[ News ] [ Paper Feed ] [ Issues ] [ Authors ] [ Archives ] [ Contact ]

..[ Phrack Magazine ]..
.:: The #hack FAQ (Part 2) ::.

Issues: [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ] [ 6 ] [ 7 ] [ 8 ] [ 9 ] [ 10 ] [ 11 ] [ 12 ] [ 13 ] [ 14 ] [ 15 ] [ 16 ] [ 17 ] [ 18 ] [ 19 ] [ 20 ] [ 21 ] [ 22 ] [ 23 ] [ 24 ] [ 25 ] [ 26 ] [ 27 ] [ 28 ] [ 29 ] [ 30 ] [ 31 ] [ 32 ] [ 33 ] [ 34 ] [ 35 ] [ 36 ] [ 37 ] [ 38 ] [ 39 ] [ 40 ] [ 41 ] [ 42 ] [ 43 ] [ 44 ] [ 45 ] [ 46 ] [ 47 ] [ 48 ] [ 49 ] [ 50 ] [ 51 ] [ 52 ] [ 53 ] [ 54 ] [ 55 ] [ 56 ] [ 57 ] [ 58 ] [ 59 ] [ 60 ] [ 61 ] [ 62 ] [ 63 ] [ 64 ] [ 65 ] [ 66 ] [ 67 ] [ 68 ]
Current issue : #47 | Release date : 1995-04-15 | Editor : Erik Bloodaxe
IntroductionErik Bloodaxe
Phrack LoopbackPhrack Staff
Line NoisePhrack Staff
Line NoisePhrack Staff
The #hack FAQ (Part 1)voyager
The #hack FAQ (Part 2)voyager
The #hack FAQ (Part 3)voyager
The #hack FAQ (Part 4)voyager
DEFCon InformationPhrack Staff
HoHoConNetta Gilboa
HoHoConCount Zero
HoHo Miscellanyvarious
An Overview of Prepaid Calling CardsTreason
The Glenayre GL3000 Paging and Voice Retrieval SystemArmitage
Complete Guide to Hacking Meridian Voice MailSubstance
DBS Primer from American Hacker Magazineunknown
Your New Windows Background (Part 1)The Man
Your New Windows Background (Part 2)Substance
A Guide To British Telecom's Caller ID ServiceDr. B0B
A Day in The Life of a Warez BrokerXxxx Xxxxxxxx
International Scenesvarious
Phrack World NewsDatastream Cowboy
Title : The #hack FAQ (Part 2)
Author : voyager
                              ==Phrack Magazine==

                 Volume Six, Issue Forty-Seven, File 6 of 22

18. What is an Internet Outdial?

An Internet outdial is a modem connected to the Internet than you can
use to dial out.  Normal outdials will only call local numbers.  A GOD
(Global OutDial) is capable of calling long distance.  Outdials are an
inexpensive method of calling long distance BBS's.

19. What are some Internet Outdials?

This FAQ answer is excerpted from CoTNo #5:

			Internet Outdial List v3.0
			 by Cavalier and DisordeR

There are several lists of Internet outdials floating around the net these
days. The following is a compilation of other lists, as well as v2.0 by
DeadKat(CoTNo issue 2, article 4). Unlike other lists where the author
just ripped other people and released it, we have sat down and tested
each one of these. Some of them we have gotten "Connection Refused" or
it timed out while trying to connect...these have been labeled dead.

			   Working Outdials
			    as of 12/29/94

NPA          IP Address                   Instructions
---          ----------                   ------------
215          isn.upenn.edu                modem

217          dialout.cecer.army.mil       atdt x,xxxXXXXX

218          modem.d.umn.edu              atdt9,xxxXXXX

303          yuma.acns.colostate.edu 3020

412          gate.cis.pitt.edu            tn3270, 
					  connect dialout.pitt.edu, 

413          dialout2400.smith.edu        Ctrl } gets ENTER NUMBER: xxxxxxx

502          outdial.louisville.edu

502          uknet.uky.edu                connect kecnet
                                          @ dial: "outdial2400 or out"

602          acssdial.inre.asu.edu        atdt8,,,,,[x][yyy]xxxyyyy

614          ns2400.acs.ohio-state.edu

614          ns9600.acs.ohio-state.edu

713               atdt x,xxxXXXX

714          modem.nts.uci.edu            atdt[area]0[phone]

