By Static Crash
Comments - I am sick off people being fed out of date information, the scene is failing and we need to keep it going.
[Note from Harl: This is one of the best phreaking files I have seen for ages. Big respect to Static Crash.]
1.0 BT Boxing
1.1 Bt Tones
1.2 Blue Boxing
1.3 Beige Boxing
1.4 Other Boxes
2.0 Phone Numbers
2.1 0800 #'s
2.2 Strange, Operator, other #'s
3.0 Phone Boxes
3.1 BT Phone Boxes
3.2 COCOTS
4.0 Cards
4.1 BT Phonecards
4.2 BT Charge Cards
4.3 Credit Cards.
------------------ End of Contents
1.0 BT Boxing
You may have read about the Blue box and The Magic 2600 or 2280 Tones,
For the most these are out of date now. If you try them, you will either
a.) get nowhere
b.) get arrested
BUT there is still one way of seizing the 'ol trunk. But first a little
bit fo history.
At the dawn of time (About 20 years ago.) BT And AT&T Bell (The USA equivilant
used certain tones for certain jobs, eg. 2600 was transmitted by certain
changes to say if they where in use or not, 2280 was the U.K equivilant.
All that changed when Both BT and AT&T Bell realised that people where abusing
0800 (or 1-800) numbers so they could box. Filters where added to xchanges
and "cheeps" to operator calls to stop the magic bleeps getting through.
Now it is almost impossible to box the British fone system, BUT countries
with simple fone systems ie: China, can still be boxed.
Here's how
1.2 BT Tones
To start whith you would need the Tones, these are 2 or more frequencies
played together to produce tones, which the switchboard should recognise.
Here they are then: (CCIT5)
1 700/900
2 700/1100
3 900/1100
4 700/1300
5 900/1300
6 1100/1300
7 700/1500
8 900/1500
9 1100/1500
0 1300/1500
KP1 1100/1700
KP2 1300/1700
ST 1500/1700
C11 700/1700
All these have a mark and space of 50 (duration and time to wait.)
The easiest way to utilise these tones is to download BlueBeep from:
http://SorcereRs-Realm.home.ml.org
Then just add two more tones to the DTMF set:
2400 Hz/2600 Hz Clear Ahead Tone
2400 Hz/2400 Hz Seize Tone
The Length Etc.. of these Tones really are variable, but i find about:
200/50 about right most of the time.
Now you need the Country Direct number, these are numbers (0880 mostly) introduced by BT,
so foreigners could dial it up and ask to be connected to a home #,bu we abuse them by
blue boxing them!
These are the Numbers That should Defenitely work:
0800 890 027 - South Africa?
0800 890 038 - ?
0800 890 049 - Germany
0800 890 056 - Chile
0800 890 055 - Brazil Direct
0800 890 059 - Libia Direct
0800 890 061 - Australia Direct
0800 890 062 - Indonesia Direct
0800 890 133 - French recording or something?
0800 890 135 - Bahamas Direct
0800 890 241 - Gabon Direct
0800 890 598 - ?
0800 890 853 - Macao Direct
0800 890 890 - ?
Here are some Numbers Which might Work:
0800 890 016 - Canada direct 0800 890 027 - South Africa direct
0800 890 031 - Netherlands direct 0800 890 032 - Belgium direct
0800 890 033 - France direct 0800 890 034 - Spain direct
0800 890 036 - Hungary direct 0800 890 038 - Yugoslavia direct
0800 890 039 - Italy direct 0800 890 042 - Czechoslovakia direct
0800 890 043 - Austria direct 0800 890 045 - Denmark direct
0800 890 046 - Sweden direct 0800 890 047 - Norway direct
0800 890 049 - Germany direct 0800 890 055 - Brazil direct
0800 890 056 - Chile direct 0800 890 061 - Australia direct
0800 890 064 - New Zealand direct 0800 890 065 - Singapore direct
0800 890 066 - Thailand direct 0800 890 081 - Japan direct
0800 890 082 - Korea direct 0800 890 123 - Bermuda direct
0800 890 212 - Morocco direct 0800 890 852 - Hong Kong direct
These Lists where compiled by me yesterday (13/2/98) so they are pretty up to date.
