





                                ==Phrack Inc.==

                    Volume One, Issue Three, Phile 1 of 10



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

%                                                                             %

%                             _  _       _______                              %

%                            | \/ |     / _____/                              %

%                            |_||_|etal/ /hop                                 %

%                            _________/ /                                     %

%                           /__________/                                      %

%                                                                             %

%                              Proudly Presents                               %

%                                                                             %

%                           Phrack Inc. Issue Three                           %

%                                                                             %

%                            Released Feb 1, 1986                             %

%                                                                             %

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%



    The files contained in this issue of Phrack Inc. are as follows:



         1: Index written by Cheap Shades

         2: Rolm systems written by Monty Python

         3: Making shell bombs written by Man-Tooth

         4: Signalling systems around the world by Data Line

         5: Private audience written by Overlord

         6: Fortell systems written by Phantom Phreaker

         7: Eavesdropping written by Circle Lord

         8: Building a Shock Rod written by Circle Lord

         9: Introduction to PBX's written by Knight Lightning

        10: Phreak World News II written by Knight Lightning



    If you have an original file that you would like published in a future

issue of Phrack Inc. Leave E-Mail to Taran King, Knight Lightning, or Myself on

any system that we are on.  If you cannot find us try and contact some member

of Metal Shop to get into touch with us.



                                           Later,

                                              ________________

                                              \Cheap/ \Shades/

                                               \___/   \____/







                                ==Phrack Inc.==

                    Volume One, Issue Three, Phile 2 of 10



    The purpose of this file is to tell you what you would be dealing with if

you stumble across this system, or if you know of a company that is using this

system. It doesn't go into incredible detail, and is lacking in areas. It is

not a guide to hacking into it, just letting you know what you would be dealing

with. This is to pique your interest in the system.



   So What the Hell is ROLM?

   -------------------------

    ROLM is a "Business Communications System" bought by IBM a few months ago,

in an effort to compete effectively with AT&T, and get a larger share of the

market, in a grand master plan to become "Big Daddy Blue" as opposed to "Ma

Bell". It is a very complex system, with features such as PhoneMail, A

Super-PBX, Local Area Networks, Public and Private Data Networks, Desktop

Communications, and Call Management.

    The heart of the system is the Controller, called the CBX <Computerized

Business Exchange>. This controls the entire network accessible through ROLM.

Since 1983, the CBX was redesigned and upgraded to the CBX II. It is a PBX with

much much more <See 'Introduction to PBX's' available on your local bbs> to

offer, and that is ROLM's claim to fame. It is light years ahead of the regular

PBX system.





    The CBX II

    ----------



    The CBX II is the core of the ROLM network. It is computer driven and

expandable from one node, with 165 channels, to 15 nodes providing 11,5200

2-way channels. The smaller business could have a model with a 16 user maximum

limit, but it can go up to 10,000 users, though this would be quite rare <and

quite God Damn expensive!>. It can be accessed from outside lines <like you> as

well as HardWired units, with a switching system to prevent busy signals on a

port. Speed depends on the system in place, either the newer, faster ROLMbus

295, or the older standard ROLMbus 74. <see Service manuals for exact details>

The larger the system, the faster as well. It is adjustable to accept different

bandwidths for the various components, such as Telex, Voice, Data, Mainframe,

LAN, Video <ta-da! Picturefones in reality!>, and anything hooked up to the

system. Similar tasks can be bunched onto one channel as well, at high or low

speeds. If multiplexing is used <above>, the maximum speed is 192,000 bps, and

if using a single interface, the top possible rate is a mindboggling 37,000,000

bps, which if you ask me, if just fluff and not too practical, so they are

usually multiplexed. <Now, what a difference that is from 300 baud!>.  Using

the CBX II network, you might find just about any kind of mainframe, from HP,

to DEC, to VAX, to the IBM 327 series.

   Note : There is a smaller version of this called the VSCBX.





    Phone Mail

    ----------



     This is one of the little beauties of the system, something truly fun to

fuck with. I called ROLM Headquarters in California to ask specific questions

about ROLM, posing as a researcher, and I got the big runaround, transferred

from department to department. Maybe you can get further than I. Their  is

408-986-1000. The  to PhoneMail from the outside is 800-345-7355. A nice

computer-generated voice comes on asking you to enter your Extension number

<which each employee has>, and then enter the "" sign. Then enter your

password. If you make around 3 or 4 bad attempts at an Extension of Password,

it will automatically ring another number, assistance I assume, to find out why

there has been an unsuccessful entry attempt. I haven't played around with this

that much, so leave mail to Monty Python with whatever you find. Once entering

an authorization  with correct password, you will be presented with more

options, leave messages to other people, and whatnot. You can hear your

messages, forward them to another person, leave the same message to more than

one person, change your welcome message, etcetera. The service is for those

business-type pigs who never sit still for one minute, like they are

permanently on speed.



     A Phone Mail Scenario

     ---------------------



     Let's say if Mr. Greed goes out to meet his secretary at a motel, but

definitely has to get that important message from Mr. Rasta, who's bringing in

$3 mil in Flake, and can't trust it to the person who would handle it <ie: the

person filling in for his sec with the tremendous tits who is getting balled by

the dirty old fat man>. Mr. Greed would have given Mr. Rasta his phone  and he

would be forwarded to the Phone Mail network, where he would hear a message

left my Mr. Greed, to anyone who would call. Mr. Rasta would leave his message

and hang up. Then Mr. Greed could call up the 800-345-7355 , punch in his

extension authorization number, and password. Or, if he was back at the office,

he could get it there through DeskTop communications. Messages can be delivered

without error, in the person's own voice, without other people knowing about

it. Therefore, someone with enough knowledge could use an unused account and

use it as his own service, without the knowledge of others.