804          ublan.virginia.edu           connect hayes, 9,,xxx-xxxx

804          ublan2.acc.virginia.edu      connect telnet
                                          connect hayes

                           Need Password

206          rexair.cac.washington.edu    This is an unbroken password
303          yuma.ACNS.ColoState.EDU      login: modem
404                .modem8|CR
415          annex132-1.EECS.Berkeley.EDU "dial1" or "dial2" or "dialer1"
514          cartier.CC.UMontreal.CA      externe,9+number
703          wal-3000.cns.vt.edu          dial2400 -aa

                          Dead/No Connect

201          idsnet
202          modem.aidt.edu
204          dial.cc.umanitoba.ca
204          umnet.cc.manitoba.ca         "dial12" or "dial24"
206          dialout24.cac.washington.edu
207          modem-o.caps.maine.edu
212          B719-7e.NYU.EDU              dial3/dial12/dial24
212          B719-7f.NYU.EDU              dial3/dial12/dial24
212          DIALOUT-1.NYU.EDU            dial3/dial12/dial24
212          FREE-138-229.NYU.EDU         dial3/dial12/dial24
212          UP19-4b.NYU.EDU              dial3/dial12/dial24
215          wiseowl.ocis.temple.edu      "atz" "atdt 9xxxyyyy"
218          aa28.d.umn.edu               "cli" "rlogin modem"
                                          at "login:"  type "modem"
218          modem.d.umn.edu              Hayes 9,XXX-XXXX
301          dial9600.umd.edu
305          alcat.library.nova.edu
305          office.cis.ufl.edu
307          modem.uwyo.edu               Hayes  0,XXX-XXXX
313                     dial2400-aa or dial1200-aa
                                          or dialout
402          dialin.creighton.edu
402          modem.criegthon.edu
404          broadband.cc.emory.edu       ".modem8" or ".dialout"
408          dialout.scu.edu
408          dialout1200.scu.edu
408          dialout2400.scu.edu
408          dialout9600.scu.edu
413          dialout.smith.edu
414          modems.uwp.edu
416          annex132.berkely.edu         atdt 9,,,,, xxx-xxxx
416          pacx.utcs.utoronto.ca        modem
503          dialout.uvm.edu
513          dialout24.afit.af.mil
513          r596adi1.uc.edu
514          pacx.CC.UMontreal.CA         externe#9 9xxx-xxxx
517          engdial.cl.msu.edu
602          dial9600.telcom.arizona.edu
603          dialout1200.unh.edu
604          dial24-nc00.net.ubc.ca
604          dial24-nc01.net.ubc.ca
604          dial96-np65.net.ubc.ca
604          gmodem.capcollege.bc.ca
604          hmodem.capcollege.bc.ca
609 (X= 1 - 4)   Hayes
609  (x = 1 to 4)
609          wright-modem-1.rutgers.edu
609          wright-modem-2.rutgers.edu
612          modem_out12e7.atk.com
612          modem_out24n8.atk.com
614          ns2400.ircc.ohio-state.edu   "dial"
615          dca.utk.edu                  dial2400 D 99k #
615          MATHSUN23.MATH.UTK.EDU       dial 2400  d  99Kxxxxxxx
616          modem.calvin.edu
617                  2400baud
617          dialout.lcs.mit.edu
617          dialout1.princeton.edu
617          isdn3.Princeton.EDU
617          jadwingymkip0.Princeton.EDU
617          lord-stanley.Princeton.EDU
617          mpanus.Princeton.EDU
617          mrmodem.wellesley.edu
617          old-dialout.Princeton.EDU
617          stagger.Princeton.EDU
617          sunshine-02.lcs.mit.edu
617          waddle.Princeton.EDU
619                  atdt [area][phone]
619          dialin.ucsd.edu              "dialout"
703          modem_pool.runet.edu
703          wal-3000.cns.vt.edu
713               "c modem96"  "atdt 9xxx-xxxx"
                                          or "Hayes"
713          modem12.bcm.tmc.edu
713          modem24.bcm.tmc.edu
713          modem24.bcm.tmc.edu
714          mdmsrv7.sdsu.edu             atdt 8xxx-xxxx
714          modem24.nts.uci.edu
714          pub-gopher.cwis.uci.edu
801          dswitch.byu.edu              "C Modem"
808          irmodem.ifa.hawaii.edu
902          star.ccs.tuns.ca             "dialout"
916          cc-dnet.ucdavis.edu          connect hayes/dialout
916          engr-dnet1.engr.ucdavis.edu  UCDNET <ret> C KEYCLUB <ret>
???              (1 - 4)
???                  nue, X to discontinue, ? for Help
???                  ntu            <none>
???          annexdial.rz.uni-duesseldorf.de
???          dial96.ncl.ac.uk
???          dialout.plk.af.mil
???          ee21.ee.ncu.edu.tw           cs8005
???          im.mgt.ncu.edu.tw            guest           <none>
???          modem.cis.uflu.edu
???          modem.ireq.hydro.qc.ca
???          modems.csuohio.edu
???          sparc20.ncu.edu.tw           u349633
???          sun2cc.nccu.edu.tw           ?
???          ts-modem.une.oz.au
???          twncu865.ncu.edu.tw          guest           <none>
???          vtnet1.cns.ut.edu            "CALL" or "call"

