll scream louder than a nudist in a velcro jock strap!! We have yet to see one or verify that even one exists. N o t even plans! It is well known that, In New Jersey, Ma Bell tested a feature of Call Waiting that displays the calling number so that the subscriber can d e termine whether he should discontinue his current call to answer the waiting call. T h i s feature resulted in outrage and legal challenges from the ACLU, unlisted subscribers, and others who love privacy. It Is known that this ANT (Automatic Number Identification) feature is NOT available anywhere without first subscribing to the Call Waiting service, and it is NOT available everywhere that Call Waiting Is avail:, ble. T h e Implication is that only after subscribing to Call Waiting i, the Ma Bell computer enabled for this ANI feature. We know from e x perience that no set of tones or digital signals sent down the line, either during ring or on-line conditions, produces a response from the Ma Bell computer that can be interpreted as a phone number. Enough said! If you have an actual, proven Orange Box or the plans to one, or of an actual, proven REMOBS number, send It to us insured or certified (we don't accept unknown CODs). Otherwise, don't waste both of our time with bullssat promises and fairy tales! Illegal calling detected Mountain B e l l today a n - SMART USE OF AUTO RADIAL: A neat trick is to use the Auto Redial feature on most modern phones. Simply by pressing the Redial button, you can discover who was called last. I f your home or business Is burglarized, if the criminal made a phone call while there, his ID can be revealed. This happens often because criminals use a victim's phone to call friends, accomplices, fences, or to make free long distance calls. (All long distance calls and those local calls made on a line with measured service are also competely traceable from the phone bill.) Simply hook up a tape recorder with a Radio Shack or phone recorder ircuit shown here or in our TELEPHONE RECORDER INTERFACE turn the recorder ON, hit Redial and record the tones or rotary ....ape used In the last phone call (as well as the conversation you have with the called party). The number dialed can then be easily recon- •structed. O r ask the police to do that for you. Phone companies t nounced that it has detected massive fraudulent use of interstate long distance calling that is causing disruption of telephone service i n the Alamogordo area. Area M a n a g e r G e n e Whitehead said the sporadic disruption in service the past • few days has been caused by the use of the Alamogordo switching facilities by people on the east coast calling Puerto Rico. He said the use of the switching facilities became so in- fraud • Students, professionals and convicts cost firms hundreds of millions WASHINGTON (AP) — Tele- block the calls, and they are percent, or about $500 million, phone companied are using com- offering amnesty programs on to fraud annually, but he said, puters, amnesty programs and college campuses for students to "It's tough t o assess losses because its a touchy topic with the law to recoup their losses 'fess up and pay up. They also are working with companies." from a half billion dollars in unpaid calls a year. federal authorities to prosecute College students are believed College students, computer. call-sell operators who are using to be among the biggest offendliterate profefstinnals and even stolen authorization codes and ers. Many know how to use enterprising prisoners a r e electronic "blue boxes" to break computers to search phone comamong the offenders who get into the network and sell calls pany systems for active authoriinto the phone network illegally to all parts of the world a t zation codes, and their campuses are hotbeds for large-scale with stolen authorization codes, drastically discounted prices. "The whole telecommunica- theft because t h e codes are electronic devices o r other tions industry is very aggressi- passed around so easily. means. Other computer hackers in"Every time you find an an- vely pursuing the people who swer for one • area, another are committing fraud. They're clude doctors, lawyers a n d problem crops up. It's a contin- going for restitution and jail homemakers, but Abuhamdeh ual battle," said•Neal Norman, sentences," said Rami Abuham- said the heaviest damage is in district security• manager for deh, executive director of the selling the codes o r posting American Telephone & Tele- industry-sponsored Communi- them on "electronic billboards." cations Fraud Control Associa- The hackers themselves usually graph Co. don't make as many calls as Companies are changing the tion. Abuhamdeh estimated that other groups, including prisonsoftware as well as the hardware in their networks to try to the industry loses about 1 ers, he said. tense Wednesday that local subscribers were having to make many attempts to complete their long distance calls. Some subscribers could not make any long distance calls at all. Whitehead noted that long distance calls into the area also were being blocked by the east coast traffic that was being routed to Puerto Rico illegally through the Alamogordo switch. He said that the use of remote switching offices, such as the one in Alamogordo, to complete these types of long distance calls also causes disruption of local service. For example, he explained, local telephone numbers are dialed as part of the total dialing sequence to complete such calls and this causes local telephones to ring. But when the telephones are answered, there is no one on the line. Whitehead said every effort is being made to minimize the impact on local subscribers through electronic means, as the investigation continues in an attempt to remove the problem. He said that this particular problem o c c u r r e d i n Alamogordo two years ago, and has appeared in other areas of the country. He said the perpetrators were using switching facilites in Montana. but were blocked there; they then tied into the Alamogordo exchange. Other communities affected include -4forrizozo, Tularosa end Cloudcroft. Friday, October 31, 1986 Alamogordo. New Mexic ['PHONE COLOR BOX A D D E N D U M 1 REMOBS REMOBS ( R E M o t e OBServation) is apparently a n o t h e r phreaker myth. C a r r i e r s are r e p o r t e d t o have secret phone numbers that the phreaker dials using a To u c h t o n e phone. H e t h e n punches in t w o access codes and t h e phone number he wishes t o tap, w h i c h can be anywhere in the U.S. N o o p e r a t o r comes o n l i n e . T h e t a p p i n g i s done i m m e d i a t e l y. a u t o m a t i c a l l y, q u i e t l y (no t e l l t a l e clicks, hums or beeps), and as long as he w i s h e s . Again, w e have been promised REMOBS numbers w i t h o u t a single one ever being produced t h a t can be shown t o w o r k . N e i t h e r we nor 2600 M A G A Z I N E (Spring 1988 issue, P. 27) believe t h a t they exist (at least to the c l a i m e d power and extent). I t ' s probable t h a t each exchange has a REMOBS s e t - u p f o r M a B e l l f o r line t e s t purposes, and f o r l a w e n f o r c e m e n t and o t h e r personnel f o r numbers In t h a t exchange. A n d It's probable t h a t once a l l the phone systems become completely I n t e g r a t ed, a n a t i o n a l l y -based REMOBS w i l l b e I n s t a l l e d . :nu-eskers have accessed c e r t a i n Ma Bell f u n c t i o n s In t h e i r exchanges by d i a l i n g D A ( D i r e c t o r y Assistance) using a S i l v e r Box. T h e " D " hiltton i s t h e n held down. T h i s bypasses the D A o p e r a t o r. A pulsed dial tone results. A c c e s s codes and phone numbers are then punched in the To u c h t o n e pad. O n e o f these t e s t functions allows a quality check o f a subscriber's l i n e d u r i n g a c t u a l use - thus eavesdropping. The o n l y k n o w n REMOBS-like system i s t h e Te l e d y n e F o r t e I I System. It's l i m i t e d to Its exchange, and i t requires passwords to access its v a r ious t e s t f u n c t i o n s . L I N E M A N ' S TEST SET The L i n e m a n ' s Te s t S e t (LTS), a l s o k n o w n a s t h e " b u t t s e t , " c a n be bought c o m m e r c i a l l y f o r S100.. F u r a l o t less, you can make one from a m o d i f i e d o n e - p i e c e phone: (1) U s e a l i n e c o r d t e r m i n a t e d w i t h a l l i g a t o r c l i p s . S e e ( A ) . (2) I n s t a l l a D P D T t o g g l e s w i t c h a n d c a p a c i t o r s . S e e '(A). W h e n switched in, t h e capacitors block the line's DC, but p e r m i t the ring and conversation A C t o b e m o n i t o r e d . (3) A n o t h e r hook-up m e t h o d i s t o s t a p l e - c o n n e c t bare ends o f LTS leads t o the phone lines. See (B). A n o t h e r m e t h o d is to poke the phone lines w i t h s m a l l s a f e t y p i n s , t h e n h o o k t h e a l l i g a t o r c l i p s t o t h e m . - . . . A n o t h e r method is to use a ribbon cable press-on connector. T h e n wire :he LT S t o t h e m a t i n g connector. U s e d w h e r e discovery is not l i k e l y, more t h a n one phone l i n e i s m o n i t o r e d , a n d w h e r e t h e l i n e s a r e r e peatedly accessed o v e r t i m e . (4) T h e s a f e s t known w a y t o use an LTS t o p h r e a k phone calls is t o find a j u n c t i o n box serving public payphones and a cordless phone m o d i f i e d f o r LTS use. E v e n i f the LTS is discovered, since the phreaker can be hundreds o f yards away, he would be d i f f i c u l t t o catch and c o n v i c t . PHONE LINE A L L I G ATO R CLIPS t (A) a s PHONE LINES / i 1 TO L.T.S. RIPPING—OFF PAYPHONES Conttd: A d d i t i o n a l m e t h o d s ( P. 1 5 - 1 6 ) u s e d t o r i p - o f f payphones i n c l u d e : (1) U s i n g double- s t i c k t a p e , E l m e r ' s G l u e o r STP t o gum- u p coins. (2) S e a l a l l l e a k s i n t h e p h o n e ( m o n e y c h a n g e r, A T M , e t c . ) w i t h p u t t y o n a v e r y c o l d , d a r k n i g h t . F i l l t h e phone w i t h w a t e r t h r u t h e coin slots. W h e n the w a t e r freezes and expands, t h e phone bursts open. A B C D DUAL-TONES: The Touch-Thne t a b l e on P. 9 should be added t o f o r the m i l i t a r y ( A u t o von) phone system A , 13, C and D keys. A = 697 + 1 6 3 3 . 