============================================================================== ========== TAP MAGAZINE ISSUES 1-5 COURTESY OF PPS:206-783-9798 ========== ============================================================================== EXCHANGE SCANNING (99XX) Almost every exchange in the Bell System has test #'s and other "goodies" such as loops with dial-ups. These "goodies" are usually found between 9900 and 9999 in your local exchange. If you have the time and initiative, scan your exchange and you may become lucky! Here are my findings in the 914-268 exchange: 9901 - Verifaction (recording of a/c and exchange) 9927 - Osc. tone (possible tone side of a loop) 9936 - Voice # to the telco central office 9937 - Voice # to the telco central office 9941 - Computer (digital voice transmission?) 9960 - Osc. tone (tone side loop -- may also be a computer in some exchanges 9961 - No response (other end of loop?) 9962 - No response (other end of loop?) 9963 - No response (other end of loop?) 9966 - Computer (see 9941) 9968 - Tone that disappears--responds to certain touch tone keys What you find depends upon the switching equipment in the exchange and the Telco operating company. Since I have done the above 914-268-99XX scan, Congers (268) has installed new switching equipment (DMS100). Some of the numbers are the same, but I have noticed that on the DMS100, the recordings are also stored in this area. 268-9903, 9906, & 9912 are all different recordings. Also, there are 2 fortress fone recordings at 268-9911 (deposit 5 cents or else) and 268-9913 (deposit 10 cents). In some areas (like Delaware), I have noticed that 9906-7 is ringback. If you find anything interesting, be sure to drop TAP a line. Have phun and remember it's only local call to see what your CO has in store for you! F.T.B.S. *****BIOC *=$=*Agent *****003 ------------------------------------------------------------------------------ HIGHWAY RADAR JAMMING Most drivers wanting to make better time on the open road will arm themselves with an expensive radar detector. However this device will not work against a gun type radar unit in which the radar signal is not present until the cop has you car in his sights and pull the trigger. Then it is too late to slow down. A better method is to continously jam any signal with a radar signal of your own. I have tested this idea with the cooperation of a local cop and found that his unit reads random numbers when your car approached him. It is suprisingly easy to make a low power radar transmitter. A nifty little semiconductor called a Gunn diode will generate microwaves when supplied with 5 to 10 vdc and enclosed in the correct size cavity (resonator). An 8 to 3 terminal regulator can be used to get this voltage from a car's system. However the correct construction and tuning of the cavity is difficult without good microwave measurement equipment. Police radars commonly operate on the K band at 22 ghz. or more often on the X band at 10.525 ghz. Most microwave intruder alarms and motion detectors (mounted over automatic doors in supermarkets, etc.) contain a Gunn type transmitter/receiver combination that transmits about 10 milliwatts at 10.525 ghz. These units work perfectly as jammers. If you can't get one locally write to Microwave Associates in Burlington, Mass. and ask for info on "Gunnplexers" for ham radio use. When you get the unit it may be mounted in a plastic box on the dash or in a weatherproof enclosure behind the plastic grille. Switch on the power when on the open highway. The unit will not jam radar to the side of behind the car so don't go speeding past the radar trap. An interesting phenomena you will notice is that drivers in front of you who are using detectors will hit their brakes as you approach large metal signs or bridges. Your signal is bouncing off these objects and triggering their detectors. Have fun... Ben Piper Reprinted from: TAP magazine, November 1983, Issue 88 ------------------------------------------------------------------------------ VENDING MACHINE KEYS By The Pyro This worked for a friend of mine at school (I would) never do anything like this) it got him over $900 in one day. Here's how to do it: On almost all vending machines they have those damn round almost unpickable locks on them so: When no one is looking quickly press a piece of AIR-HARDENING clay into the lock. (Press hard enough to get a good impression.) Remove the clay carefully and let it dry for however long the clay has to dry as specified on the package. You now have a key to fit that lock, (this Type of 'key' can be easily crushed if you're seen. But if you're smart you won't though) Have Phun!! Reprinted from: TAP magazine, December 1983, Issue 89 ------------------------------------------------------------------------------ Department Store Fun reprinted from TAP Magazine. By Agent 81. Many of the department stores in my area use a large plastic device stapled to the clothing as a security precaution. Several