If you find any of the outdials to have gone dead, changed commands,
or require password, please let us know so we can keep this list as
accurate as possible. If you would like to add to the list, feel free
to mail us and it will be included in future versions of this list,
with your name beside it. Have fun...

[Editors note: Updates have been made to this document after
               the original publication]

20. What is this system?

IBM AIX Version 3 for RISC System/6000
(C) Copyrights by IBM and by others 1982, 1990.

[You will know an AIX system because it is the only Unix system that]
[clears the screen and issues a login prompt near the bottom of the]


Once in, type GO MAIN

CDC Cyber

88/02/16. 02.36.53. N265100
CSUS CYBER 170-730.                     NOS 2.5.2-678/3.

You would normally just hit return at the family prompt.  Next prompt is:


CISCO Router
                             FIRST BANK OF TNO
                           95-866 TNO VirtualBank
                          REMOTE Router -  TN043R1

                                Console Port

                                SN - 00000866


DECserver 700-08 Communications Server V1.1 (BL44G-11A) - LAT V5.1

(c) Copyright 1992, Digital Equipment Corporation - All Rights Reserved

Please type HELP if you need assistance

Enter username> TNO


Hewlett Packard MPE-XL







Lantronix Terminal Server
Lantronix ETS16 Version V3.1/1(940623)

Type HELP at the 'Local_15> ' prompt for assistance.

Login password>

Meridian Mail (Northern Telecom Phone/Voice Mail System)
                            MMM       MMMERIDIAN
                           MMMMM     MMMMM
                         MMMMMM   MMMMMM
                        MMM  MMMMM  MMM     MMMMM     MMMMM
                      MMM   MMM   MMM     MMMMMM   MMMMMM
                     MMM         MMM     MMM MMM MMM MMM
                    MMM         MMM     MMM  MMMMM  MMM
                   MMM         MMM     MMM   MMM   MMM
                  MMM         MMM     MMM         MMM
                 MMM         MMM     MMM         MMM
                MMM         MMM     MMM         MMM
               MMM         MMM     MMM         MMM
              MMM         MMM     MMM         MMM

                                          Copyright (c) Northern Telecom, 1991

Novell ONLAN

[To access the systems it is best to own a copy of ONLAN/PC]


[To access the systems it is best to own a copy of PCAnywhere Remote]


<any text>



Primenet V 2.3  (system)
LOGIN           (you)
User id?        (system)
SAPB5           (you)
Password?       (system)
DROWSAP         (you)
OK,             (system)

MARAUDER10292  01/09/85(^G) 1 03/10/87  00:29:47

Login: root

Login: browse

Software Version: G3s.b16.2.2

Terminal Type (513, 4410, 4425): [513]

NIH Timesharing

NIH Tri-SMP 7.02-FF  16:30:04 TTY11
system 1378/1381/1453 Connected to Node Happy(40) Line # 12
Please LOGIN



                                          TBVM2 VM/ESA Rel 1.1     PUT 9200

Fill in your USERID and PASSWORD and press ENTER
(Your password will not appear when you type it)
USERID   ===>


Xylogics Annex Communications Server
Annex Command Line Interpreter   *   Copyright 1991 Xylogics, Inc.