    DeskTop communications

    ----------------------



     ROLM has developed a Computer/Telephone integrated device for use with the

Desktop communications. It is linked with the CBX II through fone lines, thus

accessible by you and me from the outside. It is not hardwired, though it can

approach hardwired speed. If you could get your hands on one of these

computer/fones then I think you would have found something very useful at home,

in your general life. But you could access the network without the special

features of the fone, like one touch dialing, which is designed for the stupid

lazy businessman. You can access company databases through the network,

mainframes, other people, just about anything as if you were right there and

told your secretary to do it for you. There is special software used by the

computers or computer/fone but it can be improvised and is just an aid. It uses

a special protocol <Don't know what, try to get your hands on one by trashing a

sales office>. What is great is that everything is tied together through

telefone lines, and not RS-232C! Thus, there is an access port....somewhere.

Scan the 's around the office  using ROLM. How do you know if it is using

ROLM one way or the other. Compile a list of local businesses, call them up

saying "This is ROLM Customer Support. We have a report of a complaint in your

CBX II network, let me speak to your supervisor please." If they say "ROLM? CBX

II? We don't use that" then just apologize and go elsewhere. Or say that you

are from ROLM corp and would like to know if the company is interested in using

it to network its system. Like, if they have it already, they would say that

they had it. And if they didn't, you would just give them a fake  <or if

you're nice the  for the local sales office obtainable in the list below>.



    But you know what's REALLY Great? They have made the network link in mind

for the person with a Computer IQ of about 0. Commands are in plain English.

Here is a demonstration screen as seen in their brochure:

           CALL, DISPLAY or MODIFY



           Display groups



           ACCESSIBLE GROUPS:

             [00] PAYROLL       [01] MODEM       [02] IBMHOST

             [03] DOWJONES      [04] DECSYSTM    [05] MIS-SYSTM

             [06] DALLAS        [07] SALES



           CALL, DISPLAY OR MODIFY?

           Call Payroll



           CALLING 7717  <which would be the ID code for the PAYROLL file>

           CALL COMPLETE



           **PAYROLL SYSTEM** <or whatever they want to call it>

            ENTER ACCOUNT CODE:



    See, nothing is confusing, everything pretty self-explanatory. There may be

more than one person wanting to do the same thing you are, so if there is, you

would be put on a queue for the task. It seems that those with an IBM would be

best suited for ROLM hacking, because ROLM is owned by IBM, and the PC's used

by the network are IBM. A person with a simpler fone/Terminal couldn't access

something like their DEC mainframe, or something like that. By calling in, you

could not run an application, unless you had a special interface, but you could

access the database, which any dumb terminal could do.

    However, there are security levels. Thus one with a privileged account

could access more things than one without it. Like Joe Schmoe in Sales couldn't

get to Payroll . It seems that for non-IBM's to access some of the parts of the

network, you would need an interface to become the same thing as a RolmPhone.

    Excessive 's of bad logon attempts, which would be construed as a linking

error would notify the network manager, And if they saw that there was no

hardware error, eventually, they would think of if they were somewhat

experienced, you guessed it, hackers.



   The PBX

   -------



    ROLM has something called Integrated Call Management <from here on known as

ICM>. Now, when designing ICM, they must have taken into account the abuse

possible in plain ol' PBX's. So they put in something called Call Screening.

This will enable the company to restrict calls to certain 's and prefixes.

Calls to non-business 's or certain areas can be screened out <"No personal

calls on my time, Johnson!">, with the exception of 1 specific  that you want.

    There is a choice of having a codeless, screened PBX, or a PBX where

accounts are assigned to each employee, and the 's they call get recorded to

that account. There can be privileged accounts where a large volume of calls

would go relatively un-noticed. But I don't think that large-scale abuse of

this system would be easy or practical. Calls are routed AUTOMATICALLY through

the service where the rates are cheaper to the location dialed, which is pretty

fucking cool.  And, the PBX is accessible from the outside, using Direct Inward

System Access, making it AB-useable.

    But what about if there is Equal Access in that area? It doesn't matter,

the CBX will automatically access the service without you having to worry about

it <hell, this is totally unnecessary for a hack/phreak, cause we ain't paying

for the damn call anyhow!>

        BUT!: There is a use of Call Detail Recording, where information on all

ingoing and outgoing calls are recorded.



     Conclusion

     ----------



     Not a lot of research went into this file, but it did take a little while

to type up, and all of the information is correct, to my knowledge. Anyone is

free to expand on this file into a Part II. It was written to enlighten people

about this system, and I hope this has helped a little bit.

     Sysops: You are free to put this file up as long as NONE of the credits

are changed! <this means the Phrack, Inc. AND Personal credits>. Please give us

a chance.



    Coming soon, to a telephone near you: The Return of The Flying Circus. Look

for it.

                   --Later On

Monty Python             <01/11/86>







                                ==Phrack Inc.==

                    Volume One, Issue Three, Phile 3 of 10





                   ////////////////////\\\\\\\\\\\\\\\\\\\\

                   ::::                                ::::

                   ::::      "SHOTGUN SHELL BOMBS"     ::::

                   ::::               from             ::::

                   ::::    The Poor Man's James Bond   ::::

                   ::::           by Kurt Saxon        ::::

                   ::::                                ::::

                   :::: typed in by --] Man-Tooth [--  ::::

                   ::::                                ::::

                   \\\\\\\\\\\\\\\\\\\\////////////////////





     These little goodies are affectionately known as "nut busters." They are

simply shotgun shells enclosed in cardboard rolls with cardboard fins put on.

On the primer end of the shell is glued a small cork with a hole drilled

through it.  A roofing nail fits in the hole snugly enough to stay in, but

loose enough to plunge into the primer upon impact.