years ago, an adventurous friend of mine got ahold of one of thes somehow, and we took it apart. Inside was a heavy paper strip laminated to aluminum foil (?). As I recall, this paper strip was about half an inch wide and 3-1/2 inces long. When this device got close to a pillar or column at the exits of a store, an alarm would sound. My friend put this paper in his wallet, and we had a lot of fun wandering in and out of various stores at a local shopping center. We would enter when a group of people would enter, or exit with several other shoppers all together.. When we entered a local Sears in the shopping center in the main corrider of the indoor mall, a loud bell rang. A family with kids was just leaving. The nearest clerk ran out the entrance to look at everyone standing around. A plain clothes security guy appeared out of nowhere. Everyone had a good time. The next store we went in was also packed with people and the manager (?) got paranoid when the alarm went off. If you move about discreetly and don't wear a jacket or coat, you can liven up the busiest of stores. But don't go into an empty store with one of these in your wallet. That's a no-no. Could pleas secure a quantity of these paper strips and send them out with your next issue? Or offer them for sale? They can be great fun, especially in a Xmax shopping mob. The one we had came unlaminated and wouldn't work any more. This might be a great money maker for TAP. You may even want to devote an entire issue to this neat gadget. These strips could be left inside candy wrappers and in the bottem of a coke cup and placed near these detector columns or pillars. Put one in a plant near a pillar. The uses and fun could be end- less. A good senior class project would be to freak out every alarm in every store so equiped, at 2 PM some Saturday afternoon when the mall is really packed. Please have your security committee go to work on getting a couple million of these things so that everyone can have several. It's more fun than going to the movies. ------------------------------------------------------------------------------ Verification By Fred Steinbeck From TAP issue # 88 10-83 There has been a great deal of controversy in the realm of phreakdom over a mysterious subject known under a number of different names, including "Verification", "Autoverification", "Verify", "Autoverify", "Verify Busy", and even "VFY BY". All of these names basically mean the same thing: the ability to listen to another person's telephone line from any telephone in the direct- dialable world. Needless to say, Bell System is very tight lipped about knowledge regarding verification. Indeed, the infamous book 'Notes on long distance dialing' ('68 edition) says, "Care must be taken to insure that the customer never gains verification capabilities." With a printed policy like that, you can imagine what their real-world policy is like! Even their own rate and route operators will not give verification on routing codes (at least in my experience), one even responding, "What?! You must be crazy! We don't give those out!" Before you get too far into this article, I will state simply: I don't know how to verify. However, I have been fooling with various things related to it, and collecting information on it for some time now. Therefore, while I can't do it (yet), I may be able to point some other bright TAPer on the right track, and perhaps he or she will show us all how. If you have knowledge not covered in this article, but don't want to write an article on your own, please send your ideas, comments, or information to Project Verify, C/O TAP Verify has also been called "Autoverify", and I have no idea why. This is not, to my knowledge, a Bell System term (at least I've never seen it in any manuals) As far as I know, there is verify, which means being able to listen to speech (kind of; see below) on a line, and there is the "Emergency Interrupt which allows you to take part in the conversation taking place on the line in question. It has been suggested that "Autoverify" is the same as an emergency interrupt , but I tend to disagree with this idea. It should be noted that the verification circuitry does not actually let anoperator listen to a conver- sation without making a beep on the line every so often. Instead, she will hear encrypted sheech. However, I believe with the proper methods, verify can be converted to an emergency interupt. Verification is normally done either by your normal "0" (TSPS) operator, if the call is in your home NPA (HNPA), or by an inward operator (IO). If the call is outside your HNPA, your normal operator will call the IO for the NPA, and say, "Verify Busy" or "Emergency Interrupt" please, 555 1212." The IO will perform whatever magic he or she must, and then reprot back. If the call is in your HNPA, though, the "0" operator can do the verification himself by using the "VFY BY" key on her keyshelf. However, in some areas, the operator uses a