13

---------------------------------------
[Ctrl-S pauses/Space=quit]

BLUE BOXING--WHY IT WORKS
by THE RESEARCHER

The most common form of signaling between toll offices uses multifrequency
tones (MF). Multifrequency signaling uses six frequencies placed in that part
of the voice spectrum where different channels have the smallest deviation in
loss. On the Bell System the frequencies used are 700, 900, 1100, 1300, 1500,
and 1700 Hz. Digits are coded as two out of the first five of these frequencies
and are sent between start-of-digit-transmission and end-of-digit-transmission
codes. The following table shows the combinations of frequencies used in North
America and on CCITT Signaling System No. 5:

.   Signal             Frequency pair
. ------------------------------------
. KP1 (start-of-digit        1100+1700
. transmission for a
. national call)
. KP2 (start-of-digit        1300+1700
. transmimission for an
. international call from
. an intermediate (transist) exchange)
. Digits: 1                  700+900
.         2                  700+1100
.         3                  900+1100
.         4                  700+1300
.         5                  900+1300
.         6                 1100+1300
.         7                  700+1500
.         8                  900+1500
.         9                 1100+1500
.         0                 1300+1500
. ST (End of digit          1500+1700
. transmission)

The MF signals are sent over the normal voice channels and are transmitted like
speech. They may be sent either by a switchboard operator or, by automatic
equipment. The reader may possibly have heard these interoffice signals. On
some systems the operator's signaling is occasionally audible, and sometimes
the automatic signaling can be faintly heard due to crosstalk. The quiet
listener may hear a faraway flurry of faint discordant notes. The frequency
2600 Hz is transmitted continuously on all voice channels between toll offices
when the channel is free. This frequency also acts as a disconnect signal,
indicating that the voice channel should return to its unused status. When the
subscriber dials the number it reaches his local central office and possibly
toll office by dc pulsing (unless touch-tone dialing was used). The toll office
selects a free voice channel in an appropriate trunk and stops the 2600 Hz
tone. The office at the end of that trunk detects the break in the 2600 Hz
signal and is alerted to receive a toll telephone number. The number is sent in
the MF code listed above. One toll office passes the number to another until
the called central office is reached. The central office rings the called
telephone. When either party replaces his receiver the call is disconnected and
the toll offices tell each other this by transmitting the 2600 Hz tone again.
It is possible to interfere with the telephone trunking mechanism by
transmitting the 2600 Hz tone from the subscriber's telephone. An AT&T story
has it that a New York shirt manufacturer once broke his front tooth in such a
way that he transmitted a brief 2600 Hz whistle every time he said the word
"shirt" on the telephone. An Eastern Airline office in Atlanta was plagued by
telephone disconnects for seven years and then discovered that they were caused
by the shrieks of exotic birds in the hotel lobby cocktail lounge. Captain
Crunch breakfast cereal packets were once delivered with a toy whistle which
produced a pure 2600 Hz tone. A brief 2600 Hz tone received by a toll office
causes it to free the voice channel in question and place a 2600 Hz tone on the
channel to the next toll office.             A blue box call is started  by
placing a long distance call in the normal way either to a free number
(information or a valid 800 series number) or else to a close-by destination
which is cheap to call. This is the call which will appear on the CAMA tape.
Once dialing is completed, your nearby tandem (toll office) routes the call to
the tandem office at the destination, possibly through intermediate tandems
along the way. As soon as you hear ringing from the other end, you feed 2600 Hz
into your phone for one second. Your local CO is unaccustomed to getting 2600
Hz and so simply ignores it, but passes it on to the nearby tandem.   This
tandem can recognize 2600 Hz as a disconnect idle from other tandems, but is
not built to react to the signal coming from a CO. So it ignores it and passes
it on. But the next tandem, thinking you hung up, cancels the call. This leaves
you hanging, still connected to a toll line between tandems. After one second
of 2600 Hz, you remove it. The distant tandem now sees that the line is no 
longer idle, and so it connects an incoming sender. As soon as you hear the
click signifying this, you have ten seconds to dial the desired number,
preceded by KP and followed by ST. When the number answers, a signal is sent
back and the CAMA tape punched to indicate the connection time. At the end of
the call, the CAMA tape is again punched with your number, the time and the
number you originally dialed. This is the call and time for which you will be
billed (unless it is free) and the number actually reached with the Blue Box is
not recorded. Because of the widespread use of 2600 Hz detectors and ESS which
can trace in seconds, blue boxing is a high risk method of phreaking.

---------------------------------------

Enter (1-69, M=Menu, Q=Quit) :