Checking authorization, Please wait...
Annex username: TNO
Annex password:

Permission granted

21. What are the default accounts for XXX?

guest           guest

qsecofr         qsecofr         /* master security officer */
qsysopr         qsysopr         /* system operator         */
qpgmr           qpgmr           /* default programmer      */




Dynix (The library software, not the UnixOS)
(Type 'later' to exit to the login prompt)
setup           <no password>
library         <no password>
circ            <9 digit number>

Hewlett Packard MPE-XL
HELLO           MGR.SYS
MGR             CAROLIAN
MGR             CCC
MGR             CNAS
MGR             CONV
MGR             COGNOS
MGR             HPDESK
MGR             HPWORD
FIELD           HPWORD
MGR             HPOFFICE
MAIL            HPOFFICE
WP              HPOFFICE
MGR             HPONLY
FIELD           HPP187
MGR             HPP187
MGR             HPP189
MGR             HPP196
MGR             INTX3
MGR             ITF3000
MANAGER         ITF3000
MAIL            MAIL
MGR             NETBASE
MGR             REGO
MGR             RJE
MGR             ROBELLE
MGR             SECURITY
MGR             SYS
PCUSER          SYS
MAIL            TELESUP
MGR             TELESUP
SYS             TELESUP
MGE             VESOFT
MGE             VESOFT
MGR             WORD
MGR             XLSERVER

Common jobs are Pub, Sys, Data
Common passwords are HPOnly, TeleSup, HP, MPE, Manager, MGR, Remote

Major BBS
Sysop           Sysop

Mitel PBX

Nomadic Computing Environment (NCE) on the Tadpole Technologies SPARCBook3
fax             <no password>

DSA             # Desquetop System Administrator

PBX             PBX
NETOP           <null>

CBX Defaults

op              op
op              operator
su              super
admin           pwp
eng             engineer

PhoneMail Defaults

sysadmin        sysadmin
tech            tech
poll            tech

1,1/system      (Directory [1,1] Password SYSTEM)

Default accounts for Micro/RSX:


Alternately you can hit <CTRL-Z>  when the boot sequence asks you for the
date and create an account using:

	    or  RUN $ACNT

(Numbers below 10 {oct} are Priveleged)

Reboot and wait for the date/time question. Type ^C and at the MCR prompt,
type "abo at." You must include the . dot!

If this works, type "acs lb0:/blks=1000" to get some swap space so the
new step won't wedge.

type " run $acnt" and change the password of any account with a group
number of 7 or less.

You may find that the ^C does not work. Try ^Z and ESC as well.
Also try all 3 as terminators to valid and invalid times.

If none of the above work, use the halt switch to halt the system,
just after a invalid date-time.  Look for a user mode PSW 1[4-7]xxxx.
then deposit 177777 into R6, cross your fingers, write protect the drive
and continue the system.  This will hopefully result in indirect blowing
up...  And hopefully the system has not been fully secured.

SGI Irix
4DGifts         <no password>
guest           <no password>
demos           <no password>
lp              <no password>
nuucp           <no password>
tour            <no password>
tutor           <no password>

System 75
bcim            bcimpw
bciim           bciimpw
bcms            bcmspw, bcms
bcnas           bcnspw
blue            bluepw
browse          looker, browsepw
craft           crftpw, craftpw, crack
cust            custpw
enquiry         enquirypw
field           support
inads           indspw, inadspw, inads
init            initpw
kraft           kraftpw
locate          locatepw
maint           maintpw, rwmaint
nms             nmspw
rcust           rcustpw
support         supportpw
tech            field

Taco Bell
rgm             rollout
tacobell        <null>

Verifone Junior 2.05
Default password: 166816

field           service
systest         utep

XON / XON Junior
Default password: 166831

22. What port is XXX on?

The file /etc/services on most Unix machines lists the port
assignments for that machine.  For a complete list of port
assignments, read RFC (Request For Comments) 1700 "Assigned Numbers"

23.  What is a trojan/worm/virus/logic bomb?

This FAQ answer was written by Theora:


Remember the Trojan Horse?  Bad guys hid inside it until they could
get into the city to do their evil deed.  A trojan computer program is
similar.  It is a program which does an unauthorized function, hidden
inside an authorized program.  It does something other than what it
claims to do, usually something malicious (although not necessarily!),
and it is intended by the author to do whatever it does.  If it's not
intentional, its called a 'bug' or, in some cases, a feature :) Some
virus scanning programs detect some trojans.  Some virus scanning
programs don't detect any trojans.  No virus scanners detect all


A virus is an independent program which reproduces itself.  It may
attach to other programs, it may create copies of itself (as in
companion viruses).  It may damage or corrupt data, change data, or
degrade the performance of your system by utilizing resources such as
memory or disk space.  Some virus scanners detect some viruses.  No
virus scanners detect all viruses.  No virus scanner can protect
against "any and all viruses, known and unknown, now and forevermore".


