FAQ H. No document will make you a hacker

313 224-9996 224-9997
313 225-9996 225-9997
313 234-9996 234-9997
313 237-9996 237-9997
313 256-9996 256-9997
313 272-9996 272-9997
313 273-9996 273-9997
313 277-9996 277-9997
313 281-9996 281-9997
313 292-9996 292-9997
313 299-9996 299-9997
313 321-9996 321-9997
313 326-9996 326-9997
313 356-9996 356-9997
313 362-9996 362-9997
313 369-9996 369-9997
313 388-9996 388-9997
313 397-9996 397-9997
313 399-9996 399-9997
313 445-9996 445-9997
313 465-9996 465-9997
313 471-9996 471-9997
313 474-9996 474-9997
313 477-9996 477-9997
313 478-9996 478-9997
313 483-9996 483-9997
313 497-9996 497-9997
313 526-9996 526-9997
313 552-9996 552-9997
313 556-9996 556-9997
313 561-9996 561-9997
313 569-9996 569-9996
313 575-9996 575-9997
313 577-9996 577-9997
313 585-9996 585-9997
313 591-9996 591-9997
313 621-9996 621-9997
313 626-9996 626-9997
313 644-9996 644-9997
313 646-9996 646-9997
313 647-9996 647-9997
313 649-9996 649-9997
313 663-9996 663-9997
313 665-9996 665-9997
313 683-9996 683-9997
313 721-9996 721-9997
313 722-9996 722-9997
313 728-9996 728-9997
313 731-9996 731-9997
313 751-9996 751-9997
313 776-9996 776-9997
313 781-9996 781-9997
313 787-9996 787-9997
313 822-9996 822-9997
313 833-9996 833-9997
313 851-9996 851-9997
313 871-9996 871-9997
313 875-9996 875-9997
313 886-9996 886-9997
313 888-9996 888-9997
313 898-9996 898-9997
313 934-9996 934-9997
313 942-9996 942-9997
313 963-9996 963-9997
313 977-9996 977-9997
315 673-9995 673-9996
315 695-9995 695-9996
402 422-0001 422-0002
402 422-0003 422-0004
402 422-0005 422-0006
402 422-0007 422-0008
402 572-0003 572-0004
402 779-0004 779-0007
406 225-9902 225-9903
N 408 238-0044 238-0045
N 408 272-0044 272-0045
N 408 729-0044 729-0045
N 408 773-0044 773-0045
N 408 926-0044 926-0045
517 422-9996 422-9997
517 423-9996 423-9997
517 455-9996 455-9997
517 563-9996 563-9997
517 663-9996 663-9997
517 851-9996 851-9997
609 921-9929 921-9930
609 994-9929 994-9930
613 966-1111
616 997-9996 997-9997
708 724-9951 724-????
713 224-1499 759-1799
713 324-1499 324-1799
713 342-1499 342-1799
713 351-1499 351-1799
713 354-1499 354-1799
713 356-1499 356-1799
713 442-1499 442-1799
713 447-1499 447-1799
713 455-1499 455-1799
713 458-1499 458-1799
713 462-1499 462-1799
713 466-1499 466-1799
713 468-1499 468-1799
713 469-1499 469-1799
713 471-1499 471-1799
713 481-1499 481-1799
713 482-1499 482-1799
713 484-1499 484-1799
713 487-1499 487-1799
713 489-1499 489-1799
713 492-1499 492-1799
713 493-1499 493-1799
713 524-1499 524-1799
713 526-1499 526-1799
713 555-1499 555-1799
713 661-1499 661-1799
713 664-1499 664-1799
713 665-1499 665-1799
713 666-1499 666-1799
713 667-1499 667-1799
713 682-1499 976-1799
713 771-1499 771-1799
713 780-1499 780-1799
713 781-1499 997-1799
713 960-1499 960-1799
713 977-1499 977-1799
713 988-1499 988-1799
N 719 598-0009 598-0010
805 528-0044 528-0045
805 544-0044 544-0045
805 773-0044 773-0045
808 235-9907 235-9908
808 239-9907 239-9908
808 245-9907 245-9908
808 247-9907 247-9908
808 261-9907 261-9908
808 322-9907 322-9908
808 328-9907 328-9908
808 329-9907 329-9908
808 332-9907 332-9908
808 335-9907 335-9908
808 572-9907 572-9908
808 623-9907 623-9908
808 624-9907 624-9908
808 668-9907 668-9908
808 742-9907 742-9908
808 879-9907 879-9908
808 882-9907 882-9908
808 885-9907 885-9908
808 959-9907 959-9908
808 961-9907 961-9908
810 362-9996 362-9997
813 385-9971 385-xxxx
908 254-9929 254-9930
908 558-9929 558-9930
908 560-9929 560-9930
908 776-9930 776-9930

16. What is a CNA number?

CNA stands for Customer Name and Address. The CNA number is a phone
number for telephone company personnel to call and get the name and
address for a phone number. If a telephone lineman finds a phone line
he does not recognize, he can use the ANI number to find its phone
number and then call the CNA operator to see who owns it and where
they live.