* First Dial the country Direct number (You should heara beep when you dial it, this means it
is a CCITT5 Line)
* Then send Clear ahead Tone
* Then send Seize tone about 30 seconds after previous tone
* You Should hear a 'beep, ker-chunk'
* Then Send Either:
KP1 + Areacode + Number + ST : For Local calls in the country you dialled (Not very useful!)
OR
KP2 + CountryCode + AreaCode + Number +ST : International Calls! Wahey
BTW, England Country code is 44
Now you can have loads of fun with Trunks, dialling one countryto another etc... (Use your
imagination.
THIS DOES WORK AS OF TODAY (14/2/98) IN ENGLAND.
1.3 Beige Boxing
Beige Boxing is much easier, and safer than Blue boxing, but not as much fun.
First you must find a BT Cab box (Them Big green Metal Boxes nearyour house.)
You will need :
* A Torch
* Some Wire Snips
* A Beige Box
* A Hex Wrench
Firstly go and buy a fone. Get a self contained handset type one - like
the cheapest ones out of the Argos catalogue. Check for : tone/pulse
switching, a ringer on/off switch and PABX compatibility.
Now cut the modular jack from the fone lead with wireclippers. Leave
about 30cm of cord attached to the jack. Strip back a couple of inches of
insulation from the cord ends. It is possible to do this without getting all
cut up, because the gold pins of the jack can be prised out and new wires
added in, extending the reach of your fone; rather than diminishing it.
Inside the cord you will find three wires. I have finally torn up enough
fones to know that there is no attempt at convention in these matters. Get
some colour coded crocodile clips and solder them or crimp them on to the
wires of both the fone and the plug, after you expose a centimetre or so of
the wires core. This can be a pain, and is not really necessary if using
with an arsenal of dedicated line monitors. More later...
Now you need to determine which wire does what. Plug the jack into a wall
socket and attach up the crocodile clips to their coloured counterparts. You
will notice that only two wires are required for a dial tone. Make a note
of it so you aren't fumbling around on the job. I removed the crocs from
the third wire (which is basically your ring indication) to make life easy.
Ring indication is not necessary with a line monitor.
Ok now go out,at night (The use for the torch) and open the Bolts with the Hex Wrench
(Preferably 13mm)
Just clip your Beige Box onto one of the cable pair's and Dial, As long as no-one else is using
the selected line, you should be able to get away,Scot-Free.
But when you do finish, please remember to Replace the Bolts!!!!!
1.4 Other Boxes
As far as other boxes go in the u.k, most of them DON'T WORK. I do have my suspicions about the
Red-Box though, so here are the tones, gained from the alt.ph.uk Newsgroup FAQ.
10p Length 200 milliseconds, Frequency 1000Hz.
20p 2 * The Above.
50p Length 350 milliseconds, Frequency 1000Hz.
1ukp 2 * The Above.
You will have to getthe Operatore to connect your call ("My #8 and #1 button are fucked" always works!
;-)
Then blast the tones when they ask for the cash.
I also think the Party, Also the Neon box should work, here is the early schematics for a Neon
(Sorry about the Caps, it's old, but it SHOULD WORK!)
A NEON BOX IS A VERY SIMPLE ADJUSTMENT TO YOUR FONE, THAT WILL ALLOW A VERY
CLEAR PASSAGE FROM YOUR COMPUTER TONES TO YOUR FONE. IT ALSO WORKS GREAT FOR
RECORDING TONES, SEX FONE, OR ANYTHING ELSE YOU WANT TO RECORD OFF OF YOUR
FONE.
TOOLS:
------
THIS MODIFICATION IS VERY SIMPLE, AND CAN BE USED ON MOST FONES, THOUGH IT IS
MORE DIFFICULT ON ONE-PIECE UNITS. ALL YOU NEED IS AN OLD PAIR OF HEADFONES,
OR SIMILAR, A FILIPS SCREW- DRIVER, A SOLDERING IRON AND SOME SOLDER.
INSTRUCTIONS
------------
OPEN YOUR FONE WITH THE SCREWDRIVER. WHEN OPENED, LOOK FOR THE RED AND BLACK
WIRES THAT LEAD TO THE MOUTH- PIECE. (IF YOU'RE NOT SURE WHICH WIRES LEAD TO
THE MOUTHPIECE, OPEN UP THE MOUTHPIECE AND FIND THE SAME COLOR WIRES ON THE
BASE. FOR ONE-PIECE UNITS, JUST LOCATE THE MOUTHPIECE).