13 = 770 + 1633. C = 852 • 1 6 3 3 . D = 941 • 1633. T h e r e s u l t i s a S i l v e r o r G r e y B o x . These e x t r a k e y s a r e used t o p r o g r a m i n c a l l p r i o r i t y. SHRIEK MODULE: CONSUMERTRONICS i n v e n t e d a n d s e l l s a d e v i c e c a l l e d t h e S H R I E K MODULE (see o u r T E L E P H O N E R E C O R D E R I N T E R FA C E ($8) m a n u a l for complete description). I t w o r k s b y sending an extremely loud shriek d o w n t h e p h o n e l i n e a t t h e p u s h o f a b u t t o n . T h e S H R I E K MODULE i s a n e x c e l l e n t c o u n t e r m e a s u r e a g a i n s t p h o n e b u g g e r s , rapists, p e r v e r t s , harassers, b i l l c o l l e c t o r s , enemies, e t c . I t ' s q u i c k l y c o n n e c t e d / d i s c o n n e c t e d w i t h i t s m o d u l a r phone p l u g and " Y " c o n n e c tor, b ..th s u p p l i e d w i t h i t . O u r t e s t i n g p r o v e s t h a t t h e S H R I E K MODL LE is easily loud enough t o damage h e a r i n g . S o m e have s c o ff e d at t h a t c l a i m , s t a t i n g t h a t i t is Impossible t o build any device t h a t can produce a loud enough sound over the phone t o damage hearing. To s e t tle t h i s issue once and f o r a l l , b e l o w is p a r t o f an a r t i c l e photocopied f r o m t h e E L E C T R O N I C S DESIGNER'S C A S E B O O K N U M B E R 4 , P. 5 (published b y E L E C T R O N I C S ; e m p h a s i s i s m i n e ) : Acoustic protector damps telephone-line transients by G i l M a r o s i 1111101 A m n o n Undue' inc. Sams Clara Cadf. By limiting the transients on telephone lines, this acoustic shock protector prevents those sudden high sound levels that can Oarnazt the ear badk enough t o cause loss o f hearing. I t holds the maximum peak-to-peak voltage a t t h e receiver o f a telephone headset t o 50 millivolts. Enough said! T h e S H R I E K M O D U L E s e l l s f o r $75 e a c h (20% O F F on order.; of 5-9 units, MOBILE C O R D L E S S PHONES: The old style m o b i l e phones were l i m i t e d in range and n u m b e r o f channels. T h e u s e r d i a l e d t h e o p e r a t o r on a f r e e c h a n n e l a n d placed t h e call. T h e new m o b i l e phones are c a l l e d , " c e l l u l a r " phones. T h e y have many m o r e channels and u n l i m i t e d range because r e p e a t e r s relay calls a l l o v e r the U.S. and some parts o f Canada, and no o p e r a t o r assistance is r e q u i r e d . C e l l u l a r phones o p e r a t e i n t h e 870-890 M H z b a n d w i d t h , w i t h c h a n n e l s s p a c e d 3 0 K H z a p a r t ( f r o m : S E C R E T dc S U R V I VA L RADIO ($20)). Cordless phones are m o b i l e phones w i t h a range o f about 300 m e t e r s (a b e t t e r antenna and r e c e i v e r extends t h i s range f o r miles). O l d e r c o r d less phones could be accessed by anyone using t h e i r own cordless hand- CH ROM ETRICS ER-21623 I KEYPAD I C OM D P D T 11.111 MISCELLANEOUS MORE ON COMPUTER BOX EMULATIONS: Computers can be i n t e r f a c e d t o phone lines t o e m u l a t e color boxes in several w a y s . O n e m e t h o d e n t a i l s using a m o d e m t h a t c a n be p r o gram med t o generate m u l t i - t o n e s . A n o t h e r is to couple your computer to t h e phone l i n e using a speaker. T h i s only w o r k s d i r e c t l y w i t h c o m puters t h a t can generate m u l t i -tones, such as the A m i g a . I B M - P C / X T / AT and P 8 / 2 systems c a n ' t generate m u l t i - t o n e s w i t h o u t t h e use o f a special card. E l s e , a D / A conversion must be m a d e t h a t w i l l produce these tones. A t h i r d , m o r e p r a c t i c a l way is t o use a music synthesizer or M I D I t o p e r f o r m t h i s t a s k . A N O T H E R TO U C H TO N E ENCODER: T h i s one's s i m i l a r t o the previous one, e x c e p t s i m p l e r t o b u i l d . I t ' s f r e q s . a r e s t r i c t l y To u c h t o r • a. • • • • • • • • • • • operator came on and said. -What number arc you Lulling fr,on.'"( hit • Every switching office in North America (the N PA system) is assigned an o f f = name and class. There are five classes of offices of cerieaily. I pve her the number to my CO. she thanked me. and then numbered I through 5. Your CO is most likely& class S or end office. I was connected to a conversation that appeared us he between a All I rang-1 /mance (ToMeans are switched by • loll office which can he framernan and his wife. Then it started ringing the party I origritally a 03,4.1.2. or I office. There is also • 4X office called an intermediate sainted :to call and everyone phreaked out (excuse the pun) I P.O. BOX 752, MIDDLE ISLAND, NY 11953 • pint I he 4X office is a digital one that can have an unattended _immediately dropped this dual line conlercrice I exchange attached to it (known as a Remote Switching Unit - RSU). : A C M -shouldn't mess with the IMPS operator since she Lori,. 1 where 151 1 are calling from. Your number will show up on a 10-digit L E D SUBSCRIPTIONS: S15/yr Individuals. 1 he following chart will list the office number. name. and how many 1 (AN I hoard). She also knows utictlyer to not you are at a id those offices existed in North America in 19111. S40/yr Corporal:0ns • • omen lone and she can trace calls quite readily Out of all Of the Claw N a m e A b b . i EOM g ..'eperators, she is one of the must dangerroo. I I l e g k i n a l Center1 4 c 1 2 BACK ISSUES: $25/yr, since 191(4 t r I N WA R D ° m a i m . Thu operator a n t s your local I SI'S (-0") 2 S e c t i o n a l Center S C 6 7 • operator in connecting calls She will never question a .all as long as 3P r i m a r y Center P C - L A O 2600 is a highly recommended phone and 6 , 4 T o l l Center T ( ' • 1:100 the call is within her Iff1.114. arra. She can only hr reached via other 41'T o l l Point T P „ r' operators o r b y a Hlue Boa. F r o m a M i . you would dial computer phreak kg quarterly • • 4X I n t e r m e d i a t e Point I I ' ' ' 1(1'..NPA•1214S1 f o r the I N WA R D opetatin that Will help you • S E n d Office E 0 • 19.P90 queineesany alb' within that NPA only R R S 1 ; 1 4 5 U es 1!.-41141):44ORY ASSISTANCE Oprratto. I his is the 011C1.111elf Il i When connecting a call from one parts to another. the switching 5iiifIrrrMlfteded to when you dial 41 I or NV/1-555-1212 She does equipment usually tries to find the shortest route between the ° s a i l ntsseeitrrii know where you arc calling Irani She does not have aCCe'rN end °WICe of the caller and the Class 5 end office of the called party. if- itsindistedriumbers, but she does know it an unlisted numbet exists fig no utter-office trunks exist between the two parties. it will then move a certaintisung There i5 also a directory assistance f i r deal people 11.110 use u i n the pest highest office for servicing (Class 4). If the (lama office leletypewitters(TIVs). If your modem can transfer HAI 'IN)! 0 5 5 ) . y i t handle the call by sending it to another Cials4 or 5 office. it will al to the next office in the hierarchy (3). fhe switching equtpment baud -..the Apple Cat can). then you can call hint her up aisl rune an interesting conversation. I he number is tox14(55-1155. I hey use the lust toes the high-usage interoffice trunk groups. If they arc trusyit PHONE pies to the final trunk groups on the next highest kvel. I f the eat! standard-telex abbreviations suchAN GA (01 C Ahead. I her tend to LINES berries-rand will talk longer than your regular operalois Also. Mei. arc cannot be connected then, you will probably get a reorder [120 11'10_ (Interruptions Per Minute) signal a l s o known as a fast busy). At this More likely to be persuaded to give more inlomtation through the _mesa-0.f "social engineering'. time. the guys at Network Operations arc probably going berserk =-1114Ortunately; they don) have access to much. I once hulishitted trying to avoid the dreaded Network Drat:Rock (as ran on TV!). -.• -It is also intemting to note that 9 connections in tandem is caledq a011419stirdithese operators and I found nut that there arc twoyuch o ices that handle T r y. One as in Philadelphia and the other is in ring-around-the-rosy and it has never occurred in telephone haw 2N3904 (4) California. They have approximately seven operators each. Mint of I his would cause an endless loop connection (an interesting way to the TTY operators seem to think their job is I tics also feel they really screw up the Network). 