Normal CNA numbers are available only to telephone company personnel.
Private citizens may legally get CNA information from private
companies. Two such companies are:

Unidirectory [phone]
Telename [phone]

Note that these are 900 numbers, and will cost you approximately one
dollar per minute.

If you are in 312 or 708, AmeriTech has a pay-for-play CNA service
available to the general public. The number is 796-9600. The cost is
$.35/call and can look up two numbers per call.

If you are in 415, Pacific Bell offers a public access CNL service at
[phone].

If you are in Bell Atlantic territory you can call [phone] or
[phone] for automated CNA information. The cost is $.50/call.

17. What is the telephone company CNA number for my area?

203 [phone] CT
312 [phone] Chicago, IL
506 [phone] New Brunswick
513 [phone] Cincinnati/Dayton, OH
516 [phone] Hempstead/Long Island, NY
614 [phone] Columbus/Steubenville, OH
813 [phone] Ft. Meyers/St. Petersburg/Tampa, FL
NYNEX [phone] New York, Connecticut, Vermont, Rhode
Island, New Hampshire, and Massachusetts

18. What are some numbers that always ring busy?

In the following listings, "xxx" means that the same number is used as a
constantly busy number in many different prefixes. In most of these,
there are some exchanges that ring busy and some exchanges that are in
normal use. *ALWAYS* test these numbers at least three times during
normal business hours before using as a constantly busy number.

N 800 999-1803 WATS
N 201 635-9970 Hackensack/Jersey City/Newark/Paterson, NJ
N 212 724-9970 Manhattan, NY
N 213 xxx-1117 Los Angeles, CA
N 213 xxx-1118 Los Angeles, CA
N 213 xxx-1119 Los Angeles, CA
N 213 xxx-9198 Los Angeles, CA
216 xxx-9887 Akron/Canton/Cleveland/Lorain/Youngstown, OH
303 431-0000 Denver, CO
303 866-8660 Denver, CO
N 310 xxx-1117 Long Beach, CA
N 310 xxx-1118 Long Beach, CA
N 310 xxx-1119 Long Beach, CA
N 310 xxx-9198 Long Beach, CA
316 952-7265 Dodge City/Wichita, KS
501 377-99xx AR
U 719 472-3772 Colorado Springs/Leadville/Pueblo, CO
805 255-0699 Bakersfield/Santa Barbara, CA
N 714 xxx-1117 Anaheim, CA
N 714 xxx-1118 Anaheim, CA
N 714 xxx-1119 Anaheim, CA
N 714 xxx-9198 Anaheim, CA
N 717 292-0009 Harrisburg/Scranton/Wilkes-Barre, PA
N 818 xxx-1117 Pasadena, CA
N 818 xxx-1118 Pasadena, CA
N 818 xxx-1119 Pasadena, CA
N 818 xxx-9198 Pasadena, CA
U 818 885-0699 Pasadena, CA (???-0699 is a pattern)
N 860 525-7078 Hartford, CT
906 632-9999 Marquette/Sault Ste. Marie, MI
906 635-9999 Marquette/Sault Ste. Marie, MI

19. What are some numbers that temporarily disconnect phone service?

If your NPA is not listed, or the listing does not cover your LATA,
try common numbers such as 119 (GTD5 switches) or 511.

314 511 Columbia/Jefferson City/St.Louis, MO (1 minute)
404 420 Atlanta, GA (5 minutes)
405 953 Enid/Oklahoma City, OK (1 minute)
U 407 511 Orlando, FL (United Telephone) (1 minute)
N 414 958-0013 Fond du Lac/Green Bay/Milwaukee/Racine, WI (1 minute)
512 200 Austin/Corpus Christi, TX (1 minute)
516 480 Hempstead/Long Island, NY (1 minute)
603 980 NH
614 xxx-9894 Columbus/Steubenville, OH
805 119 Bakersfield/Santa Barbara, CA (3 minutes)
919 211 or 511 Durham, NC (10 min - 1 hour)

20. What is a Proctor Test Set?

A Proctor Test Set is a tool used by telco personnel to diagnose
problems with phone lines. You call the Proctor Test Set number and
press buttons on a touch tone phone to active the tests you select.