     Since the shell is not confined in the chamber of the gun, it will

naturally not cause the same amount of damage.  But if it goes off between a

fellow's legs he can look forward to becoming a soprano.



     These bombs are thrown singly or by the handful into the air over milling

crowds.  The weight of the shell and stabilization by the fins causes the nut

buster to head straight downward.



     It has tremendous effect as its presence is usually a suprise.  The threat

of more coming is guaranteed to route any mob.



     Not only does it go off on the pavement but it will also explode on

contact with a person's head or shoulder.  At night it is impossible to trace

its point of origin.



                 -----

                 !    \

              /> !     \                /- Cork

          Fins   !     !               v

                 --------------------!\

           ! \   !         !-----!   ! \ !

           !  \> !------   !     !   !---!  <-- Roofing nail

           !     !         !-----!   ! / !

           \     --------------------!/

            \    !     !       ^

             \-> !     / ^      \

                 !    /  !       \

                 -----   !       Shell

                         !

                         !

                Close fitting 3-1/2 inch Aluminum Tubing Glued on Shell.



                      SHOTGUN SHELL BOMB





     A clever use for a plain shotgun shell is as a muffler bomb.  The shell is

simply shoved up a car's exhaust pipe with a length of stiff wire until it

drops into the muffler.  After a few minutes on the road the shell explodes,

totalling out the muffler and treating the driver to a sick kind of panic.







                                ==Phrack Inc.==

                    Volume One, Issue Three, Phile 4 of 10



Signalling Systems Around the World





For those of you who have the desire to make international calls, this info may

be of interest.  Thanks to TAP and Nick Haflinger.



CCITT 1.       An old international system, now deceased.  Used a 500 Hz tone

                interrupted at 20 Hz (Ring) for 1-way line signals.



CCITT 2.       Proposed "International Standard" that never caught on much.

                Used 600 Hz interrupted by 750 Hz.  Still used in Australia,

                New Zealand and South Africa.



CCITT 3.       An early in-band system that uses 2280 for both line and

                register (!!). Used in France, Austria, Poland and Hungary.



CCITT 4        A variation of 3, but uses 2040 and 2400 for end to end Tx of

                line and register.  Used for international Traffic in Europe,

                but cannot be used with TASI (AKA Multiplex or "that dammed

                clipping").



CCITT 5        This is the most popular, and the one used in the US. 2400 and

                the infamous 2600 are used for link to link (not merely end to

                end line signals.  Registers are handled via DTMF (Touchtones).

                Anyone know what 2400 does??



CCITT 5 bis.   Just like above, but a 1850 Hz tone is used for TASI locking

                and transmission of line signals.



CCITT 6        The newest and worst for phreaks.  It uses digital data sent

                out-of-band to control the connection.  In other words, the

                connection is made and billing started BEFORE you can get

                control.



CCITT 5R1      A regional system like 5, but doesn't use the mysterious 2400

                and can't use the multiplexer.



CCITT 5R2      Probably the interface to AUTOVON, as it uses 120 Hz spaced

                tones for DTMF instead of 200.  Also 3825 Hz is the blow-off

                tone instead of 2600.





The "Extra" tones



1700 + 700 = Inward Operator

1700 + 900 = Delay operator, also, in TSPS,STP (a "Zero Plus" call from a coin

             phone)

1700 + 1100= KP1 (Start recognition of special tones)

1300 + 1700= KP2 (End recognition of special tones)



12-85  Data Line. CIS 72767,3207: TWX 650-240-6356







                                ==Phrack Inc.==

                    Volume One, Issue Three, Phile 5 of 10





                             * PRIVATE AUDIENCE *



                  (A BASIC LESSON IN THE ART OF LISTENING IN)



                               BROUGHT TO YOU BY



                              -[ THE OVERLORD ]-



-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-





                                PART I: THE LAW





Federal law:

  Section 605 of title 47 of the U.S code, forbids interception of

communication, or divulagance of intercepted communication except by persons

outlined in section 119 of title 18 (a portion of the Omnibus crime control and

safe streets act of 1968). This act states that "It shall not be unlawful under

this act for an operator of a switchboard, or an officer, employee, or agent of

any communication common carrier who's switching system is used in the

transmission of a wire communication to intercept or disclose intercepted

communication."



What all this legal bullshit is saying is that if you don't work for a phone

company then you can't go around tapping people's lines. If you decide to

anyway, and get caught, it could cost you up to 5 years of your life and

$10,000. This, you are all assuming, means that if you tap someone else's line,

you will be punished....wrong! You can't tap your own line either. The

punishment for this is probably no more than a slap on the hand, that is if

they actually catch you, but it's a good thing to know..............now on to

the fun.....



                               PART II: TAPPING



Everyone has at some time wanted to hear what a friend, the principal, the prom

queen, or a neighbor has to say on the phone. There are several easy ways to

tap into a phone line. None of the methods that I present will involve actually

entering the house. You can do everything from the backyard. I will discuss

four methods of tapping a line. They go in order of increasing difficulty.



1. The "beige box": a beige box (or bud box) is actually better known as a

"lineman" phone. They are terribly simple to construct, and are basically the

easiest method to use. They consist of nothing more than a phone with the

modular plug that goes into the wall cut off, and two alligator clips attached

to the red and green wires. The way to use this box, is to venture into the

yard of the person you want to tap, and put it onto his line. This is best done

at the bell phone box that is usually next to the gas meter. It should only

have one screw holding it shut, and is very easily opened. Once you are in, you

should see 4 screws with wires attached to them. If the house has one line,

then clip the red lead to the first screw, and the green to the second. You are

then on the "tappee's" phone. You will hear any conversation going on. I

strongly recommend that you remove the speaker from the phone that you're using

so the "tappee" can't hear every sound you make. If the house has two lines,

then the second line is on screws three and four. If you connect everything

right, but you don't get on the line, then you probably have the wires

backward. Switch the red to the second screw and the green to the first. If no

conversation is going on, you may realize that you can't tap the phone very

well because you don't want to sit there all night, and if you are on the

phone, then the poor tappee can't dial out, and that could be bad...so.......

method two.