routing code to accomplish verification, and this the loop hole we shall attack. It follows that if a IO or "0" operator can do it, so can we, with a blue box Now, courtesy of Robert Allen (who brought it to my attention) and Susan Thunder (who apparently discovered it), here is what used to work for getting operators to hook you into conversations with other perople (i.e.,let you lis- ten to them till you hung up): You'd call the operator and say "Operator, TSPS Maintenance Engineer Calling. Ring forward to 001 + NPA + 7d, ring back to my number, hit ring forward, no AMA, and then position release. This creates some problems, and you must be familiar with the TSPS console (by dialing "0"), you are on the "back", or incoming part of a loop. When she places a call for you, the call goes out on the "forward", or outgoing part of the loop. If an operator wants to make a call, she punches KP FWD (keypulse forward), the number, and ST. Ring FWD puts a 90 volt ringing signal across the forward part of the line (and may dial the number as well). The problem arises from the fact that I don't know if Ring FWD will actually dial a call, and if there is some other subtle difference between it an KP FWD. Let us assume ringing forwad makes a call from the TSPS console to whatever number is given. Ring back causes your phone to ring (it is assumed you hung up after giving her your instructions; if you didn't you'd hear an annoying 90 volts across the earpiece...) "No AMA" means "no automatic message account- ing", so nobody gets billed for the call, although it will show up on a tape somewhere. "Position Release" removes the operator from the ciruit, and allows her to receive other calls. This leaves an unaccounted-for ring forward. The verification ciruit, as you know, likes to encrypt coversation, whic is something we don't want. Well, the second Ring FWD sends another 90 volts crashing against the verify ciruitry, which Juda Gerad thinks removes the voice encryption from the line, puts the operator (and you) in circuit, and puts a beep tone on the line every five seconds. This seems to make sense, and I am inclined to agree with him. The bit about "....001 + NPA + 7D" causes the thought "MF routing code" to spring immediately to mind. Now, the above trick was supposed to work in the 213 NPA. I have tried both "KP+001+213+7D+ST", and some other area codes. I generally get nothing, a reorder signal, or a tandem recording. Here's some food for thought: On an official Telcoo sheet I have, labeled " 213 NPA MF Routing Codes", 001 is listed as "VFY BY", or verify busy for the 213 NPA. 002 is listed for the 805 NPA. Ma Bell likes to have standardized routing codes, such logical, then, that 001 would be a sort of "standard" verify code, and other prefixes would be tacked on at 002,003, etc. However, I have heard from a retired operator that verification codes ar different from area to area, and are not always nice numbers like 001, 002. Ah, well, a guy can hope, can't he? Some suggestions for future attacks on this dilemma: Everyone call your operators and subtley ask questions. I have found the tend to give information out easier if you ask for something that you would ordinarily have to be a company employee to know about, such as rate steps, operator routings, etc. Casually let slip that you used to be (or still are) an operator, or that you work for company security. Also, you might want to blue box some codes like 001 followed by your NPA and the last 7D of a busy number. If you get a sort of "whispery noise", try blasting the line with a ringing signal (you might piggyback another line onto yours and call the piggyback to generate the 90 volts) and see if that does anything. Don't forget tos send in any scraps of info, no matter how mundane to Project Verify c/o TAP Room 603, 147 west 42 St. New York City, 10036 The PIRATES HOLLOW 415-236-2371 ;( X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X Another file downloaded from: NIRVANAnet(tm) &TOTSE 510/935-5845 Walnut Creek, CA Taipan Enigma Burn This Flag 408/363-9766 San Jose, CA Zardoz realitycheck 415/666-0339 San Francisco, CA Poindexter Fortran Governed Anarchy 510/226-6656 Fremont, CA Eightball New Dork Sublime 805/823-1346 Tehachapi, CA Biffnix Lies Unlimited 801/278-2699 Salt Lake City, UT Mick Freen Atomic Books 410/669-4179 Baltimore, MD Baywolf Sea of Noise 203/886-1441 Norwich, CT Mr. Noise The Dojo 713/997-6351 Pearland, TX Yojimbo Frayed Ends of Sanity 503/965-6747 Cloverdale, OR Flatline The Ether Room 510/228-1146 Martinez, CA Tiny Little Super Guy Hacker Heaven 860/456-9266 Lebanon, CT The Visionary The Shaven Yak 510/672-6570 Clayton, CA Magic Man El Observador 408/372-9054 Salinas, CA El Observador Cool Beans! 415/648-7865 San Francisco, CA G.A. Ellsworth DUSK Til Dawn 604/746-5383 Cowichan Bay, BC Cyber Trollis The Great Abyss 510/482-5813 Oakland, CA Keymaster "Raw Data for Raw Nerves" X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X