'I he 10 regional centers in the United States and the 2 in Canada arc are underpaid. !hey actually call up a regular 13A tt to process your all interconnected. They form the foundation of the entire telephone.. request. n o fancy computers here! (Other operators have access to • a AIICi( own 1)A by dialing E.P.NPA•1311.51 SELECTOR • network. Since there arc only 12 of them. they arc listed below: _...'; NPA SWITCHES : 0 1 1 . • ' t h e Tfrdirectory assistance. by the way. is still a tree call, unlike (lass I Regional Office Location 0 2 1 4 normal DA. One might be able to aynid being charged for 13A calls by Dallas 4 ESS . I a J . " : 87 • In 2 1 5 using a computer and modem at 45.5 baud. Wayne. PA 3 0 3 • • • ( - N / A Operator. CN; A operators do exactly the opposite of what Denser IT 306 directory assistance operators arc for. You give them the number, they • • • Regina No. 2 SPI-IW [Canada) 314 give you the name and address (Customer Name. Address). In my Si. Louis 4T PHONE LINES e • 404 experiences, these operators know more than the DA operators doand Rockdale. GA • • 412 they are more susceptible to 'social engincering_- It is possible to Pittsburgh 4E 504 bullshit a C74/A operator for the NON-P1:11 DAS (i.e.. you give them Montreal No.) 4AETS [Canada) 607 the name and they gave you the unlisted number). This is due to the fact Norwich, NY 714 that they assume you are a fellow company employee. The divestiture. San Bernardino, CA 1 5 though. has resulted in the break-up of a few NON-PUBa'sand policy Norway. IL 1 -0 1 4 -changes itiCN White Plains 4T, NY In the Network. there are three major types of switching equipment. • iNTERCEPTOperator. The intera-pt operator is the one that you fley are known as: Step. Crossbar, and E.S.S. Check past and future are connected to when there are not enough recordingsavaiLabk or the a r e is not set up to tell you that the number has been disconnected or issues of 2600 for complete details on how these systems work. changed. They usually say. 'What number did you dial?" This is Operators Another vital ingredient of the Network is the telephone operator. Considered to be the lowest operator !deform since they have no power "Slave arc manydifferent kinds. What follows is a discussion of someof whatsoever and usually know very little. L O T H ER Operators. And then there are the: Mobile. Ship-to-Shore. • w i r e common ones. Conference. Marine. Verify, '''Leave Word and Call Back.- Route and • I S P S Operator. The TSPS (Traffic Service Position Systern opposed to This Shitty Phone ServieenOperator is probably the bitch Rate (2.11•1100.141.1212•ST—new number as a result of the break(or bastard for the phernak liberationists) that most of us are used to up). and other special operators who have one purpose or another in the Nenciwk. haring to deal with. Problems with an Operator? Ask to speak to their supervrsor_.or Here are her responsibilities: I) Obtaining billing information for Calling Card or 3rd number better yet, the Group Chief (who ts the highest ranking official in any office), the equivalent of the Madame in a whorehouse (if you will call.. In excuse the analogy). 2) Identifying called customer on person-to-person calls. 1 1 2 P H O N E S Or Some COk. by the way, hate bugs in them that allow you to use a I 3) Obtaining aomptance of charges on collect calls. 4) Identifying calling numbers. This only happens when the calling or a 0 as the Ith digit when dialing (This tends to happen mostly in number i s not automatically recorded b y C A M A (Centralised crossbars and it doesn't work consistently.) 1 his en:shies a caller to call Automatic Message Accounting)and forwarded from the local office. special operators and other internal teko numbers without having to Thos could be caused by equipment failures ( A N I F Automatic use a blue box. For example. 415421.1111 would get you a San Franciseo-Oak Land INWAR I) Operator. Number Identification Failure) or if the office is not equipped for CAM A ION I Operator Number Identifseation). 11 once had an equipment failure happen to me and the TSPS PHONE L I N E S 139 • 11 11 VITAL INGREDIENTS PHONE COLOR BOX ADDENDUM SWITCHING CENTERS AND OPERATORS From:2600 MAGAZINE (A) (B) (C) 18Ls211;;TIL T " T • •• a* set, at the cost of the subscriber. Newer models use different fregs. and access codes to prevent this lucrative terra Of phreaking. Channel 1-10 Base and Handset freqs. ()n MHz) are, respectively: 1 -46.61/49.67 2 -46.63/49.845 3 -46.67/49.86 4 -46.71/49.77 5 - 46.73/49.875 6 - 4 6 . 7 7 / 4 9 . 8 3 7-46.83/49.89 8 -46.87/49.93 9 -46.93/49.99 10 - 46.97/49.97 SUGGESTED READING: The following selections are suggested: (1) 2600 MAGAZINE- a n excellent quarterly on phone and computer Phreakirg. P.O. Box 752, Middle Island, NY 11953. Subscriptions are s15/yr. Individuals, $40/yr. corporate. S25/yr. back issues (since 1984). The Spring 1988 issue has a lengthy article ca./1e, et MONITORING; PHONE CALLS F11771 A TYRO." We reproduced this article in our new, BEYOND VAN ECK PBBIAKING (S20) manual. car(D) SIMPLE PHONE CIRCUITS: ( A ) Is another Off-Hook indicator. C i r cuit isolation and input impedance are very high. (B) is a phone lock. Once you have the circuit wired, then seal your box with epoxy to conceal the combination. Prevents unauthorized people from using your phones. Any number or type of selector switches can be used. (C) is a simple ringer silencer that does not require disassembly of the phone. The line connecting the yellow and green leads Is cut and the cut ends wired to a SPST switch. (D) is a simple conference caller. l b use this circuit, each phone shown must have its own number. Use one phone to call Person A, and another phone to call Person B. T h e n throw the switch that connects the two phones together thru their 1 tiF caps. Bingo! Yo u ' r e in conference! 00K ALARM coorrarra 555 12 PHONE COLOR BOX ADDENDUM Pwc [ D O Z E %WWII •11 REMOTE 100 a. ICKARPHONE M I . 01 17: abs 60K •••• PHONE UN ES 2N2222 4M KO ' - 6SK • ALARM DIALER: This invaluable circuit will detect the activation of one to many normally-closed (NC) or normally-opened (NO) switches common to alarm systems, then automatically dial the phone using Ibuchtones, and then play a message into the phone. The number dialed can be 911 or some phone number you, or someone you trust, can be reached at. Alarms include those for intrusion, fire, smoke, water, ice, wind, pet, etc. Additional circuitry (using the NE5900 IC described herein) could be added to detect a busy signal or non-answer, and to dial a another number if either occurs. l b use this circuit, first record the tones used to dial the number. This can be done by using any phone recorder interface hooked up to your recorder while you dial that phone number. Leave 2-5 seconds of lead tape before dialing so that enough time is given for the dialtone to come on. Then leave 3-6 seconds of blank tape. Then follow that with a short, clear, emergency-type message that includes your name and address. Follow the message with another 3-6 seconds of blank tape. Repeat this message and 3-6 seconds of blank tape at least 10 times or until about 8.5 minutes of tape time is used up. Then rewind the tape, and book the circuit to it. Once completed, test the device by simulating an alarm activation. T h e n rewind your tape again. •ausuismemossiemirm o w s (2) "771LEPIIONE ADD-ON, NO MORE WRONG NUMBERS," Gary McClellan, RADIO ELECTRONICS, March 1984, P. 59. T h i s fairly complex device ends you the misery of wrong-number dialers, phone salesmen, harassers, etc. (3) "THE BLUE 8 0 1 A N D M A BELL," Herb Friedman, RADIO ELECTRONICS, P. 49. Fascinating article on early phone phreaking but does have some major errors (ex: misidentifying the Black Box as the Red Box). (4) PHREAKERBBSs. Error rates are high, much of the material is pare fantasy and nonsense, the schematics are virtually unreadable and no photos, BBSs can be expensive to access, some use plagiarized * m a t e r i a l , and phreaker BBS deny most users important accesses and their numbers change so frequently that its hard to keep track of them. Occasionally you can pick up some useful info. We use BBSs but mostly to download PD software, for E-Mail, and for exchanging opinions. "PHRACKING": The correct term for describing color boxing is "Phrealdng." The term, "Backing," can be defined as using computers and the phone system to penetrate other computer/phone systems. "Phreaking" has also been Mined this way. "Hacking" can also simply be defined as computer Emigrem ming. It's time that a new term be devised which is defined as cry kind of phreaking/hacking activity that involves a computer and tie phone system. I propose that my new term, "PHRACKING" be used = I relegate "Pbreaking" to color boxing only and "Hacking" to progem mire only. The term, "PHRACKING" not only combines "Phreaktag" and "Hacking," but also sounds like "Cracking," "Fragging" and "fracas," a l l relevant terms. I f you agree/disagree, please write me trlease don't phone until science develops a way to clone about three I s o r e of me). 