2. The recorder: This method is probably the most widespread, and you still

don't have to be a genius to do it. There are LOTS of ways to tape

conversations. The two easiest are either to put a "telephone induction pickup"

(Radio Shack $1.99) on the beige box you were using, then plugging it into the

microphone jack of a small tape recorder, and leaving it on record. Or plugging

the recorder right into the line. This can be done by taking a walkman plug,

and cutting off the earphones, then pick one of the two earphone wires, and

strip it. There should be another wire inside the one you just stripped. Strip

that one too, and attach alligators to them. Then follow the beige box

instructions to tape the conversation. In order to save tape, you may want to

use a voice activated recorder (Radio Shack $59), or if your recorder has a

"remote" jack, you can get a "telephone recorder control" at Radio shack shack

for $19 that turns the recorder on when the phone is on, and off when the phone

is off. This little box plugs right into the wall (modularly of course), so it

is best NOT to remove the modular plug for it. Work around it if you can. If

not, then just do you best to get a good connection. When recording, it is good

to keep your recorder hidden from sight (in the Bell box if possible), but in a

place easy enough to change tapes from.



3. The wireless microphone: this is the BUG. It transmits a signal from the

phone to the radio (FM band). You may remember Mr. Microphone (from Kaytel

fame); these wireless microphones are available from Radio Shack for $19. They

are easy to build and easy to hook up. There are so many different models, that

is is almost impossible to tell you exactly what to do. The most common thing

to do is to cut off the microphone element, and attach these two wires to

screws one and two. The line MIGHT, depending on the brand, be "permanently off

hook". This is bad, but by phucking around with it for a while, you should get

it working. There are two drawbacks to using this method. One, is that the poor

asshole who is getting his phone tapped might hear himself on "FM 88, the

principal connection". The second problem is the range. The store bought

transmitters have a VERY short range. I suggest that you build the customized

version I will present in part four (it's cheaper too). Now on to the best of

all the methods....



4. The "easy-talks": This method combines all the best aspects of all the the

other methods. It only has one drawback... You need a set of "Easy-talk" walkie

talkies. They are voice activated, and cost about $59. You can find 'em at toy

stores, and "hi-tech" catalogs. I think that any voice activated walkie talkies

will work, but I have only tried the easy-talks. First, you have to decide on

one for the "transmitter" and one for the "receiver". It is best to use the one

with the strongest transmission to transmit, even though it may receive better

also. De-solder the speaker of the "transmitter", and the microphone of the

"receiver". Now, go to the box. put the walkie talkie on "VOX" and hook the

microphone leads (as in method three) to the first and second screws in the

box. Now go home, and listen on your walkie talkie. If nothing happens, then

the phone signal wasn't strong enough to "activate" the transmission. If this

happens, there are two things you can do. One, add some ground lines to the

microphone plugs. This is the most inconspicuous, but if it doesn't work then

you need an amplifier, like a walkman with two earphone plugs. Put the first

plug on the line, and then into one of the jacks. Then turn the volume all the

way up (w/out pressing play). Next connect the second earphone plug to the mice

wires, and into the second earphone outlet on the walkman. Now put the whole

mess in the box, and lock it up. This should do the trick. It gives you a

private radio station to listen to them on: you can turn it off when something

boring comes on, and you can tape off the walkie talkie speaker that you have!



                      PART IV: WIRELESS TRANSMITTER PLANZ



This is a tiny transmitter that consists on a one colpitts oscillator that

derives it's power from the phone line. Since the resistance it puts on the

line is less than 100 ohms, it has no effect on the telephone performance, and

can not be detected by the phone company, or the tappee. Since it is a

low-powered device using no antenna for radiation, it is legal to the FCC.

(That is it complies with part 15 of the FCC rules and regulations). It,

however is still illegal to do, it's just that what you're using to do it is

legal. This is explained later in part 15... "no person shall use such a device

for eavesdropping unless authorized by all parties of the conversation" (then

it's not eavesdropping is it?). What this thing does, is use four diodes to

form a "bridge rectifier". It produces a varying dc voltage varying with the

auto-signals on the line. That voltage is used to supply the the voltage for

the oscillator transistor. Which is connected to a radio circuit. From there,

you can tune it to any channel you want. The rest will all be explained in a

minute....











PARTS LIST

item                |              description

-----------------------------------------------------------------

C1                  | 47-Pf ceramic disk capacitor

C2,C3               | 27-Pf mica capacitor

CR1,CR2,CR3,CR4     | germanium diode 1n90 or equivalent

R1                  | 100 ohm, 1/4 watt 10% composition resistor

R2                  | 10k, 1/4 watt 10% composition resistor

R3                  | .7k, 1/4 watt 10% composition resistor

L1                  | 2 uH radio frequency choke (see text)

L2                  | 5 turns No.20 wire (see text)

Q1                  | Npn rf transistor 2N5179 or equivalent

-----------------------------------------------------------------



L1 may be constructed by winding approximately 40 turns of No. 36

enamel wire on a mega-ohm, 1/2 watt resistor. The value of L1 is

not critical. L2 can be made by wrapping 5 turns of No. 20 wire

around a 1/4 inch form. After the wire is wrapped, the form can

be removed. Just solder it into place on the circuit board. It

should hold quite nicely. Also be sure to position Q1 so that the

emitter, base, and collector are in the proper holes. The

schematic should be pretty easy to follow. Although it has an

unusual number of grounds, it still works.