Made famous by Robert Morris, Jr. , worms are programs which reproduce
by copying themselves over and over, system to system, using up
resources and sometimes slowing down the systems.  They are self
contained and use the networks to spread, in much the same way viruses
use files to spread.  Some people say the solution to viruses and
worms is to just not have any files or networks.  They are probably
correct.  We would include computers.

Logic Bomb:

Code which will trigger a particular form of 'attack' when a
designated condition is met.  For instance, a logic bomb could delete
all files on Dec.  5th.  Unlike a virus, a logic bomb does not make
copies of itself.

24.  How can I protect myself from viruses and such?

This FAQ answer was written by Theora:

The most common viruses are boot sector infectors.  You can help
protect yourself against those by write protecting all disks which you
do not need write access to.  Definitely keep a set of write protected
floppy system disks.  If you get a virus, it will make things much
simpler.  And, they are good for coasters.  Only kidding.

Scan all incoming files with a recent copy of a good virus scanner.
Among the best are F-Prot, Dr.  Solomon's Anti-virus Toolkit, and
Thunderbyte Anti-Virus.  AVP is also a good proggie.  Using more than
one scanner could be helpful.  You may get those one or two viruses
that the other guy happened to miss this month.

New viruses come out at the rate of about 8 per day now.  NO scanner
can keep up with them all, but the four mentioned here do the best job
of keeping current.  Any _good_ scanner will detect the majority of
common viruses.  No virus scanner will detect all viruses.

Right now there are about 5600 known viruses.  New ones are written
all the time.  If you use a scanner for virus detection, you need to
make sure you get frequent updates.  If you rely on behaviour
blockers, you should know that such programs can be bypassed easily by
a technique known as tunnelling.

You may want to use integrity checkers as well as scanners.  Keep in
mind that while these can supply added protection, they are not

You may want to use a particular kind of scanner, called resident
scanners.  Those are programs which stay resident in the computer
memory and constantly monitor program execution (and sometimes even
access to the files containing programs).  If you try to execute a
program, the resident scanner receives control and scans it first for
known viruses.  Only if no such viruses are found, the program is
allowed to execute.

Most virus scanners will not protect you against many kinds of
trojans, any sort of logic bombs, or worms.  Theoretically, they
_could_ protect you against logic bombs and/or worms, by addition of
scanning strings; however, this is rarely done.

The best, actually only way, to protect yourself is to know what you
have on your system and make sure what you have there is authorised by
you.  Make freqent backups of all important files.  Keep your DOS
system files write protected.  Write protect all disks that you do not
need to write to.  If you do get a virus, don't panic.  Call the
support department of the company who supplies your anti-virus product
if you aren't sure of what you are doing.  If the company you got your
anti-virus software from does not have a good technical support
department, change companies.

The best way to make sure viruses are not spread is not to spread
them.  Some people do this intentionally.  We discourage this. Viruses
aren't cool.

25.  Where can I get more information about viruses?

This FAQ answer was written by Theora:

Assembly lanaguage programming books illustrate the (boring) aspect of
replication and have for a long time.  The most exciting/interesting
thing about viruses is all the controversy around them.  Free speech,
legality, and cute payloads are a lot more interesting than "find
first, find next" calls.  You can get information about the technical
aspects of viruses, as well as help if you should happen to get a
virus, from the virus-l FAQ, posted on comp. virus every so often.
You can also pick up on the various debates there.  There are
alt.virus type newsgroups, but the level of technical expertise is
minimal, and so far at least there has not been a lot of real "help"
for people who want to get -rid- of a virus.

There are a lot of virus experts.  To become one, just call yourself
one.  Only Kidding.  Understanding viruses involves understanding
programming, operating systems, and their interaction.  Understanding
all of the 'Cult of Virus' business requires a lot of discernment.
There are a number of good papers available on viruses, and the Cult
of Virus; you can get information on them from just about anyone
listed in the virus-l FAQ.  The FTP site ftp.informatik.uni-hamburg.de
is a pretty reliable site for proggies and text.