555 2E2646 OM 100 ale 2 0.01 1 250 555 2N222i 33K - o.oi = No= " r = 100 *ALLMODESARE 1144002 0.1 45V RELAY (1.2K OHM) PHONE LINES eol,e SOO : 4 1 PHONE CALL LD1ITER: T h i s neat device limits the duration of a phone calL Great If you have talkative teenagers or employees. The amount of time permitted is about 10 minutes. After about 8 minutes (set by the UJT circuit), several warning beeps are emitted on the phone line. (This duration can be changed by changing the 4M ohm resistor and-or 250 uF capacitor. Using a 1.2M ohm resistor keeps the calls under 3 minutes for long distance calls.) From about 1-3 minutes later (set by the 555, 470K, 1M and 100 uF), a constant ringing across the line results that can only be stopped by hanging up the phone. This circuit is automatically activated every time the receiver is picked up and reset upon hanging up, but can be defeated by opening up Si. .9V 45 olio 'Speaker 61 =RUBE PHONE 0 a. 3 2-N5139 T O 680 NoN-sECURE PHONE 2.2K tr- CARRIER INPUT so T4 R f l T wEl 60 3 1N4002 (8) IN5139 so = • 600 L 10K I iNO SECURITY VOICE SCRAIIHLENJDESCRAMBLER: T h i s circuit lets you use an ordinary phone to scramble and transmit a voice message and receive a scrambled message and descramble it. I t is a frequency Inverter scrambler. T h i s means that low tones are inverted to high tones and vice-versa. l b an eavesdropper, the resulting message is garbled or like a foreign language. Each phone involved in a scrambled call must have one of these devices for I t to properly work. This circuit requires the mechanical construction of a receiver mount that allows the small pickup coil, L I , to be placed near the house , phone's earphone, and a small speaker near Its mike. This mount should also include the rest of the circuitry. LI i s a telephone induction coil pick-up, such as t h e Lafayette 99E10340 or equivalent (iron coil form). Some relay coils also work well. T l - T 4 are all 1:1 isolation transformers with 500 ohm windings, such as the 'fried T34-X. 300-600 ohm windings will also work. The carrier input can be any sinewave generator tunable in the 3-3.05 KHz range. F o r any set-up all carrier freqs. used must b e identical. ,J0,4 : i d & C O N S L72-1EFUTRONICZ..3:111 Crescent Dr., PA. Drawer 537 Alamogordo. NH 88310 • TELEPHONERECORDERINTERFA COPYRIGHT © 1 9 8 5 ' , J O H N J . WILLIAMS & FA M I LY. A L L R I G H T S RESERVED By: John J . Williams, MSEE, CONSUMERTRONICS C O . , P. O . D r a w e r 537, Alamogordo, N M 8 8 3 1 0 - oFeELEms4D , v / p c s a , - N r w . 4 1 - 4 4 . 4 1 . 1 4 . 4 How often have you needed t o record a telephone conversa-, tion without t h e f e a r t h a t M a Bell o r some goon can detect' that you have a recorder hooked-up to your lines? Ultra-high1, impedance telephone interfaces, such a s t h e TELECORDERI (described here) were d i ff i c u l t t o obtain by the unwashed gen-1 eral public. M a Bell, police agencies, spy outfits and organized c r i m e families had t h e m . (Sidetone inductive taps have been available, but require the disassembly of the phone). A t e l e p h o n e recorder i n t e r f a c e should have t h e following features: (1) I t must provide a clear and clean reproduction of the conversation. (2) I t must be quickly and easily connected a n d disconnected. W i t h the advent o f the modern phone connector, one no Ion e r needs a screwdriver to make a phone connection. (31 I t must be easy to operate, and of small size. (4 I t must have u l t r a -high input impedance; i t must not load the lines o r interfere w i t h telephone conversations; and it must not be electronically detectable. T h e old-fashion interface consisting o f a capacitor(s) and a transformer (see figure)i to connect a recorder t o the phone lines is easily detectable.' Sophisticated electronic technicues can be used t o even ferret out taps/bugs w i t h input impecances o f up-to about 10 Meg. ohms. T h e lines are thoroughly tested when they are known to b e clean, a n d t h e n periodically retested f o r taps/bugs. Any changes i n l i n e impedances, which indicate a tap/bug, can then be observed. Even minute changes will alert the tester to make a physical search. (5) I t must b e rugged and dependable. Regardless of the noise and interference o n t h e lines, t h e recorder interface must survive and function as designed. I t must also survive high-voltage tap/bug destruction techniques. T o destroy bugs/ taps, a technician disconnects the lines from all legitimate d e vices and the Central Office. H e then hooks-up an AC generator t o supply 1,000+ v o l t s t o t h e lines. A n y tap o r bug on the lines n o t o f very high impedance and surge-protected as the TELECORDER is, is immediately destroyed. (6) I t must have on-line monitoring capabilities. I n other words, simply b y observing an LED o r meter, one can tell i f there i s a c t i v i t y o n t h e lines without l i f t i n g the handpiece. On-line monitoring i s extremely important f o r t w o reasons. First, i t immediately detects any tap/bug in which the monitored conversation is sent down the phone lines, such as an infinity bug. A tap/bug is obvious when, as in any recording, you notice t h e sound-level LED/meter activations are in sync. t o the sound levels in the room. Second, i t immediately detects when a n extension phone i s being used. I n this case, t h e sound-level L E D / m e t e r activations w i l l indicate a conversation is taking place, but since the sound activations are not in sync. w i t h the room sounds, the sound is coming from an e x tension. (7) A n i c e feature is an option to have the recorder a c tivate from an o f f -hook o r voice-activated switch. W e implemented a n electronic o f f -hook activation switch. W h e n i t comes t o phone conversations, o f f -hook switching i s p r e ferred over voice-activated switching. (8) Another n i c e f e a t u r e i s t o have a "Shriek" option. The "Shriek" i s designed t o send an ear-piercing shriek down the phone lines t o protest against dirtbags that make obscene or heavy-breathing phone calls, and against infinity bug eavesdroppers. We also implemented this feature. TERMINOLOGY The t e r m "phone" means "telephone." T h e t e r m 'recorder" means "cassette t a p e r e c o r d e r. " T h e 'term "mike" means microphone. T h e abbreviations, " R F " and " F M " mean "radio frequency" and "frequency modulated," respectively. The term "phone tap" or "tap" is used for "telephone wiretap." A p h o n e w i r e t a p occurs when a n electrical connection i s made to the phone lines foNthe purpose of monitoring the s i g — nal on the lines. F o r example, i f one uses alligator clips t o jumper a headset across t h e phone lines, that is wiretapping.; The TELECORDER i s a f o r m o f wiretapping. W i r e t a p s a r e generally most easily placed without entering the premises t o be tapped. P h o n e taps are used t o monitor phone conversa-i tions only. The term "phone bug" or "bug" means "telephone bug," and des2 cribes any device, o t h e r than a tap, which i s installed i n a phone or connected t o one, and is used to monitor a conversation. A l t h o u g h the terms "tap" and "bug" are frequently and incorrectly used interchangeably when phone devices are described, a "bug" is generally a device that uses i t s own microphone and transmits wirelessly. H o w e v e r, a bug may be connected t o the phone lines t o obtain operating power, to provide switching, and-or t o transmit on a wired basis. Te l e phone bugs are frequently placed t o n o t only monitor phone conversations, b u t all conversations taking place in the room. A " b u g " almost always requires entering t h e premises t o be bugged. T h e objective of bugs and taps are the same - to c o m promise conversation. INFINITY BUG One o f the most popular phone bugs is known as the "infinity bug," "infinity transmitter" and "harmonica bug." T h i s fascinating device is secreted inside the phone and connected directly t o i t for switching and transmitting purposes. I t usually a l so derives its power from the phone lines. Once implanted in-. side the phone, t h e eavesdropper can call the phone f r o m any place in the world. B e f o r e the phone rings, he uses a harmonica (or other tone signal device) t o inject a certain frequency; into the lines. T h e infinity bug detects this frequency and im- , mediately switches o f f the ringer and then bypasses the hookswitch switches t o make the phone a c t as i f the handpiece had been lifted. T h e signal from the now active handpiece m i ke (or from another mike hidden in the phone o r in the room). is highly amplified b y t h e i n f i n i t y bug and transmitted down the lines t o the eavesdropper. T h e infinity bug immediately becomes deactivated when either t h e handpiece is physically raised o r when t h e eavesdropper injects another t u r n -OFF tone into his phone. HOW THE CIRCUITS WORK The TELECORDER circuits shown here are (refer to figures): 1) The TELECORDER, Shriek Circuit, and Power Supply. 2 ) The Automatic (Auto.) Feature. 3 ) T h e add-on RF Transmitter Circuit. Most commercial telephone recorder interfaces have a bridge rectifier input so t h a t they function regardless of which leads D I R E C T N A A D W I R E TA P O N T E L E P H O N E U N E INDUCTIVE TA P e (2) SI INDUCTIVE T A M ONE EACH ON U N E . 6 . 0 I N S T R U M E N T D I R E C T TA P A T T H E T E L E P H O N E C O U P A N Y EXC.