                  |------------------L1----------------|

                 --                                    |

            CR1 /  \ CR2              |----------------|

A--------------/    \ --|         ----|          |     |

       |       \    /   |         |   |          C2    L2

       |    CR3 \  /CR4 |         C1  R2    |----|     |

      R1         --     |         |   |    gnd   C3    |

       |         |      |         ----|          |-----|

       |        gnd     |             |                |

       |                |             |-----|----Base  collector

       |                |                   R3     \   /

B-----------------------|                   |       \/\ <- Q1

                                           gnd       \/

                                                     |

                                                     |

                                                    emitter(gnd)







The odd thing about this bug that we haven't encountered yet, is that it is put

on only one wire (either red or green) so go to the box, remove the red wire

that was ALREADY on screw

1 and attach it to wire 'A' of the bug. Then attach

wire 'B' to the screw itself. You can adjust the frequency which it comes out

on the FM channel by either smooshing, or widening the coils of L2. It takes a

few minutes to get to work right, but it is also very versatile. You can change

the frequency at will, and you can easily record off your radio.



                           PART FIVE: HELPFUL HINTS





First of all, With method one, the beige box, you may notice that you can also

dial out on the phone you use. I don't recommend that you do this. If you

decide to anyway, and do something conspicuous like set up a 30 person

conference for three hours, then I suggest that you make sure the people are

either out of town or dead. In general, when you tap a line, you must be

careful. I test everything I make on my line first, then install it late at

night. I would not recommend that you leave a recorder on all day. Put it on

when you want it going, and take it off when you're done. As far as recording

goes, I think that if there is a recorder on the line it sends a sporadic beep

back to the phone co. I know that if you don't record directly off the line

(i.e off your radio) then even the most sophisticated equipment can't tell that

you're recording. Also, make sure that when you install something, the people

are NOT on the line. Installation tends to make lots of scratchy sounds, clicks

and static. It is generally a good thing to avoid. It doesn't take too much

intelligence to just make a call to the house before you go to install the

thing. If it's busy then wait a while. (This of course does not apply if you

are making a "midnight run").



All in all, if you use common sense, and are *VERY* careful, chances are you

won't get caught. Never think that you're unstoppable, and don't broadcast what

you're doing. Keep it to yourself, and you can have a great time.



                       -[ OVERLORD ]-



THANKS TO:



The CircleLord

TARAN KING

Knight Lightning

The Forest Ranger

P-80 systems



Watch for more advanced tapping, how they catch you, and verification in the

near future.







                                ==Phrack Inc.==

                    Volume One, Issue Three, Phile 6 of 10



                                Fortell Systems

                          Written by Phantom Phreaker



                       Call The Alliance at 618-667-3825



Fortell systems seem to be a system to monitor lines. They can only be used to

monitor lines within their own NPA.

 A Fortell system is at 716-955-7750. Whene you call, you will hear:



'Hello. This is the Taradyne Fortell system. Please enter ID code'



The ID for this system is 722877*. After you type that in (DTMF) it will ask

'please enter line number' where you then type the PRE+SUFF of the number you

wish to check within the NPA of the Fortell.

  After you enter a number, it will repeat the number you entered. Now it will

ask you to 'please enter mode'.



The modes are:



1-Calling on other line

2-Calling on test line

3-Line test results



If you enter mode 1, you will have these commands available:



1-Fault location

2-Other testing

7-Test ok, Monitor

8-Hang up

9-Enter next line number



 If you enter 7 here, it will repeat what you selected, and ask for an ID code

which can be any 6 digit number followed by a *.



 Now it will dial and tell you:

 'Subscriber busy-busy-monitor test in progress conversation on line-short on

line'



2-Monitor test

3-Overide and test

4-Wait for idle



 If you enter 2, (Monitor Test) it will tell you the busy status again.



 If you enter 3, it will override, or tell you 'Not available in this CO'.



 If you enter 4, (Wait for idle) it will wait until the line is idle.





If you enter 1 (Fault Location) at the main list you will get these options:



1-Open location

3-Short location

4-Cross location

5-Ground location

8-Hang up



If you enter 2 (Other testing) here, you will have these commands:



2-Loop Ground OHMS

3-Dial tone test

5-Pair ID

8-Hang up



If you enter Mode 2, you will have these options:(Other testing)



2-Other testing

7-Test ok, Monitor

8-Hang up

9-Enter next line number



  It will repeat what you selected. If you select 2 here, you will now have

these commands:



2-Loop Ground Omhs

8-Hang up



 If you select 7 at the main list after mode 2, it will ask for an ID which is

any 6 digit number followed by a *. Now it will dial and check the number. If

the number is busy, it will say 'Subcriber busy-monitor-test in progress-

conversation on line-short on line-please hang up-waiting for idle' Now you can

just type * to go back to the main list of commands.



      If you enter MODE 3, if you have done a test before, it will give you the

results of the test. If you haven't done a test, it will tell you so with 'No

test results available'



 You can abort back to the main commands list by typing a *.



 By typing a 9 at several places you will be taken back to the beginning where

it asks you to 'enter line number'





PP-01/06/86







                                ==Phrack Inc.==

                    Volume One, Issue Three, Phile 7 of 10



        ***************************************************************

        *                                                             *

        *               Electronic Eavesdropper                       *

        *                                                             *

        *               by                                            *

        *                                                             *

        *               Circle Lord                                   *

        *                                                             *

        ***************************************************************





     Have you ever considered buying one of those hi powered microphones often

seen in eletronics magazines, but thought it was to much to buy and to small to

card?   The circuit shown in this file will provide you with the information to

build one for a lot less money.