WHEN YOU HAVE FOUND THE MOUTHPIECE, OR WIRES, CUT THE EARD OF THE HEAD- FONES
OFF, AND ONE WIRE (THE ONE THAT LEADS TO THE RIGHT EAR). STRIP THE LEFT WIRE
SO ABOUT AN EIGHTH INCH IS SHOWING. KEEP THE OTHER SIDE IN TACT.
THEN ON THE RED WIRE, SOLDER THE WIRE THAT IS SEPARATLY SEALED FROM THE OTHER
ONE. ON THE BLACK WIRE (THESE ARE THE ENDS OF THE WIRE ON THE CIR- CUIT BOARD)
SOLDER THE WAIRE WRAPPED AROUND THE OTHER WIRE. THEN SOLDER A HOLE FOR THE
WIRE. YOU HAVE NOW MADE A NEON BOX.
2.0 Phone Numbers
Okay now come's the strangest part of the file, EVERYBODY should know what a fone # is!.
When i wrote this i meant what are some strange phone numbers Well:
17070 is a personal Fave, it is the Something or other Test line
* It is free
* it has Call Back
* it has a test to show what number you are using (Perfect for Beige Boxing ;-)
175 and 176 only work in certain place's now, they are sorta the same as 17070
This section is quite small as all the cool numbers have been removed.
2.1 0800 Numbers
As already stated Country Direct numbers are 0800,here are some more strange #'s
0800890XXX Scan 000-105
scanned on 6/12/97
0800777555 - VMB Toyota passcode is box number
0800890002 - Noted
0800890003 - Foreign crap
0800890005 - VMB
0800890008 - Carrier (Noted)
0800890010 - asks for card No.
0800890011 - AT & T
0800890013 - asks for pin no.
0800890016 - canada
0800890028 - foreign
0800890031 - may be boxible
0800890032 - may be boxible
0800890033 - french telecome
0800890034 - spanish
0800890035 - busy
0800890036 - voice
0800890037 - asks for pin no.
0800890038 - voice
0800890039 - italian telecom
0800890041 - swiss telecome
0800890042 - some foreign tele
0800890043 - german
0800890044 - Carrier (Noted)
0800890045 - denmarc telecome
0800890046 - foreign telco
0800890047 - foreign
0800890048 - picked up
0800890049 - foreign telco
0800890051 - may be boxible
0800890052 - may be boxible
0800890053 - Carrier (Noted)
0800890055 - foriegn
0800890056 - may be boxible
0800890059 - may be boxible
0800890060 - foriegn
0800890061 - telstra astralia
0800890062 - may be boxible
0800890063 - asksfornocalling
0800890064 - nz tellecom calling card No
0800890065 - singapore telco
0800890066 - foriegn
0800890068 - asks for pin
0800890070 - funy beeps
0800890072 - AT & T
0800890078 - Fax
0800890080 - foreign operator
0800890081 - japan direct
0800890082 - foriegn
0800890084 - foriegn telco
0800890085 - callingcard Hong Kong
0800890088 - foriegn
0800890089 - Carrier (Noted)
0800890095 - funy beeps
0800890098 - french telecom
0800890101 - funy beeps
0800890105 - asks for pin no
-------------------------------------------------
0800890XXX Scan 105-300
scaned 7/12/97
0800890106 - foriegn
0800890111 - Fax
0800890112 - Carrier (Noted)
0800890115 - Carrier (Noted)
0800890116 - may be boxible
0800890117 - AT & T
0800890120 - AT & T
0800890122 - AT & T
0800890123 - faint voice
0800890130 - VMB
0800890131 - VMB
0800890132 - voice
0800890134 - AT & T
0800890135 - May be boxible
0800890136 - Honk Kong Telecom
0800890139 - busy
0800890140 - AT & T
0800890141 - AT & T
0800890142 - AT & T
0800890143 - AT & T
0800890144 - AT & T
0800890145 - MCI
0800890146 - MCI
0800890147 - MCI
0800890148 - MCI
0800890149 - AT & T
0800890150 - funy beeps
0800890154 - VMB
0800890155 - funy beeps
0800890161 - Carrier (Noted)
0800890162 - AT & T
0800890163 - AT & T
0800890164 - AT & T
0800890165 - AT & T
0800890166 - AT & T
0800890167 - AT & T
0800890168 - AT & T
0800890169 - AT & T
0800890175 - AT & T
0800890176 - AT & T
0800890178 - VOICE
0800890179 - AT & T
0800890180 - AT & T
0800890181 - ASKS FOR CC No
0800890182 - Karea Telecom
0800890183 - AT & T
0800890187 - AT & T
0800890188 - Foreign
0800890191 - AT & T
0800890192 - AT & T
0800890195 - AT & T
0800890204 - funy beeps
0800890210 - calling Card No
0800890211 - AT & T
0800890212 - voice
0800890214 - foriegn voice
0800890216 - AT & T canada
0800890220 - country direct No
18:11 14/02/98
Another Personal Fave is
0800 89 0180 Which ask for a Credit Card # (HAHAHAH use a fake one!)