26. What is Cryptoxxxxxxx?

This FAQ answer is excerpted from: Computer Security Basics
                                   by Deborah Russell
                                   and G.T. Gengemi Sr.

A message is called either plaintext or cleartext.  The process of
disguising a message in such a way as to hide its substance is called
encryption.  An encrypted message is called ciphertext.  The process
of turning ciphertext back into plaintext is called decryption.

The art and science of keeping messages secure is called cryptography,
and it is practiced by cryptographers.  Cryptanalysts are
practitioners of cryptanalysis, the art and science of breaking
ciphertext, i.e. seeing through the disguise.  The branch of
mathematics embodying both cryptography and cryptanalysis is called
cryptology, and it's practitioners are called cryptologists.

27. What is PGP?

This FAQ answer is excerpted from: PGP(tm) User's Guide
                                   Volume I: Essential Topics
                                   by Philip Zimmermann

PGP(tm) uses public-key encryption to protect E-mail and data files.
Communicate securely with people you've never met, with no secure
channels needed for prior exchange of keys.  PGP is well featured and
fast, with sophisticated key management, digital signatures, data
compression, and good ergonomic design.

Pretty Good(tm) Privacy (PGP), from Phil's Pretty Good Software, is a
high security cryptographic software application for MS-DOS, Unix,
VAX/VMS, and other computers.  PGP allows people to exchange files or
messages with privacy, authentication, and convenience.  Privacy means
that only those intended to receive a message can read it.
Authentication means that messages that appear to be from a particular
person can only have originated from that person. Convenience means
that privacy and authentication are provided without the hassles of
managing keys associated with conventional cryptographic software.  No
secure channels are needed to exchange keys between users, which makes
PGP much easier to use.  This is because PGP is based on a powerful
new technology called "public key" cryptography.

PGP combines the convenience of the Rivest-Shamir-Adleman (RSA)
public key cryptosystem with the speed of conventional cryptography,
message digests for digital signatures, data compression before
encryption, good ergonomic design, and sophisticated key management. 
And PGP performs the public-key functions faster than most other
software implementations.  PGP is public key cryptography for the

28. What is Tempest?

Tempest stands for Transient Electromagnetic Pulse Surveillance

Computers and other electronic equipment release interference to their
surrounding environment.  You may observe this by placing two video
monitors close together.  The pictures will behave erratically until
you space them apart.

Although most of the time these emissions are simply annoyances, they
can sometimes be very helpful.  Suppose we wanted to see what project
a target was working on.  We could sit in a van outside her office and
use sensitive electronic equipment to attempt to pick up and decipher
the emanations from her video monitor.

Our competitor, however, could shield the emanations from her
equipment or use equipment without strong emanations.

Tempest is the US Government program for evaluation and endorsement
of electronic equipment that is safe from eavesdropping.

29. What is an anonymous remailer?

An anonymous remailer is a system on the Internet that allows you to
send e-mail anonymously or post messages to Usenet anonymously.

You apply for an anonymous ID at the remailer site.  Then, when you
send a message to the remailer, it sends it out from your anonymous ID
at the remailer.  No one reading the post will know your real account
name or host name.  If someone sends a message to your anonymous ID,
it will be forwarded to your real account by the remailer.

30. What are the addresses of some anonymous remailers?

The most popular and stable anonymous remailer is anon.penet.fi,
operated by Johan Helsingus.  To obtain an anonymous ID, mail
ping@anon.penet.fi.  For assistance is obtaining an anonymous account
at penet, mail help@anon.penet.fi.

To see a list on anonymous remailers, finger

31. How do I defeat Copy Protection?

There are two common methods of defeating copy protection.  The first
is to use a program that removes copy protection.  Popular programs
that do this are CopyIIPC from Central Point Software and CopyWrite
from Quaid Software.  The second method involves patching the copy
protected program.  For popular software, you may be able to locate a
ready made patch.  You can them apply the patch using any hex editor,
such as debug or the Peter Norton's DiskEdit.  If you cannot, you must
patch the software yourself.