     These audio eavesdropping devices are probably one of the hottest items in

the underground due to their ability to pick up voices through thick walls.

You can also attach the speaker wires to a tape recorder and save all the

conversation.   As one can see these are great for blackmailing a teacher,

classmate, principal, neighbor, or whoever you seek services from...







Parts list:



-=EM--------------------------

M1    Amplifier Module. (Lafayette 99C9037 or equiv.)

M2    9-VDC battery.

M3    Microphone

R1    20K poteniometer with spst switch.

S1    Spst switch on R1

SP1   8-ohm speaker

T1    Audio transformer (Radio Crap part  273-1380)







                        Schematics

                        +------+--------M1

                        1      1        1

                        1      1red     1blu

                        1      1        1

                        1      transformer

                        1      1        1

                        1      1yel     1grn

                        +------+        1

                               1  +-----+      +-----+

                               1  1            1     1

                              b1 b1 r+M2+b o+S1+o    1

                              l1 l1 e1  1l r1  1r    1

                              k1 u1 d1  1k g1  1g    1

                            **********************   1

                           *                yel>*-+  ++

                           *                    * R   1

                           *         M1         * 1-+ 1

                           *                red>*-+ 1 1

                           *                    *   1<<

                           **********************   1

                             b1   1g    y1          1

                             l1   1r    e1          1

                             k1   1y    l1          1

                              1   1      +----------+

                              +SP1+





S1 here is on the potentiometer

M3 can be an earphone earpiece









                               ----          /

                              /             /

                             /             /

                            /    ircle    /    ord

                            ----          ----







                                ==Phrack Inc.==

                    Volume One, Issue Three, Phile 8 of 10



        ***************************************************************

        *                                                             *

        *                      Making a Shock Rod                     *

        *                                                             *

        *                             By                              *

        *                                                             *

        *                        Circle Lord                          *

        *                                                             *

        ***************************************************************





This handy little circuit is the key to generating THOUSANDS of volts of

electricity for warding off attackers (notice the plural).   It generates it

all from a hefty 6-volt source and is easily fit into a tubular casing.

Originally used as a fence charger, this circuit can be put to other uses such

as: charging a whole row of lockers at school, a row of theater seats, or a

metal bleacher set in the gym. More on this later.



To build this, all you need is a GE-3 transistor, a 6.3-volt transformer, and a

handful of spare parts from old radios.   The ammount of shock you wish to

generate is determined by the setting of potentiometer R1, a 15,000 ohm

variable resistor.   Hint: for maximum shock, set R1 at maximum!





***************************************************************

Item    *  Description

***************************************************************

 C1      * 500uF, 10-WVDC electrolytic capacitor

 C2      * 2000uF, 15-WVDC electrolytic capacitor

 M1      * 6-VDC battery

 M2,M3   * Leads

 Q1      * GE-3 transistor (2n555 will also do)

 R1      * 15K potentiometer

 R2      * 160-ohm resistor

 S1      * Spst switch

 T1      * 6.3-VAC filament transformer (Triad F-14x or equiv.)

 X1      * 1N540 diode



***************************************************************





                        Schematics:



                            +---C1--------------+

                            1                   1   HOT

                            1     +-----+       1  LEAD

                            +---1<Q1    1        )(-->

                          R1*     +     1   +--->)(

                        +-->*     1     1   1    )(

                        1   *  +--+     1   1    )(-->

                        1   1  1  1     1   1    1 TO

                        1   1  1  1     1   1    1 GND

                        1   *  C2 1     +---1----+

                        1  R2  1  1         1    1

                        1   *  1  1         1 X1 1

                        +---+--+--1---------1-->-+

                                  1 +/-     1    1

                                  +*M1*-*S1*+   GND    -





         ----         /

        /            /

       /            /

      /    ircle   /    ord

      ----         ----







                                ==Phrack Inc.==

                    Volume One, Issue Three, Phile 9 of 10



@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

@                                  _  _        _______                        @

@                                 | \/ |      / _____/                        @

@                                 |_||_|etal / /hop                           @

@                                 __________/ /                               @

@                                /___________/                                @

@                                   PRIVATE                                   @

@                                                                             @

@                                 Presents...                                 @

@                                                                             @

@                    \\\\\=-{ Knight Lightning's }-=/////                     @

@                                                                             @

@                           "Introduction to PBXs"                            @

@                                                                             @

@                                                                             @

@                         Written on January 3, 1986                          @

@                                                                             @

@                                                                             @

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@



This file is a personal continuation of the PBX entry in the MCI

Telecommunications Glossary.

_______________________________________________________________________________



A telephone exchange serving an individual organization and having connections

to a public telephone exchange is called a Private Branch Exchange (PBX).  The

PBX performs a switching function by connecting any extension in the private

organization to an outside line.  A PBX is actually a private switch that

connects a group of telephones within an individual organization.  Calls placed

outside this individual group are connected to a telephone company's central

office switch through trunks.  A PBX may be operated by an attendant from the

private organization or the switching system may be done automatically.  Other

terms that are commonly used interchangeably with PBX are: Private Automatic

Branch Exchange (PABX), Private Automatic Exchange (PAX), and Computerized

Branch Exchange (CBX).  Although these terms were originally used to identify

specific switch structures, today they are often used as synonyms.



PBXs can use any of three basic switching methods: step-by-step (SxS),

Cross-bar (X-bar), and computer controlled, to perform the basic function of

switching.  However, in addition to detecting calls and establishing a

transmission link between two telephones, PBXs can do much more.



The common control, often called a central processing unit (CPU), controls the

switching matrix that connects the stations and trunks.  The switching matrix

of a PBX performs the same job as does an operator at a manual switchboard or a

common control central office switch.  The CPU, however, gets its instructions

from the "stored program", which contains directions for activities, such as

detecting calls, sending them over the best available route, and recording

billing information.  These computerized electronic switches are used to

perform routine, as well as unique, functions that simply weren't practical or

even possible with electromechanical switches.