21. What is a Proctor Test Set in my area?

If your NPA is not listed try common numbers such as 111 or 117.

805 111 Bakersfield/Santa Barbara, CA
909 117 Tyler, TX
913 611-1111 Lawrence/Salina/Topeka, KS

22. What is scanning?

Scanning is dialing a large number of telephone numbers in the hope
of finding interesting carriers (computers) or tones.

Scanning can be done by hand, although dialing several thousand
telephone numbers by hand is extremely boring and takes a long time.

Much better is to use a scanning program, sometimes called a war
dialer or a demon dialer. Currently, the best war dialer available to
PC-DOS users is ToneLoc from Minor Threat and Mucho Maas. ToneLoc can
be ftp'd from ftp.paranoia.com /pub/toneloc/.

A war dialer will dial a range of numbers and log what it finds at
each number. You can then only dial up the numbers that the war
dialer marked as carriers or tones.

23. Is scanning illegal?

Excerpt from: 2600, Spring 1990, Page 27:

-BQ-
In some places, scanning has been made illegal. It would be hard,
though, for someone to file a complaint against you for scanning since
the whole purpose is to call every number once and only once. It's
not likely to be thought of as harassment by anyone who gets a single
phone call from a scanning computer. Some central offices have been
known to react strangely when people start scanning. Sometimes you're
unable to get a dialtone for hours after you start scanning. But
there is no uniform policy. The best thing to do is to first find out
if you've got some crazy law saying you can't do it. If, as is
likely, there is no such law, the only way to find out what happens is
to give it a try.
-EQ-

It should be noted that a law making scanning illegal was recently
passed in Colorado Springs, CO. It is now illegal to place a call
in Colorado Springs without the intent to communicate.

24. Where can I purchase a lineman's handset?

Contact East
335 Willow Street
North Andover, MA 01845-5995
[phone]

Jensen Tools
7815 S. 46th Street
Phoenix, AZ 85044-5399
[phone]

Specialized Products
3131 Premier Drive
Irving, TX 75063
[phone]

Time Motion Tools
12778 Brookprinter Place
Poway, CA 92064
[phone]

25. What are the DTMF frequencies?

DTMF stands for Dual Tone Multi Frequency. These are the tones you get
when you press a key on your telephone touch pad. The tone of the
button is the sum of the column and row tones. The ABCD keys do not
exist on standard telephones.

1209 1336 1477 1633

697 1 2 3 A

770 4 5 6 B

852 7 8 9 C

941 * 0 # D

26. What are the frequencies of the telephone tones?

Type Hz On Off
---------------------------------------------------------------------
Dial Tone 350 & 440 --- ---
Busy Signal 480 & 620 0.5 0.5
Toll Congestion 480 & 620 0.2 0.3
Ringback (Normal) 440 & 480 2.0 4.0
Ringback (PBX) 440 & 480 1.5 4.5
Reorder (Local) 480 & 620 3.0 2.0
Invalid Number 200 & 400
Hang Up Warning 1400 & 2060 0.1 0.1
Hang Up 2450 & 2600 --- ---

27. What are all of the * (LASS) codes?

Local Area Signalling Services (LASS) and Custom Calling Feature
Control Codes:

(These appear to be standard, but may be changed locally)

Service Tone Pulse/rotary Notes
--------------------------------------------------------------------------
Assistance/Police *12 n/a [1]
Cancel forwarding *30 n/a [C1]
Automatic Forwarding *31 n/a [C1]
Notify *32 n/a [C1] [2]
Intercom Ring 1 (..) *51 1151 [3]
Intercom Ring 2 (.._) *52 1152 [3]
Intercom Ring 3 (._.) *53 1153 [3]
Extension Hold *54 1154 [3]
Customer Originated Trace *57 1157
Selective Call Rejection *60 1160 (or Call Screen)
Selective Distinct Alert *61 1161
Selective Call Acceptance *62 1162
Selective Call Forwarding *63 1163
ICLID Activation *65 1165
Call Return (outgoing) *66 1166
Number Display Blocking *67 1167 [4]
Computer Access Restriction *68 1168
Call Return (incoming) *69 1169
Call Waiting disable *70 1170 [4]
No Answer Call Transfer *71 1171
Usage Sensitive 3 way call *71 1171
Call Forwarding: start *72 or 72# 1172
Call Forwarding: cancel *73 or 73# 1173
Speed Calling (8 numbers) *74 or 74# 1174
Speed Calling (30 numbers) *75 or 75# 1175
Anonymous Call Rejection *77 1177 [5] [M: *58]
Call Screen Disable *80 1180 (or Call Screen) [M: *50]
Selective Distinct Disable *81 1181 [M: *51]
Select. Acceptance Disable *82 1182 [4] [7]
Select. Forwarding Disable *83 1183 [M: *53]
ICLID Disable *85 1185
Call Return (cancel out) *86 1186 [6] [M: *56]
Anon. Call Reject (cancel) *87 1187 [5] [M: *68]
Call Return (cancel in) *89 1189 [6] [M: *59]