-JANICE R A D I O TA P O N T E L E P H O N E U h E A N D I N S T R U m E H T I N F I N I T Y T R A N S M I T T E R S . O N E E A C H O N 1.1111 A N D U N , QA...,1 i—ti t i 0 t SI w 10 . RADIO E N E R G Y I L L U M I N AT I O N T E L E P H O N E M O D I F I C AT I O N S R I S C / 0 . T RINGER C O I L S I,.O FTONE Figure 1: Composite Various Tapping and Bugging Methods U.:ed.. 1 i d I N F I N I T Y TRANSMITTER H RINGER C L I . T / I A L. O F F ICE WINES HOOK:WITCH NETWORK PHONE INSTRUMENT PREMISES HE R O S E ' are connected to the red and green lines. W e do not recommend bridge rectifier inputs because they are vulnerable t o high voltage line-clearing pulse techniques. Therefore, proper connection i s required f o r t h e TELECORDER t o function. The red line should be positive with respect to the green line. TELEPHONERECORDERINTERFACE P . 2 TELECORDER WITH SHRIEK CIRCUIT 1) Depending upon h o w y o u wish t o use the TELECORDER will dictate its size, shape, arrangement of controls, AC power vs. battery operation, and so forth. W e used a 6" X 9 " X 2" aluminum hobbyist box (see figure) so that we could place the recorder over it, and the phone on top of the recorder. IThe2114733133 input pre-amp. is biased-up with R I t o permit an Iultra-high input impedance. Optimum results occur when R1 is tuned so that Vs = 0.65*Vdd. T h e input zener protects the circuit from high voltage or reverse inputs. T h e output o f the pre-amp. goes to the Aux. Input of the recorder. T h e i n put impedance of the Aux. Input of cassette recorders are typically 100 K - 500 K ohms. T h e Mike Input is not used because its Input impedance is too low - typically 10 K ohms. To pro-. vide a stronger signal to the recorder, use the audio amplifier stages o f the RF Transmitter (see figure) to boost the output of t h e F E T. This output is then connected to the Mike Input of the recorder. The Shriek Circuit simply consists o f a NE555 Ti m e r I C coupled to the phone lines with a standard 500:8 ohm miniature speaker transformer. T h e capacitors in series with its primary and secondary block the DC. When the ganged pushbutton switch is closed, two things happen - power is fed to the timer to activate it, and the transformer secondary is connected to the phone lines. T h e second feature is very important because, without it, the Shriek Circuit would have to be permanently connected t o the phone lines, and thus would be ,.searQ detectable by Ma Bell and other snoopers. R 2 is tuned so that the resultant output is as sharp as possible for optimum effectiveness. The Power Supply Circuit is basically a plain vanilla design, except t h a t a n A C outlet for the recorder A C is provided. SW1 may/may not be included for switching the Auto. Feature into the circuit, and for independent recorder operation. We designed our power supply for 15 VDC (7815 voltage regulator IC), but you can select a different voltage. Y o u can a l iways use batteries if 120 VAC is not desired or available. AUTOMATIC FEATURE The Auto. Feature Circuit is an option that permits you t o automatically turn-ON the recorder whenever the phone is in the o f f -hook state. N o t e that the Auto. Feature is NOT a voice-activated switch. W i t h this option, even the dial pulses/ tones a r e recorded, and infinity bugs automatically activate the recorder. T h e purpose of the Off-Hook Detection Circuit is to provide a +15 VDC at the collector of the 2N2222A transistor whenever the Input voltage drops from the 48 volt onhook phone line voltage to the 5 - 6 volt off-hook line voltage. The purpose of the Delay Circuit is keep the recorder ON for 1 - 25 seconds (determined by 1 M, 15-turn pot.) after the last off-hook situation. T h i s saves wear and tear on the recorder . so t h a t i t doesn't keep turning O N and OFF whenever the phone rings. The 15 volt input zener is provided to protect the circuit from 4114. line noise and surges. Input impedance is an impressive 30 M ohms. T h e 5 volt source zener is used to drop the output voltage a t the 2N2222A input for proper switching. I t , as well as the 1 5 volt zener, must be changed i f a power supply voltage other than 15 volts is used. SW1 on the CD4047 output selects either the Auto. Feature circuit to control the reed relay (thus recorder), or to bypass the Auto. Feature altogether. RF TRANSMITTER In case you want to transmit the monitored phone conversations, an RF transmitter circuit is provided. T h e Input is connected t o point (A) on the TELECORDER FET source output. 'The f i r s t t w o stages amplify t h e input signal, and provide high stability and sensitivity. T h e last two stages mix the signal with the carrier and transmit it as a FM signal. Maximum practical range is about 10 miles. A n y quality F M receiver will receive the signal CIRCUIT TESTING The TELECORDER Is not difficult to test. Yo u do not need anyone t o call you for the preliminary tests. Y o u can dial yourself using your own phone. D i a l your number. When ringing commences, hang-up. Y o u r phone should ring as i f you were called by someone else. T h e Central Office doesn't know the difference. B y. picking up the handpiece, you can talk t o any phone extension. Because the TELECORDER is ultra-high input impedance, you can test and use I t without, any fear of being electronically detected by Ma Bell or any-. one else. TIPS AND SUGGESTIONS 2) W e purposely designed the TELECORDER t o provide all the desired features with the greatest simplicity o f design. Commonly available components were selected. Substitutions of equivalent devices can be made. Components should be readily available from Radio Shack, other retail electronic stores, and ads i n t h e various electronics/computer magazines. A l t h o u g h w e prefer t o wire prototype circuits using point-to-point wiring on flea ;lips and pert. board because wir. ing changes are much more easily made, you might want to finalize your design on a P C board for greater compactness and less noise. 111 3) Component quality i s important - particulary when i t comes to noise figure. A l l input resistors should be metal o x ide types - never carbon! Capacitors should be quality tanta. lum or mylar (except for the 1,500 uf electrolytic power supply f i l t e r capacitor). E i t h e r operate the TELECORDER from a battery, or provide a t least 1,500 uf of filter capacitance. The best quality CMOS components are RCA. 4) Since the FET inputs are ultra-high impedance, be careful to keep. great distance between input leads and A C power (either internal- or external) and oscillator and output sections. I n p u t leads should be of the shortest lengths possible. The input FETs should also be separately shielded within the circuit box, and liberally use ground planes. U s e sound wiring techniques. A l l external signal leads should either be shield:ed (preferred) or twisted pair. 5) The choice of recorder and cassette tape are also critical. The Realistic (Radio Shack) CTR-40 recorder chosen was of a handy size, but did not impress us as high quality. B e sure Ithat your recorder has an Aux. Input, a Remote Input, and either a sound-level LED or meter (preferred). K e e p the tape heads cleaned. T h e cassette tape should be of the best quality you can buy. 6) B y using sound wiring practices, and top quality electronic components, recorder and tape, and b y keeping Input leads away from stray A C sources, you can make excellent recordings. I f not, noise level can be so high that the resultant quality is very poor. I n fact, quality can become so poor that you may not be able t o pick up soft voices. Remember that the ;signal has to be picked off o f the usually noisy phone lines, and then processed by the TELECORDER •circuitry, the r e corder circuitry and tape heads. REVENT PHONE EAVESDROPPING Although there are many ways to tap/bug a phone, there are only three methods o f obtaining the purfoinecl conversations: 1) Over the phone lines. 2 ) UsIng an RF transmitter/receiver. 3 ) A hard-wired recorder or headset. To ferret out all taps and bugs on a regular basis is an expensive, time-consuming and uncertain proposition. Circuits u s ing the type of ultra-high impedance Input used by the TELECORDER and non-electrical taps (ex: inductive) can only be revealed by physical discovery. W e f e e l that a better a p proach is t o prevent the transmission of the stolen information. T h e Steps described b e r o v - Ti v d r i l m o s t phone leaks, but can be circumvented by Ma Bell, police agencies and topof-the-line detectives: 1) Use the TELECORDER t o monitor t h e lines so that you can immediately detect the presence of an active infinity bug or other tap/bug that uses the phone lines for transmission. 2) Place t h e telephone inside o f a fine mesh hardware cloth booth securely grounded t o a coldwater pipe. F o r cosmetic purposes, the booth can be surrounded by plastic, fiberglass or wood. T h i s eliminates R F transmissions from bugs/ taps located inside the phone. O t h e r methods include locking the phone up in a safe when not in use, ands epoxing the chassis screws and screw caps after thoroughly inspecting the phone's innards. A f i f t y dollar phone is a small price to pay to protect millions of dollars of information. 