3.0 Phone Boxes
BT Phone boes have always been the bane of U.K Phreakers. They are pretty well secured now,
but older models have a serious flaw,
the conection between the handpiece and the box was crap, it could be cut with a junior hacksaw,
so, if u drive out into the countryside and find a vacant phonebox you can do 1 of 3 things.
* Hack the casing of the Handset-box lead, revealing wires, one of these controls Coin return,
Coin collect etc..
* Use a car jack under the money box (Black with round circles) and smash it open.
* Or try and Blue box throguh it, it may work, if the box is old enough.
3.1 Cocots are Customer Owned payphones, that are connected to a normal line (just like
your usual fone, except that
* The phone conected is a pay fone
* It is more expensove than a usual BT pay fone.
This is because the customer who owns it has to pay BT then make a profit as well.
This brings up numerous oppurtunities.
The best is to:
Walk into a local: Hospital, School, Debenhams, etc...
Find the public payphone, make sure it ISNT BT, ie: no markings whatsoever
Find where it is plugged in, In most Schools it is hard wired, SO u mustcut the wires
and use a beige box.
In Debnhams or Hospitals it is usually just a phone jack,so unplug it and plug in your own
phone! Dial away.
Another Trick i discoevered is this, the dial tone you get when you pick up the handset ISNT
a BT tone, it is generated by the COCOT,when you dial and you are connected it reverts to the
usual BT Dial tone. To get past this try.
Either Dialing an 0800 # (0800 24 25 26 Works best ;-)) and letting them hangup,
then blast the DTMF tones down the line
OR
Try Dialing a normal Local number then pressing # to change to DTMF and dialing.
4.0 Cards
4.1 Phone cards.
Bt phone cards are surrpounded in myths, the best i heard was that you could coverthe black strip
in a reflective coating ie: nail varnish, then re-use it, this is BOLLOCKS.
The only way to re-use the cards now is by somehow, shorting the chip. Maybe someone
could design a De-polariser or something?
4.2 Charge Cards
These come in 3 flavours, Home, National and international
The home has the number and pin on one card
The national has the number on a card, and the pin comes in the post.
My favourite trick is to stand by a phone box in an airport etc..
and watch the people typing in there numbers, if they type a normal fone number in after it, write
down the chargecard number and pin ,they should pasuse after typing these in, so u have time to
write them down!
4.3 Credit Cards.
WARNING: CREDIT CARD FRAUD IS A SERIOUS OFFENCE, I SHOULD KNOW!!!
Now on with the file.
First things first, the easiest way to avbuse these babies is to find a CC maker, then
make a few VISA and MASTERCARD numbers. Then try a load of Country Direct
#'s till you find one that accepts CC's. Give them the numberand a fake expiry dat.
ie: 01/99
Then give them the fone number, making sure you add 01 + country code + area code + number
You can also order goods on fake cc's #'s.
JUST DON'T SEND IT TO YOUR HOUSE!!
This File is for Educational Purposes only. The author will not accept any liability for
misuse of this information
February 14 1998 - Static Crash
Information is Free
This File is Dedicated to Teri-Ann, You know who you are.
Also greets to, The Sorceror, Elvis, Gambit, Chickaboo and Elly!!