Writing a patch requires a debugger, such as Soft-Ice or Sourcer.  It
also requires some knowledge of assembly language.  Load the protected
program under the debugger and watch for it to check the protection
mechanism.  When it does, change that portion of the code.  The code
can be changed from JE (Jump on Equal) or JNE (Jump On Not Equal) to
JMP (Jump Unconditionally).  Or the code may simply be replaced with
NOP (No Operation) instructions.

32. What is is a loopback network connection.  If you telnet, ftp, etc...
to it you are connected to your own machine.

33. How do I post to a moderated newsgroup?

Usenet messages consist of message headers and message bodies.  The
message header tells the news software how to process the message.
Headers can be divided into two types, required and optional. Required
headers are ones like "From" and "Newsgroups."  Without the required
headers, your message will not be posted properly.

One of the optional headers is the "Approved" header.  To post to a
moderated newsgroup, simply add an Approved header line to your
message header.  The header line should contain the newsgroup
moderators e-mail address.  To see the correct format for your target
newsgroup, save a message from the newsgroup and then look at it using
any text editor.

A "Approved" header line should look like this:

Approved: will@gnu.ai.mit.edu

There cannot not be a blank line in the message header.  A blank line
will cause any portion of the header after the blank line to be
interpreted as part of the message body.

For more information, read RFC 1036: Standard for Interchange of
USENET messages.

Section B: Telephony

01. What is a Red Box?

When a coin is inserted into a payphone, the payphone emits a set of
tones to ACTS (Automated Coin Toll System).  Red boxes work by fooling
ACTS into believing you have actually put money into the phone.  The
red box simply plays the ACTS tones into the telephone microphone.
ACTS hears those tones, and allows you to place your call.  The actual
tones are:

Nickel Signal      1700+2200  0.060s on
Dime Signal        1700+2200  0.060s on, 0.060s off, twice repeating
Quarter Signal     1700+2200  33ms on, 33ms off, 5 times repeating

02. How do I build a Red Box?

Red boxes are commonly manufactured from modified Radio Shack tone
dialers, Hallmark greeting cards, or made from scratch from readily
available electronic components.

To make a Red Box from a Radio Shack 43-141 or 43-146 tone dialer,
open the dialer and replace the crystal with a new one.  
The purpose of the new crystal is to cause the * button on your tone
dialer to create a 1700Mhz and 2200Mhz tone instead of the original
941Mhz and 1209Mhz tones.  The exact value of the replacement crystal
should be 6.466806 to create a perfect 1700Mhz tone and 6.513698 to
create a perfect 2200mhz tone. A crystal close to those values will
create a tone that easily falls within the loose tolerances of ACTS.
The most popular choice is the 6.5536Mhz crystal, because it is the
eaiest to procure.  The old crystal is the large shiny metal component
labeled "3.579545Mhz."  When you are finished replacing the crystal,
program the P1 button with five *'s.  That will simulate a quarter
tone each time you press P1.

03. Where can I get a 6.5536Mhz crystal?

Your best bet is a local electronics store.  Radio Shack sells them,
but they are overpriced and the store must order them in.  This takes
approximately two weeks.  In addition, many Radio Shack employees do
not know that this can be done.

Or, you could order the crystal mail order.  This introduces Shipping
and Handling charges, which are usually much greater than the price of
the crystal.  It's best to get several people together to share the
S&H cost.  Or, buy five or six yourself and sell them later.  Some of
the places you can order crystals are:

701 Brooks Avenue South
P.O. Box 677
Thief River Falls, MN 56701-0677
Part Number:X415-ND    /* Note: 6.500Mhz and only .197 x .433 x .149! */
Part Number:X018-ND

JDR Microdevices:
2233 Branham Lane
San Jose, CA 95124
Part Number: 6.5536MHZ

Tandy Express Order Marketing
401 NE 38th Street
Fort Worth, TX 76106
Part Number: 10068625

2300 Zanker Road
San Jose CA 95131
(408)943-9774 Voice
(408)943-9776 Fax
(408)943-0622 BBS
Part Number: 92A057

04. Which payphones will a Red Box work on?

Red Boxes will work on TelCo owned payphones, but not on COCOT's
(Customer Owned Coin Operated Telephones).

Red boxes work by fooling ACTS (Automated Coin Toll System) into
believing you have put money into the pay phone.  ACTS is the
telephone company software responsible for saying "Please deposit XX
cents" and listening for the coins being deposited.