Just as in the public switched network, PBX switches make connection between

instruments, or "key telephone sets".  We're all familiar with key telephone

sets, whether we know them by name or not.  They're the business telephones

that have six push-button keys lined up below the dial--a red button marked

"hold" and five buttons or lines with flashing lights.



Systems with PBXs and key sets have a great deal of flexability in planning for

their needs because they can set up their codes to accomplish the functions

needed in their particular situations.  In fact, the PBX can be programmed so

that each individual extension within a system can take advantage of features

applicable to its own business needs.



Some of the features that are availiable with PBXs and key systems are: call

transfer, which allows internal or external calls to be transferred from one

telephone to any other phone in the system; automatic push-button signaling,

which indicates the status of all phones in the system with display lights and

buttons; one-way voice paging, which can be answered by dialing the operator

from the nearest telephone in the system; camp-on, in which a call made to a

busy phone automatically waits until the line is idle; and internal and

external conference capabilities, which enables outside callers to conference

with several inside users.



Some features automatically handle incoming telephone calls.  Automatic call

waiting not only holds calls made to a busy extension until the extension is

free, but also signals the person being called that a call is waiting and

informs the caller that he is on hold.  Automatic call forwarding will send

calls to employees who are temporarily in locations other than their offices,

provided they "inform" the PBX where they can be found.  Automatic call

distribution automatically send an incoming call to the first extension that's

not busy--a useful feature for situations in which any one of a group of

persons in the organization can adequately respond to incoming calls.  Another

example is automatic call back, which allows a caller who reaches a busy line

to ask the PBX to return his or her call when the line is free.



Still other features provide services such as night telelphone answering,

telephone traffic monitoring, and network or hot-line connection.  These

examples are but a sample from the features possible with computerized PBXs.



===============================================================================

This is a very brief description of how to use and what to expect on a PBX.

-------------------------------------------------------------------------------

Basically, you call the PBX and you will have to enter a code that can be

anywhere from 4 to 6 digits (Note: some PBXs do not require codes).  Then you

will hear a dial tone.  From here you would under normal circumstances dial:

9 + 1 (or 0) + NPA-PRE-SUFF, for long distance dialing or dial 8 for local

dialing.



The most common use of the PBX is to call Alliance Teleconferencing,

a teleconference service offered by AT&T.  To do this dial:

0700-456-1000,1002,1003,2000,2001,2002.



Note: PBX codes are usually very simple and usually 4 digits.

EX: 0000, 1111, 1234, etc

===============================================================================

Look for a file on Alliance Teleconferencing coming soon...

_______________________________________________________________________________



This has been a Knight Lightning presentation...



@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@







                                ==Phrack Inc.==

                   Volume One, Issue Three, Phile 10 of 10



=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=



                             Phreak World News II

                                  Compiled by

                      \\\\\=-{ Knight Lightning }-=/////

_______________________________________________________________________________



Retraction

----------

We at Phrack Inc, respectfully retract all statements made in last issue

concerning Stronghold East Elite and the LOD.  We are sorry for any

inconvenience this may have caused you.

_______________________________________________________________________________



Phreaks Against Geeks

---------------------

This group was formed as a joke by The W(hack)o Cracko Brothers Inc. on a

conference in December of 1985.  The charter members were TWCB, taRfruS, Blue

Adept, The Clashmaster, and a few others.  Since then, Catcher in the Rye and

the Slovak have tried to join.



Later that month, Boston Strangler and Micro Man formed PAP, which stands for

Phreaks Against Phreaks Against Geeks.  Other opposers of PAG include:

Hack Attack, The Detective, Kleptic Wizard and The Overlord 313. It is not

known if these others are now in PAP or not.



All of this nonsense was really started on the Dartmouth System and is mainly

a local feud of phreaks in the Boston (617 NPA) area.

_______________________________________________________________________________



Brainstorm Gets 10 Megs

-----------------------

Finally, after several months of promises, Brainstorm (ELITE) now has a 10 Meg

Hard-drive.  As of January 1, 1986 Modern Mutant cleared the userlog of

Brainstorm and a membership drive was started.  Note: To become a member of

Brainstorm, you will have to take a small (and more or less easy) filter.

Some other new features on Brainstorm are online games; Karate, Football, and a

hacking simulation.

_______________________________________________________________________________



Anarchy Inc. Disbanded

----------------------

Anarchy Inc., a once very famous g-phile writing organization, has been

disbanded.  Basically because most of its membership are now attending college.

_______________________________________________________________________________



Dartmouth Conferences To Be Abolished?

--------------------------------------

This message was given on January 9, 1986 when a user would try to join a

conference.



XCaliber, Fantasie, Spectre, etc are not available until tomorrow. Due to

pressure from Kiewit and some users, conferences have been disabled for one

day. Hopefully this will remind some people that the conferences are a public

service on the part of a few people and are not a "right". Recent abuse of the

conferences has made caring for these conferences almost more trouble than they

are worth. These abuses have also caused some users to complain to Kiewit. Too

many complaints and they might vanish altogether. If everyone will work at

keeping the conferences reasonably clean and free of abuse life will be much

easier. Thank you for your time and appologies for the lack of conferences.



You are no longer connected to conference "XYZ".



Later, Corwin got pissed off by the password abuse that was going on and killed

almost all non-Dartmouth student passwords.  It is also rumored that he took

down the DUNE bbs, however Apollo Phoebus says that it is a temporary thing and

that DUNE will be going back up soon.

_______________________________________________________________________________



MCI Employee Bust

-----------------

Employees at MCI were creating fake accounts and then running up massive bills.