3) Rewire the phone so that i t runs In visible metal conduit as far as you can, and frequently inspect these runs for physical invasions. Eliminate all extensions. Test the Shriek Circuit t o the bare minimum. J u s t enough to tune i t for optimum output. Consumertronics Co. Once testing is completed, you are ready t o put your TELECORDER to work for you. 2011 CRESCENT DR., P. O. CALVE 537, ALAMOGORDO, NM 88310 I p. 3 L E G A L I T I E S +Vdd * . 4 b ° I/2 Connector Block 0.1 uf 2N4338 10 M (34) .1" ='.ED 4 1 22 uf 1 0 K - 60 VDC (On Hook) VDC (Off Hoo Twisted — Pair LK 12" MM. TO PHONE o r, CONNECTOR T . 300 ohm t T1 ui ',NDARD 3NE P L U G 100 uf . 2N4391 Or Equivalent N-Channel FET. R I Must Be Adjusted. • I;gakx - 230 K 13-Turn Pot. Tuned So That Vs • 0.63•Vdd. - 300 K Potentiometer Turned Until !Output is Shariest ohm-3-ohm Audio (Speaker) Transformer, 10 dAild1n.) • 120 VAC Step-Down Power Transformer, 30 mA (Min.). Secondary Voltage According to Selected 78XX. (1) 5 0.01 Recorder . A C Power C o n n e c t o r SHRIEK . 1 0 1 GENERATOR 'TELEPHONE RECORDER I N T E R FACE I S SOLD FOR EDUCATIONAL PURPOSES ONLY. T h e legality of using the TELECORDER is questionable to the best of our layman's :knowledge. A s long as you use the TELECORDER t o record a phone 'conversation i n which you a r e one 12" MIA. 'party, i t ' s probably l e g a l e v e n though the law seems to require one to send a beep down the lines every 15 seconds to notify all other parties :that their conversation is being r e corded. However, unless you have a court order or work for Ma Bell, you cannot legally record phone conversations to which you are not a party - even if you own the phone and one of t h e other parties is your minor MINI-PHONE child or spouse! This provision seems PLUG - to be satisfied by simply informing those who use your phones that their. TO R E C O R D E R phone conversations a r e subject t o AUX. INPUT being recorded by you whenever you feel required to do so. id 1.0 Amp ON/OFF SwitCh 100 K 1N4001 1 . 0 , 10 Watt XX O k - 13 78XX 10 of 120 V A C 1N4001 +Vdd • • I g o ul (Mim) • 4011. Every reasonable attempt i s made to provide complete and accurate information; C O N S U M E R T R O N I C S CO. is not liable for any errors or omissions found herein. I f you find any e r r o r s o r omissions, p l e a s e write us. I f substantial, or you provide us substantial new information ,we publish in the future, we will pay 'you cash and-or provide you a byline in the next edition. Sorry, we do not have sufficient staff to provide individual advice. Although t h e Carterphone Supreme Court decision indicates t h a t y o u can legally attach anything you want to your own phone lines as long as i t does not Interfere with communications o r the operation of the phone company, f o r years, Ma Bell required folks to pay for special interfacing equipment to do so (even though they didn't use this same interfacing equipment on their same-designe6equiPment). 1The Shriek option is probably illegal. It I s Y O U R decision wheribi t o use it. W e would use it ;only as a last resort FigUre 2: Basic TELECORDER with Shriek Circuit and Power Supply. - only when the p o lice a n d M a B e l l can't o r won't stop 11 Figuie 3: Automatic (Auto.) Feature the offensive calls after we've repeat(Off-Hook Detector and Recorder Switcher). uf edly complained t o +13 VDC I ;them - or t o punish :an I n t r u d e r u s i n g Vdd -Astable /01,4 an I n f i n i t y b u g . 1.5 K 1.15accap".°144t The Shriek option C134.007 22 2 N 4 3 9 1 :clearly h a s I l l e g a l Red Multlylbrater Twisted Pair japplications. F o r 2N2222A lexantple, s o m e Ritrig; z • Vo l t Vz • 3 'toadc1one has been To Phan RC hassling you at your Una 10 IA 12 K +Trig. I work, o r a bill col' M u m m a oruts C Ilectory o r a n e x -11 ;something or anothNCurEN Vs v o l t er. O n e could call out. !him/her u p about NCOmi 340 A M . T h e n Ksiabli•GevE-•tteset • I mumble something 1/2 eosenector 9 1 _ !over t h e phone -to B1odc 2/0391. 1144001 • j get h i m / h e r t o •Connector Block 2N2222A •. ;press t h e receiver •• O F 11 - - • -- S W 1 ■ Auto. Feature Select. tightly t o t h e e a r. OFF-HOOK DETECTIEW CIRCUIT • Activation o f t h e D E L A Y - C I R C U I T ( I ) _Auto. Fcatrro ON. 1 sea 4 Time " sec". ( 2 ) Auto. Feature Bypassed. Shriek C i r c u i t :should t h e n p r o duce a sharp, stab!Figure 4: R F Transmitter with Audio Amplifier Stages. !bing 'pain In the ear. SW1 a Auto Feature Select. (1) ' Auto. Feature ON. ( 2 ) A u t o . Feature Bypassed. ••••• POWER sp.m.y. of - .47 ul , 1 0 K I o r 20 K .47 uf Isolation Transformer To Phone Lincs . T o Recorder Mike Input • OWN LI and L i are lightly wound, 1/4' cuZ, n o = m e t e d W i r e l f LI 7 turns for 150 MHz, Of 9 turns for 100 MHz. L2 • O turns for 130 MHz, .or .5 turns for 100•14111g. ;Figure 5 : T y p i c a l C r u d e Commercially Available . Te l e p h o n e R e c o r d e r I n t e r f a c e . TELEPHONERECORBERINTERFA -I Figure 7: C i r c u i t Diagram of a 500-Type Telephone. t TELEPHONE LINE BASIC TELEPHONY Uwe Cora PI • TAPE EECORtilteAG POWER ROOT P2 • TAPE RECORDER PLUG Pksaval Imo TELEGORDER b Auto..Piatira F i g u r e Is not & m a w ; a t e Into yral3 main. P3 • PHONE LINZ PLUG 1.4 • PHONE PLUG PaOss retzooctoex S e l e PI • AUX. p a w TO TAPE RECORDER. ILINLPHortE PLUG Pr . REMOTE, W H I T TO TAPE RECORDER, SUM-61241 PHONE PLUG loculkd yeti tl Auto. Amuse b 6 : c •• r n y s i c a l t e d L a y o u t 4 rte. D E T E C T I N G j BUGS ec TAPS ..nany years ago, one could easily detect a phone tap/bug by listening to strange clicks. S o m e phone taps/bugs were even so crude that. they tripped the 40 ma relay at the Central Office, causing Ma Bell service personnel t o rush to the incriminating site. Others required that the tap/bug had t o be constantly personally monitored. Except in T V thrillers, B movies, comic books and with some cheap detectives, these crude types of taps/bugs no longer exist. Today's taps and bugs cannot even b e detected using sophisticated electronic techniques, not to mention audio observation. The following are effective procedures for ferreting out almost all taps and bugs. i t is best to first run these tests on the system after careful and detailed physical inspection is made t o assure that the system is free of taps and bugs. T h e n , periodically retest the phone system. E v e n minor changes can detect the presence of taps/bugs. Always record all test results: 1) TESTS DONE WITH THE PHONE LINES DISCONNECTED AT THE U R G E PROTECTOR (A) OPEN-CIRCUIT: A n ohm meter I s placed across the open-circuited r e d and green lines. Resistance should measure a t least 1 Meg. ohm. I f resistance Is less,Than 1 Meg. ohm, or the m e ter's needle bounces around o r drifts- z-wly upward (capacitativ charge-up characteristic), a parallel tap/bug ug Is Indicated. e (B) SHORT-CIRCUIT: P l a c e a temporary jumper across the, phone lines at the surge protector disconnect site. Measure the resls-1 tance across the red and green lines a t the most distant phone. The, resistance should be 1 - 2 ohms. I f resistance is higher, than a series' l a p / b u g or d r o u t relay is indicated. (C) A U D I O GENERATOR: T h i s test Is done with the phone lines open-circuited. A n audio frequency generator is connected to the lines through a series 22 K ohm resistor. A dual-trace oscilloscope is hooked-up with one input across the phone lines, and Its oth-' er input across the audio generator. O n e trace on the CRT is placed over the other. T h e audio generator is then slowly swept between about 10 H z and 50 KHz. I f any notching or peaking effect different than your original clean test of the circuit is noticed - even a minor change - the presence of a tap/bug is indicated. n TEST D O N E W I T H T H E P H O N E CIRCUITS N O R M A L LY HOOKED-UP: (A) Place a high-impedance voltmeter across t h e red and green lines. - If the voltage-drops to 5 - 6 volts while the phone- and all o f its extensions are hung-up, an infinity bug or similar type d e vice is indicated. i x (B) I f the phones are hung-up and the voltage is less than the 48 volts or so expected for your area, a parallel tap/bug is indicated. (C) I f a phone Is off-hook, and the voltage is higher than the expected 5 - 6 volts, a series tap/bug is indicated. (D) Phone your test phone sometime when you know no one will be there t o answer I t (or tell them not t o answer It). U s e an audio generator with an automatic sweep from about 20 H z to 20 KHz. Acoustically couple your audio generator to the phone you use to place the call. I f the ringing of your test phone inexplicable stops at any frequency, an infinity bug Is Indicated-. M o s t modern Infinity bugs are dual-frequency turn-ON and single- or dual-frequency turnOFF. D u a l -frequency bugs can't be detected with this test. S t i l l more sophisticated Infinity bugs require an encoded signal for activation. 