COCOT's do not use ACTS.  On a COCOT, the pay phone itself is
responsible for determining what coins have been inserted.

05. How do I make local calls with a Red Box?

Payphones do not use ACTS for local calls.  To use your red box for
local calls, you have to fool ACTS into getting involved in the call.

One way to do this, in some areas, is by dialing 10288-xxx-xxxx.  This
makes your call a long distance call, and brings ACTS into the

In other areas, you can call Directory Assistance and ask for the
number of the person you are trying to reach.  The operator will give
you the number and then you will hear a message similar to "Your call
can be completed automatically for an additional 35 cents."  When this
happens, you can then use ACTS tones.

06. What is a Blue Box?

Blue boxes use a 2600hz tone to size control of telephone switches
that use in-band signalling.  The caller may then access special
switch functions, with the usual purpose of making free long distance
phone calls, using the tones provided by the Blue Box.

07. Do Blue Boxes still work?

Blue Boxes still work in areas using in band signalling.  Modern phone
switches use out of band signalling.  Nothing you send over the voice
portion of bandwidth can control the switch.  If you are in an area
served by a switch using out of band signalling, you can still blue
box by calling through an area served by older in-band equipment.

08. What is a Black Box?

A Black Box is a 1.8k ohm resistor placed across your phone line to
cause the phone company equipment to be unable to detect that you have
answered your telephone.  People who call you will then not be billed
for the telephone call.  Black boxes do not work under ESS.

09. What do all the colored boxes do?

Acrylic      Steal Three-Way-Calling, Call Waiting and programmable
	     Call Forwarding on old 4-wire phone systems
Aqua         Drain the voltage of the FBI lock-in-trace/trap-trace
Beige        Lineman's hand set
Black        Allows the calling party to not be billed for the call
Blast        Phone microphone amplifier
Blotto       Supposedly shorts every fone out in the immediate area
Blue         Emulate a true operator by seizing a trunk with a 2600hz
Brown        Create a party line from 2 phone lines
Bud          Tap into your neighbors phone line
Chartreuse   Use the electricity from your phone line
Cheese       Connect two phones to create a diverter
Chrome       Manipulate Traffic Signals by Remote Control
Clear        A telephone pickup coil and a small amp used to make free
	     calls on Fortress Phones
Color        Line activated telephone recorder
Copper       Cause crosstalk interference on an extender
Crimson      Hold button
Dark         Re-route outgoing or incoming calls to another phone
Dayglo       Connect to your neighbors phone line
Divertor     Re-route outgoing or incoming calls to another phone
DLOC         Create a party line from 2 phone lines
Gold         Dialout router
Green        Emulate the Coin Collect, Coin Return, and Ringback tones
Infinity     Remotely activated phone tap
Jack         Touch-Tone key pad
Light        In-use light
Lunch        AM transmitter
Magenta      Connect a remote phone line to another remote phone line
Mauve        Phone tap without cutting into a line
Neon         External microphone
Noise        Create line noise
Olive        External ringer
Party        Create a party line from 2 phone lines
Pearl        Tone generator
Pink         Create a party line from 2 phone lines
Purple       Telephone hold button
Rainbow      Kill a trace by putting 120v into the phone line (joke)
Razz         Tap into your neighbors phone
Red          Make free phone calls from pay phones by generating
	     quarter tones
Rock         Add music to your phone line
Scarlet      Cause a neighbors phone line to have poor reception
Silver       Create the DTMF tones for A, B, C and D
Static       Keep the voltage on a phone line high
Switch       Add hold, indicator lights, conferencing, etc..
Tan          Line activated telephone recorder
Tron         Reverse the phase of power to your house, causing your
	     electric meter to run slower
TV Cable     "See" sound waves on your TV
Urine        Create a capacitative disturbance between the ring and
	     tip wires in another's telephone headset
Violet       Keep a payphone from hanging up
White        Portable DTMF keypad
Yellow       Add an extension phone

Box schematics may be retrieved from these FTP sites:

ftp.netcom.com          /pub/br/bradleym
ftp.netcom.com          /pub/va/vandal
ftp.winternet.com       /users/craigb

[ News ] [ Paper Feed ] [ Issues ] [ Authors ] [ Archives ] [ Contact ]
© Copyleft 1985-2014, Phrack Magazine.