Notes:

[C1] - Means code used for Cellular One service
[1] - for cellular in Pittsburgh, PA A/C 412 in some areas
[2] - indicates that you are not local and maybe how to reach you
[3] - found in Pac Bell territory; Intercom ring causes a distinctive
ring to be generated on the current line; Hold keeps a call
connected until another extension is picked up
[4] - applied once before each call
[5] - A.C.R. blocks calls from those who blocked Caller ID
(used in C&P territory, for instance)
[6] - cancels further return attempts
[7] - *82 (1182) has been mandated to be the nationwide code for
"Send CLID info regardless of the default setting on this
phone line."
[M: *xx] - alternate code used for MLVP (multi-line variety package)
by Bellcore. It goes by different names in different RBOCs.
In Bellsouth it is called Prestige. It is an arrangement of
ESSEX like features for single or small multiple line groups.

The reason for different codes for some features in MLVP is that
call-pickup is *8 in MLVP so all *8x codes are reassigned *5x

28. What frequencies do cordless phones operate on?

Here are the frequencies for the first generation 46/49mhz phones.

Channel Handset Transmit Base Transmit
------- ---------------- -------------
1 49.670mhz 46.610mhz
2 49.845 46.630
3 49.860 46.670
4 49.770 46.710
5 49.875 46.730
6 49.830 46.770
7 49.890 46.830
8 49.930 46.870
9 49.990 46.930
10 49.970 46.970


The new "900mhz" cordless phones have been allocated the frequencies
between 902-228MHz, with channel spacing between 30-100KHz.

Following are some examples of the frequencies used by phones
currently on the market.

----------------------------------------------------------------
Panasonic KX-T9000 (60 Channels)
base 902.100 - 903.870 Base frequencies (30Khz spacing)
handset 926.100 - 927.870 Handset frequencies
CH BASE HANDSET CH BASE HANDSET CH BASE HANDSET
-- ------- ------- -- ------- ------- -- ------- -------
01 902.100 926.100 11 902.400 926.400 21 902.700 926.700
02 902.130 926.130 12 902.430 926.430 22 902.730 926.730
03 902.160 926.160 13 902.460 926.460 23 902.760 926.760
04 902.190 926.190 14 902.490 926.490 24 902.790 926.790
05 902.220 926.220 15 902.520 926.520 25 902.820 926.820
06 902.250 926.250 16 902.550 926.550 26 902.850 926.850
07 902.280 926.280 17 902.580 926.580 27 902.880 926.880
08 902.310 926.310 18 902.610 926.610 28 902.910 926.910
09 902.340 926.340 19 902.640 926.640 29 902.940 926.940
10 902.370 926.370 20 902.670 926.670 30 902.970 926.970

31 903.000 927.000 41 903.300 927.300 51 903.600 927.600
32 903.030 927.030 42 903.330 927.330 52 903.630 927.630
33 903.060 927.060 43 903.360 927.360 53 903.660 927.660
34 903.090 927.090 44 903.390 927.390 54 903.690 927.690
35 903.120 927.120 45 903.420 927.420 55 903.720 927.720
36 903.150 927.150 46 903.450 927.450 56 903.750 927.750
37 903.180 927.180 47 903.480 927.480 57 903.780 927.780
38 903.210 927.210 48 903.510 927.510 58 903.810 927.810
39 903.240 927.240 49 903.540 927.540 59 903.840 927.840
40 903.270 927.270 50 903.570 927.570 60 903.870 927.870

------------------------------------------------------------

V-TECH TROPEZ DX900 (20 CHANNELS)
905.6 - 907.5 TRANSPONDER (BASE) FREQUENCIES (100 KHZ SPACING)
925.5 - 927.4 HANDSET FREQUENCIES