3) MICROPHONE TEST: Remove the mike from the phone. I n spect i t . I f i t appears to be unduly thick or heavy, is soldered, or; does n o t m a k e a sound when you shake i t (carbon granules), I t is pro- bably one o f the popular drop-in mike buns that has a built-in RFC transmitter. N o w t e s t the m i k e terminals in t h e handpiece, pressing: down o n t h e hookswitch. A n y voltage indicates some sort o f hook-, switch bypass device in operation. TarPtinu prrnpnr6TMTPETAIT 13_ It Figure 1 is a schematic of a Type-500 Telephone - one of the most common telephone in use, and comes in various configurations. Sound is picked-up by the microphone (transmitter) In the handpiece. A small amount of this sound is fed back Into the earphone (receiver) to provide the live sound of the phone., The rest- of -the sound-energy is-sent-down-the phone-linesto-the'party you are phoning. This sound is amplified on the way at the phone company Central O f fice and by line repeaters. N o amplification occurs in the phone itself. RVI (varistor) is used to suppress dial pulse clicks so they are not fed into the receiver. RV 2 , C2, C3, R2 and the windings of the Induction coil form a h y brid arrangement that provides simultaneous two-way operation over a twowire circuit. C I and R I compose the dial pulse filter to suppress high-frequency interference to nearby radios and TVs. R I , RV2 and RV3 also serve to reduce the efficiency of the transmitter on short loops from the central o f fice t o provide satisfactory transmission volume. A l l components marked with an asterisk (19 are located within the Telco network blodc located inside ITT, Western Electric and other phones (in still other phones, these components are on a PC board). Most phones require three wires - red, green and yellow. I n some phones, the green and yellow lines are jumpered together. T h e red and yellow wires make the phone ring. A 60 - 90 volt 20 ltz signal is applied to the ringer (two coils in series with a capacitor C4); C 4 and these coils are designeso that . once the phone starts to ring, it continues to ring while drawing very little current. Although the ringer is connected to the phone lines at all times, the rest of the phone is only connected when the handpiece Is lifted off of the hookswitch. M a Bell can determine how many phones you have on-line by either silently measuring the capacitance o f t h e lines o r the amount of current drawn during ringing. T h e specific impedance value of each ringer depends upon the phone used, but i t i s In the 1 Meg ohm range at 20 Hz resonance (measured at the Central Office). If one were to tap the phone lines using a typical, commercially-available r e corder interface or other tap/bug, Ma Bell (arid thus the police) could easily electronically detect the foreign device attached to the lines by the substantlally increased line loading. Thus, if you want to keep your business private, you require a device like the TELECORDER with an ultra-high Input impedance (infinite DC resistance, 30+ Meg ohm AC). The TELECORDER is virtually undetectable electronically even -If the lines are rung out with all of the phones and Central Office disconnected, using the most sophisticated equipment available! I t s impedance is so extremely high that it is In the range of normal line leakage. T h e TELECORDER Is also virtually 1ndestructable i f some neanderthal tries to clear the lines with power pulses. When the handpiece is lifted off of the hookswitch, switches SI and 52 close while 53 opehs. Ciosing.51 and S2 places the remainder of the phone Into the circuit. I t ' s impedance is 600 - 900 ohms. T h e 48 - 60 volts across the lines immediately drops to 5 - 6 volts. To dial a phone number 'using a rotary dial, the lines must be interrupted (opened and closed) at a repetition rate of 10 pulses/sec. D I is located in the back of the phone dial, and is used to produce these pulses. I f the number 4 is dialed, Dl will open and close four times. During this entire interval, D2 r e mains closed so that the dial clicks are not fed back into the receiver. I n ; fact, D2 remains closed during any duration that the rotary dial is away from its home position. F o r tone phones, the dial tones (two for each button) are sent down the lines, and detected at the Central Office. To n e phones have a drop-in block consisting of the pushbuttons and the contacts that are closed when they are pushed. REFERENCES' I ) TELEPHONE ACCESSORIES YOU CAND BUILD, and MORE TELEPHONE ACCESSOCIES YOU CAN BUILD, Ades Glider, Hayden, 1976 ard 1960. Wa h l , M a n y excellent d , t i and Ideas. 2) T A P NEWSLETTER, Technical Action Party, 1971 - 1 % 4 . N o 1 ogler avaltaate,jahlIshed or In birdnem. T H E AUTHORITY o n tcdrological misddel - particularly t h e terms, "'Phone Phreak," and 24a Beth is a Cheap H o t t e r. ° Detailed information on Red, Blue Blade, etc. phone boxes. Available en/y I r a n (11•ONSUMERTROKICS 0 0 . , P. O. Drawer 337. Alamogordii, N M 111310, $2 pee back issue. S o r y, rsa W a x % imallable. 3) C O M M = TROICKS CO., P. O. Drawer 337, Alamogordo, NM 112310. SUPER-SISRITIAL CATALOG only 31. 6 1 4 technical survival publicatkos on r e g r e t s . energy, phones (TONE DEAF) computers, eiec& m i c a Unwicial, medical. etc. - all bard-hitting - some controveralal 4) e n = TELEPHONE SWTTCRING SYSTEMS, B u t e CARRIER TELEPHONY, and BASIC ELECTRONIC SWITCNING FOR TELEPHONE SYSTEMS, David Talley, Hayden, 1 % 9 , 1977, 1%5. Excellent primers on telephone macrosysterra but muds ed the Information is riat, 5) l i m y fine how-to-do books are available on electronic strvelliance from MENTOR PUBLICATIONS, 133-33 Ho. :wed., Fl N Y 11334.-p feaa taleq.), arid LOOMPANICS UNLUAITED, P. O . Box 1197, Port To m eerd, T I M r . - 6 1 • hly recommended a r e (A) V B I G U lea F _Scott F4. P N O R IG B E H T 1976(B) ELECTRONIC SPYING and I t s accompanying PORTFOLIO O F SCHEMATIC DIAGRAMS FOR ELECTRONIC SURVEILLANCE DEVICES, MENTOR. 1979. (C) WIRETAPPING A N D ELECTRONIC SURVEILLANCE, National Commission For The Review of Federal and State Lows Relatkg to Vlretappineaand Electronic Surveillance. 1936. • B U G S & PL E C T R O N I C I R D E S E R T PUBLICATIONS, 1976. METHODS OP ELECTRONIC AUDIO SURVEILLANCE, David A. Pollock, Thomas, 1979. HOW T O AV O I D ELE.CTRONIC EAVESDROPPING A N D P R I VA C Y INVASION, William W . Turner. Inrestbsttors information Serviee. 1972. HE V E HIM 1 5 1 5 II 22111 2 MEI I _ M 5 N W N O N I M O N I S M I = M I DISGUISE I NM W S W M $ NEI 1 M E I I n B I M N M I O N W S 5 IN Copyright ®1981, JOHN.,t. WO.LIAMS.8m.FAMILY — ABSOLUTELY ALL RIGHTS RESERVED BY; .10Ht4.): W11.LEAMS,' _ • . S O L D .PQR EDUCATIONAL f-URPOSES.4.:0‘,ILY C O N S U M E R T R C N T C S - C O . - D R AV 4 I F P ' , 53:7„kqrave,r,.:!v, . 5 1 0 MetTS T.743.gp; i}1 ,7)11 A l i . m c I , n , g name ! • L ; t I • .• , ••-r:ifL r i p -I -an - • n t • • • •-.4. • • • _ - • . e 7 . : ( a r t e v t - q = A 5 ; • s u r, , . . . . 7 One b e l h z 11,.6xci i n a, cone, t h i s df.t.Vicf,' ma 1)=71,7-11,-.-ularl?; SS. L.e . p a r t y 4/: n' a s e z • THEVOICE DISGUISER SOLD FOR EDUCATIONAL PURPOSES ONLY P . 2 • B. PARTIALLY OVERCOME WITH THE VOICE DISGUISER 1. 12,P,4L,„afial 'ies c o n s i s t e n t o i : v e r y thg--s-uspect. . . c , t e r i v A r : s t 9 - t h e p o i n t 01 c 2. the. he3. O f Acc.L, ind o f s. ently when t h e y s p e a k . T h e i n v e s t i g a t o r o r e x p e r t w i t n e s s identi- -in r e c o r d e d u t t e r a n c e s .and. compares them t o the s p e e c h p a t d i s t o r t pause c h a r tends _co clisguiF-..c ;LTOthr-.r the acct.nt •?: t h e sarn-z. e-.tene as --,ccents. OVERCOME WITH THE VOICE. ':;:::5GUIS'a, the cy,vner of. a Vof-:e., t ' . o u g h t h e one tt: .14:2pwifjp•reo, ?-,N 08:WY 2N2222A. - SI)caite.r 300 600ohm; 1 .22'72A 42907A 2N4391 e) V4 WAIT iBOTTOM I . RE: UMW( OUTPUTS WU 2144391FET DISCONNECTED 6-4 A l f 9a DA.1:151.11 V i i t e r C o n c e p t . 0 3 1 3000 7 9 4 ; 0 0 0 )2,59 Z.5.$5 1 9 9 5 2.!i12 3 1 6 2 3 9 8 1 k I Z ÷ SHE VOICE DISGUISER S O L D FOR EDUCATIONAL PURPOSES ONLY P . 3 ith a c a l l a n d t h e e l e c t r o n i c v o i c e d i s g u i s e r d o e s n o t h a v e r a n d o m , u n p r e d i c a t a b l e and u n r e p e a t a b l e u a l i t i e s , t h e e x p e r t c a n r e c o n s t r u c t t h e v o i c e p r i n t b y p e r f o r m i n g t h e i n v e r s e o f the t r a n s f e r f u n c t i o n ' t h e v o i c e d i s g u i s e r . A c t u a l l y , p h o n e c i r c u i t s a n d tape r e c o r d i n g s a r e , t o some e x t e n t , e l e c t r o n i c 'rice d i s g U i . s e r i w i t h s o r a n d o m n e s s t h a t t h e y c a n be o v e r c o m e b y a n a l y s i s ( i n t h e o r y ) . • 'CiOitkieZPTS • - A , DUAL FUSER. CONCEPT E S s e l l i t i a l l y, t h i s c i r c l . d t c o n s i s t s o f t w o wideba:)6 l i l t e r s o f Q (c•entor f r e q . / I 3 W ) o f about 0 . 4 5 outPUtsarei•Mixed i n v a r i o u s .-;:onibinations. Q u i e s c e n t c u r r e n t f o r i t (and t h e n e x t d e s i g n ) i s :-.t.,•out 400 u A . S e e : F i g u r e 1. F r e q u e n c y plots a r e g i v e n . N O t i c e , t h a t nr: r1?7ii1er wh.-,it f i l t e r ( A o r B ) i s with I Tc q u e n c y, s . g_ f r c c ; . . t e n c y c o n t e n t e x i s t s and : yen tnoc.,,,sli f i l t c . r rf.o. a l l ..reqkienc--le-3. F f _any cri.-,q;_,f,3-1•:.::7 compoite.nt w e r e f i l t e r e d t o l e s s t h a n 1% o f itE i n p u t , i t w o u l d give used,' arict i f ()tie w n - t h e ctnly pe.rson known t o thal , . • e i • very , t i , e F, s e ! , i n g o f a n y i r e -.t‘re •?, c 1 5 : : c . i u i S c ' i t h a t ` 7 -.:d : r c :,uetCycoi.