Then later they would either credit the accounts or say that the subscriber

reported code abuse.  Any employee found doing this was fired.



Another way these employees were cheating the company was by reporting code

abuse on their own accounts, however MCI Security using CNA quickly caught

these employees.



Note: MCI Security has stated that the only real way that they can catch

      abusers of the phone company is by calling the numbers that the abusers

      call and asking them who they know making these calls.



              Information has been provided through MCI Security

_______________________________________________________________________________



MCI/IBM Merge

-------------

MCI Telecommunications company has merged with IBM and their phone industry

SBS.  This was an effort to join the two as strong allies against AT&T.



                      IBM computers  Vs.  AT&T computers



             MCI Telecommunications  Vs.  AT&T Telecommunications



Changes arising from this merger (if any) are not known, but none are expected

for some years.

_______________________________________________________________________________



The Life And Crimes of the W(hack)o Cracko Brothers

---------------------------------------------------

The date is somewhere in December of 1984.  Peter writes a code hacker for the

Hayes and tells Tim NOT to use it on Sprint because they trace. Sometime later

that night Tim received a call from Scan Man, sysop of P-80.



Scan Man said he needed TWCB to hack him some Sprint codes cause he didn't have

the time or a Hayes.  Tim did it for him on the 314-342-8900 Sprint extender.



He left it on all night and the next day while he was in school.  Sprint traced

him.  At 9:00 AM the next morning agents from the FBI, AT&T, Western Union,

GTE, and Southwestern Bell, arrived at TWCB's house.



They were let in, bringing with them cameras and tape recorders among other

equipment.  Upon seeing this Peter blew into an upstairs extension and

cancelled the dialing program, but not before the agents made sure it was the

right place.



All of TWCB's computer equipment was confiscated and Tim was taken downtown

shortly after being picked up at school.  Peter was sick and left home.  Tim

was later released in his mother's custody.



They each received probation and 100 hours of county service.



That was then...



Recently TWCB has come under investigation for the following: Drug use and

dealing, burglary, forgery, and fraudulent use of a credit card.



Peter: 8 Class A Felony charges

       1 Class A Misdemeanor charge

       1 Class B Misdemeanor charge



Tim:   6 Class A Felony charges

       2 Class B Misdemeanor charges



Note: Some of these misdemeanors are for not returning library books.



Also it has been said that Tim has been in jail 11 times. Both members of TWCB

are now enrolled in a reform school.



The information in this article has been provided by TWCB, directly and/or

indirectly.

_______________________________________________________________________________



Blue Adept: Gone For Good

-------------------------

Blue Adept, known for being an all around loser and Dartmouth impersonator,

decided to try blue boxing.  For some reason he decided to call an out-of-state

trunk direct.



Later that month Blue Adept and his parents received a phone bill with a

charge around $386.00.  This led to his being restricted from using the phone.



Sometime after this incident Blue Adept received an invitation to join on a

conference.  He wasn't home but his parents decided to stay on and listen in.



Blue Adept is not allowed on conferences anymore and all calls to him are now

screened.

_______________________________________________________________________________



Overlord 313 Busted: Step dad turns him in

------------------------------------------

Overlord's step-dad always would be checking his computer to see what was on it

and what was nearby.  Last week he noticed the credits in Overlord's file on

Wiretapping, which can be seen in this issue of Phrack.



He reported his findings to Overlord's mom.  She had a talk with him and he

promised to stop his evil ways.  His step-dad didn't believe him for a second.



                                    1/11/86



Step-dad goes on business trip, where he meets Ma Bell executive Don Mitchell.

Step-dad asks all sorts of different questions regarding use of MCI dialups and

Alliance Teleconferencing, and talks about how his step-son does all these

things and more.  Don strongly suggests that he reports this to the phone

company...



                                    1-13-86



                                    HE DOES

                                    -------

          No legal action against Overlord has taken place as of now.



                  Information Provided by The Overlord of 313

_______________________________________________________________________________



Maelstrom 305 Busted

--------------------

While I am not at liberty to revel all the information concerning this bust I

will mention the bare facts.



Maelstrom hacked into the Southern Bell Data Network (SBDN).  This system

happened to be local to him so he did not bother to use an extender.

Unfortunately this system also had ANI (Automatic Number Identification).  His

computer and other equipment as well as all his files were confiscated as

evidence.



                 Information provided by the Maelstrom of 305

_______________________________________________________________________________



Whackoland BBS

--------------

This bbs is now up and running strong.  Its sysops are of course...TWCB Inc.

300/1200 Baud, and 40 Megs.  It has unique features and great mods as well as

Elite Sections.  Call today...  314-256-8220.   Note: Only 100 users will be

kept so if you are just a beginner please don't bother to call.

_______________________________________________________________________________



R.I.P. Broadway Show

--------------------

The Broadway Show BBS in New York is now down, and Broadway Hacker will soon be

in Washington DC.  This C-64 run bbs, was one of the best in its time, but

later it became a hangout for rodents.



>From its ashes rises a new bbs, however its name has not been released as of

this writing.  Broadway Hacker will sysop this bbs for about a week and then

turn it over to the new sysop.  His name is not yet know, probably since he

hasn't a handle yet.



Although this new bbs will appear legal and have some legal sections it is

indeed a phreak bbs, and should be checked out.



                                 718-615-0580

_______________________________________________________________________________



Speed Demon Elite Down?

-----------------------

This bbs sysoped by Radical Rocker has suddenly disappeared leaving the caller

with a message of the line being disconnected.  No other information is

available.

_______________________________________________________________________________



Well that's all for this issue's Phreak World News. If you have anything of news



                   Knight Lightning/Taran King/Cheap Shades

_______________________________________________________________________________





.