-3noriert'c.o-.,1c11-ie L r ?F a r t ` • _1 m i x i i s . : e .21 the t w o Landisas-s f i l t c - r s r s . r. -,, • 1,?,,€ ;"!, r J.1_•":. ' 1 : 2 ; a r ) O to I 1.1:2:), o f f).i•Pate f o r 1 ) s w i t c h s e t t i n g : a r, d . u?..gain p o t . i s -,--•-r,r--22 t h a t tr.). 1 . 1 . 0 VC i ' is i,r4t.i„aitly , " D h • Ei S , • . . 2 .• . . • 7_:1 t i -le r . . . . , ' D p e d - - - p f i f . . • and. thc.f r •r r e• . . i , b u t _r ; f r o m tso, o n e -ca.7:. be-th I 6ANDPASS.4DAZIP)) FILTER coNcePT it ; 1 rained . s t y l i c i t s e t t i n g s . ^ tArt: 1 9 8 s -many 'Ofb.er 2 circUitryAna,.4, t . l td pas: siVe _ i l l ' a • D r i 7:• j Qf t h e :2-st M i t e r - r e f e r p p e O s arourt4 i s , i Mc(,:;rw F i l t e r ttrair ) t - —e o f tne - 6 c - A t 3 t ) : 4 7 . 3 •CI `1.-L12 . , . • ) • - • 1AEYOKEDISGUISER + SOLD FOR EDUCATIONAL PURPOSES ONLY 4 11 —1-1 ) ' . - . I DIP - '-?/-'1ll ' . > 1 0 K i s, 10K A 7 K 1M I=40Ki T - - - \, .eA.,. - - Care.16n ___..... ' 3 + V !, . 1 _ t'..,.... 4 . r 1: 1 . r i - ‘ ' r " 11 " . •• . -4 1 i,.,...% " . ' .4. . . ,° •/• , . / 1 . . . I . . r . T Ai . t LrK ',..127K , , ''r. 0. '..c,+itS- i''''"-------.----1 I ISK t a i ti f , '.22u,, ! . -7. ; kit 7,x: 1 .. - 1 2 r , „ , „.,.............,,......4 i i ' . an ' 1 . ' f 4 L I j'''' i s ' ' . --C 1-7.-- .- „.... ''''',,., p i - - ,4,:!,,- ,.,-.: 4./ ts k l p . ---:*--!00,,,,..e-...4.,:.,;(1# f i , • ;. • ; . r: z >vi.," r,,, r A --tz ..,. .i..., ,,,,..... - • ,.3 --.K..- : 4 1 . P i T . .."%ii, ; • 4 • CAP f w tr .-- • 2. ,n KSilcs +4.• IRTA!..-,CIST'AS• .• :" • EVCKE 1";ISGUISER SOLD FOR EDUCATIONAL PURPOSES ONLY P . 6 • C. THE DELAY LINE CONCEPT T h i s method u s e s t h e R e t i c o n D u a l A n a l o g D e l a y L i n e ( S A D - 1 0 2 4 A ) t o p r o d u c e a n a d j u s t a b l e p h a s e / .-ir f l a n g e r ( v a r i a b l e c o m b f i l t e r ) . T h i s v e r y e x c i t i n g a p p r o a c h i s a l s o v e r y s o p h i s t i c a t e d arid may be f.-.00 c o m p l e x f o r many e x p e r i m e n t e r s . S A D - 1 0 2 4 A s c a n be obtained f r o m R a d i o S h a c k f o r about $ 1 2 , acr.-oti-iparied b y instri.......tioni-: a n d .7.--.petiEications.- O r . e rrtight a s k R E T I C O N (345 P o t r e r o A v e . , S u n n y - . ,iali-2., C A 94:186,..408-73R-42()6) f o r S A D - 1 0 2 4 A applicat-icn n o t e s ( N o . 1 0 9 , 1 ( . , A , 11 9 , 11 2 and e s p e c a l l y 11 3 ) . - F o r a b o u t $ 3 5 , t h e y ..vill s e l l y o u a n excelltr-:, - - - i l u a t i o n b o a r d f:.',7,- i t . T h e p a r t i c u l a r c i r Uit ti.:-..,-,- -,' "L".....-e. i n m i n d i s w e l l L-1.:,-.3cribed i n -Radio S h a c k ' s ::_-;:',IGINEERS N O T E E . G O K , p p . 4 4 - 4 3 , about. 2.5Q. 1:-..-,., 7. s:rying t:ne o s c i l l a t c r ' s 11',.I .7:11--ri p o t , I t s frec,...,- ,: 1 3 changecl, t h e r e b y c h a n g i n g the comb :*ter nc,-che5. A -.--‘.,,---37:-ril r o -i-.:-..t.-7:med I; FT:7 c:ar be pl:_-1,-.:J:r.--.- : - a l l e l t o t h i s p o t . t o p r o v i d e an a u t o r n a c ...oniiione,t 7.-.-....;: .... •:.-:.-.,:... . . . . . , , , , , 1 7 '2 1 ` . . 1 € r C y .-3:', ' i.;111 i s a f f e c t e d . ';),7 advaria9...:3 ' - c d ;:•-• - o a t ,-,r,c:-. , ' . , . a r e s e t , v a r y i n g t h o :-..si:11.ritor p o t . Crial : -: . . . . , 7 L t i -w 1.7" : - . . a , t i , 3 . r a , . n e s s . i ' s EF./E2.74 pr6se.7-v-ed e.-.,,en ..:1-, :-: , - - - , ' . , t i : : " . . . , : i •7tL . Thr.disadvr-nt;--czes'are i t s i-:neat :ow:x.1:: N h i l l . IAT,4flua;,,vi) tt ..._.4,1F-40t,„Eett, VALUES A N D :.",.-,..,:,',-;,•''.(.F..eliS ::- i r. . a . - - e . i p t i i I ' I c . ILI.,.:_, ,.,:,?:-.p.,..-.e-7,f1-zi.-,t..--T ripp,..id-roff'- posS.ibly leadir," -, -., :.,-.:...;-',47.: L-•;:-,,,,,.--. ::. ,..::-..-!:,2-r-,:.:...f-„ ng-s..i .y...0tu Filo.uld•a1,7,ii.e.ys r...irii, : 1.:ie F:t air,iping . . , yot.iri-.-ieci,.!7:11..0 , „rupori.... ,.. ._.. ,.. :•_,:l..: I, - ,.,....., 0.- ,..1c_.:Iii. inne3teve. a v a i l ab,lki; i p r e f . . . - i n e sent-lpiape-r.:Or f i l e . T h e sqhe..274tric f t h i y lic.at,.,:.1-:);:-..ay .;:ist-) L-.I...:-.J. ,i..,:',3 -',7e7,--.:1-::-...-t s and Jn r)...,s,,1.--- '..ti):4 0:W:;T, .,,• ..e th(,. ,:' .-......r. /".ale's .1;.1.,iAf shown;.,.: ,b.!-It.• 0a .Lc.01341-,.., e.-..-. ...-ily 1. 49:0„fipt?,01.-.4.:.- aC.-teri":,ti.c.:s.', I t ' ; t i .--vt...,""Er-ikeio14.1 eftti-kt.t0 des71,i.gy ::'...7:3e-... . . . yliyi-:,-,:',.. a t 0 1ti6T11 17;11 10::+SeS1fp.ikfUelCtitS:ti. 1-':'fflAiii: Uilia."_441::;V *ice. Dirs,iuise r. , , - I r i s , , , : : : i ! - ' . ) ' : : r . ' . ..,..'. :JlZ'— fail1-..t ;7...‘11.1fe • A h o , .e,;:.1,-.-.1id -17 , ' C S . _;Ii,--S 4 iiikt4--,..„..' t . , . e 71.0.,.. 41c,r.-.bt.'o--c 4,:-.111,•i..-41- eai. e%jt....-.'t.•.-;,' . .. i n ••.',- . 1 . _ 6 q .,, * , t p s . - A r k l ,4t, 0 . W i t . , 4411f.).1.11C :04 ::40,1t,b,. ni0h,frequertefte,. o. r i p .d s i -. ,t e. . ,. i i r i t - i f t::17 1-'r:i" ';:1.:::1?....,. . . . . _ . . . .:i_ ...ilx.Oe9;;;, ...01--.114- i t c Eyridy:. voi.cr.S. 4f-rerAt414t2 r 4-roliii,e.s. s " - - , . -ild±-ft._.€2c.i..?-an,:y --.1.ii,:-.: ,,-i-e'.:...est ....rt-..plii. . . t i : ,-1-tilltki.-- t!ile high a i d Iptk ifeelite.01-7,,y en&s O f t-Otte-te i ' - - , ' , a p p t i c a t i o r i s . t h e .-vivs,-:-. o.f.. s ;..ii-6!7,i'aiiii.)1e,IVil-e76-i4.i,:b1r-', e . . ! :._A n i p t ,..:, .... IL,: ,...k:2,..1, ..1iiF: Ile r, a p l - i ; s jci t i1d i . 6I 6 l e c l ','-'-r -, 071. '..'.likiP.,.iii 'C flt;:440', tud1..4verif.,1.0,..v„,**-id'$41P.'fifif6b.lioli sb01.11-1 " . '.-ii..-' ,:::-.:..-. 7rePuenc7,-.:-_,... . .. t ...IF:sr.:Dive piirf;i:36rci e ; p o x ' y, ' e t c c u i c k l y 1 ) P c . m e s a r t t p l i n it) m g e 2 . . . . r i t s t t C l f f R i . : : f D r a k t l f t t h a• t ' P ‘ . . ' ito 1,1114 012 xCli-1C,' PHONI A S i r c u k t t i , fikT. 7 : i g o t t i ' t t h s ./8tPe-,- a r i d s j c u r i t y reasonY hi6444IttiffTig, t o b m i : c f , 5 p i l i . - t r e i s p c a l - - . e r a s s e m b l y ••• ;`OfitiTRA.14:1;0*4 A N D U S A C I E H I N T S i c a r v. t r u c t e d znci packaged t h e 'Voice Dis..,ci,iitser . . , • th.e. i - 7 1 y , R a T e d t h a t asseinbisy , t r o i l i a 0 f • a l t d . 3 7 g 3 s A s I t s : J e d ' , . t r e - . ;...1Secl-E, ed :ru,bber'seclions s ' c p . a r a t e the m i c 1.3''Prn th'e titheL bottbra re.diice Muff:lit-1=J f o r 1 1 ts r. b s ; 3 1 . 1 - f i t•S.ki.re..proi,Ided t o attac-n 'the r u t : ' . e} • , u i l t i ' 1 n' .414rcly,T-.----:cnovini:i f.014r" 7,tie p 4 1 r ; l a s'ed ; ,•tsacc:, *rane."-tv.1•0',f,f5. 6 4 4 47'4 ' b ) 1 4 • - ; iti *it Tt .00 r••• " v arlAt• k t o i A 4 b6-'1.=;:gt ; ! F : r i C ) U 9 l`q•911. • . ' c i t i o . P . use,r m c v t g . . " to i n . • s b ,,n s., ' 'sg-triser t e . used i.41- i.e.ver se t k . . 1 ? e , 3s , c i V e r ,r,eaF;:er."ar • V't tilt g:, SEA '4.71 ar:',76.1,),--the :t....ec,,'eilied vOlce ikhilea-:ter..iatinglyolse. components •.A.7.1'.!..i-,-,_.T.frii, < , 11.1t.'10,..:, t.13ra,31.,.:.d'it .!;.$-1,,tht. c 041-).ei-..1 or s'...f. -Chose-,' tE:St po.int ,Or tip: ty-00,,pr1g 3 a rcl jacics.,, .. tte;...rea.sti h i , tit:. sic': •-..1;,64:,-';1i-i-4cL.-r mirii41-.-one connffe --iior , 5 iiia- t I.I'tor.tini:-pl;oite .jacit. interce.-;.:d'etl,,h i i i t (?...174-ci.A.fgi,friSi•-•calerrftob7,.•i'se).•••:sin oIturtal,::.,1y, t h e -recetvez sp,..:akern-i4totit (.=1 E and West( rn, .. 1,*-t-r`is vlit..yrk'S.:.`.:.:;3,iili,:-.-k art,d,tri,;g‹.-.,: e ''Z'.rrilitIg:A,...): f i t i n v r 't,l-i3t1.1"-211" P V C 4d-a'rptoi- i'Lltiiii17-e'ci, :t7tiery t i g l i - , - t . e : F:,n. wit 11 91:) -;'k.,t10( s. . : Tizi !.:.:.--i.4d2 ,st (it -i s: 2 . 1 2 5 " : l o n g : - sir:Oiling 1,--:,n-,?,:ii..- ;.s s e l f - d e L - a t i n , 1 becausethe.n -,(--7,,i- ,-,.(7.:;.:•',) ..11).-:',..-n't _ i:7T i lv C,"?: , i ; : l t i i tife VOIC,.:' ')U--cui:-..,--r . A n -.,i1-:-.1a1,.v.a. i s tr. t i s ? r-linc-- .7,:ni-o{1/...-nf: --.01;70..e-tr/r, . i t .c-i1.1,,,,,. sr,r...--, Ytt,,,:,s...-. :,'.7 S hot I ,-..-- .;.,i re t o h . 1 : , , , i 2 : . i . . , i , 3 1 ' : . `16.--i77,-., ..-,177„-,,t.:nd, THEYOKE DISGUISER P. 7 SOLD FOR EDUCATIONAL PURPOSES ONLY X. APPENDIX A. W H Y VOICEPRINT A N A LY S I S A N D TAFERECORDINGS S H O U L D NEVER BE USED A S EVIDENCE •• V t i c e p r i n t s s h o u l d n e v e r be. Used a s e v i d e n c e ! S o m e c o u r t s t r i s t s s w e a r t b a t W a s insa.ne a t t h e t i m e o f the c r i m e , v h i l e t h e :: pbone usc. L t h e c a l l e r i s t h u s d e t e r a i i n d . : f i t i s f r e : n h i s l-,nme, b u s ' . c c , ':,hers he i s _ 'Aw , r e • i ffi r t i l t o • a cc:!: n .0- -.Jo: c?w''017,;z 1st s t"••• L i 3 a 1 , 1 , . e / L t . ,; g o 4.2:364-x Z# t Z,4 Fat . . i?1i.,i91,:t)0474t1t-ij,t1C.N 07=Ftvis.. .-f-y..,h;;:EAt..1,•,frt,, • c , T v o • s t i e t? N t t ! P 4 h • i r , r . 5 h s ^ t 1:4t4 . . 7 ! • , " 4 : 11 f r 5 , : , - 111 ) " " ' ' : A • 4:51 o t / . 1 ere , aztuaL :44;147'8' k bt --1,eLES Art .FLEA R$1.1.TS;-• EA,MS.7.3 Y*0 N e : 11 CAN'T 6.1*001:1WHATfi?%,,A vt..clyACr.c n • i E , . . . 4 4 . ` , : i 0 i 1 0 1 . . 4 7 : t AVA;L;,, ONLY . 1 7 " 7 l e 5 t a : T p a 4)11,m $ Ey, c :"A;;;Tc.a:r. t.0'1"..`W 1 3 : 1 ; 1 ‘ 4 , , ' , . • t, 1 ' 7 , F S -30441.Y iftcomez,-Tta-. -;68 1,er. Th-it":“4riE“E, t a r r:rTE k a N L Y s • . a . '