CH BASE HANDSET CH BASE HANDSET CH BASE HANDSET
-- ------- ------- -- ------- ------- -- ------- -------
01 905.600 925.500 08 906.300 926.200 15 907.000 926.900
02 905.700 925.600 09 906.400 926.300 16 907.100 927.000
03 905.800 925.700 10 906.500 926.400 17 907.200 927.100
04 905.900 925.800 11 906.600 926.500 18 907.300 927.200
05 906.000 925.900 12 906.700 926.600 19 907.400 927.300
06 906.100 926.000 13 906.800 926.700 20 907.500 927.400
07 906.200 926.100 14 906.900 926.800

------------------------------------------------------------
Other 900mhz cordless phones
AT&T #9120 - - - - - 902.0 - 905.0 & 925.0 - 928.0 MHZ
OTRON CORP. #CP-1000 902.1 - 903.9 & 926.1 - 927.9 MHZ
SAMSUNG #SP-R912- - - 903.0 & 927.0 MHZ

------------------------------------------------------------

29. What is Caller-ID?

This FAQ answer is stolen from Rockwell:

Calling Number Delivery (CND), better known as Caller ID, is a
telephone service intended for residential and small business
customers. It allows the called Customer Premises Equipment (CPE) to
receive a calling party's directory number and the date and time of
the call during the first 4 second silent interval in the ringing
cycle.

Parameters
~~~~~~~~~~
The data signalling interface has the following characteristics:

Link Type: 2-wire, simplex
Transmission Scheme: Analog, phase-coherent FSK
Logical 1 (mark) 1200 +/- 12 Hz
Logical 0 (space) 2200 +/- 22 Hz
Transmission Rate: 1200 bps
Transmission Level: 13.5 +/- dBm into 900 ohm load


Protocol
~~~~~~~~
The protocol uses 8-bit data words (bytes), each bounded by a start
bit and a stop bit. The CND message uses the Single Data Message
format shown below.

| Channel | Carrier | Message | Message | Data | Checksum |
| Seizure | Signal | Type | Length | Word(s) | Word |
| Signal | | Word | Word | | |

Channel Seizure Signal
~~~~~~~~~~~~~~~~~~~~~~
The channel seizure is 30 continuous bytes of 55h (01010101) providing
a detectable alternating function to the CPE (i.e. the modem data
pump).

Carrier Signal
~~~~~~~~~~~~~~
The carrier signal consists of 130 +/- 25 mS of mark (1200 Hz) to
condition the receiver for data.

Message Type Word
~~~~~~~~~~~~~~~~~
The message type word indicates the service and capability associated
with the data message. The message type word for CND is 04h
(00000100).

Message Length Word
~~~~~~~~~~~~~~~~~~~
The message length word specifies the total number of data words to
follow.

Data Words
~~~~~~~~~~
The data words are encoded in ASCII and represent the following
information:

o The first two words represent the month
o The next two words represent the day of the month
o The next two words represent the hour in local military time
o The next two words represent the minute after the hour
o The calling party's directory number is represented by the
remaining words in the data word field

If the calling party's directory number is not available to the
terminating central office, the data word field contains an ASCII "O".
If the calling party invokes the privacy capability, the data word
field contains an ASCII "P".

Checksum Word
~~~~~~~~~~~~~
The Checksum Word contains the twos complement of the modulo 256 sum
of the other words in the data message (i.e., message type, message
length, and data words). The receiving equipment may calculate the
modulo 256 sum of the received words and add this sum to the received
checksum word. A result of zero generally indicates that the message
was correctly received. Message retransmission is not supported.

Example CNS Single Data Message
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
An example of a received CND message, beginning with the message type
word, follows:

04 12 30 39 33 30 31 32 32 34 36 30 39 35 35 35 31 32 31 32 51

04h= Calling number delivery information code (message type word)
12h= 18 decimal; Number of data words (date,time, and directory
number words)
ASCII 30,39= 09; September
ASCII 33,30= 30; 30th day
ASCII 31,32= 12; 12:00 PM
ASCII 32,34= 24; 24 minutes (i.e., 12:24 PM)
ASCII 36,30,39,35,35,35,31,32,31,32= [phone]; calling
party's directory number
51h= Checksum Word

Data Access Arrangement (DAA) Requirements
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To receive CND information, the modem monitors the phone line between
the first and second ring bursts without causing the DAA to go off
hook in the conventional sense, which would inhibit the transmission
of CND by the local central office. A simple modification to an
existing DAA circuit easily accomplishes the task.

Modem Requirements
~~~~~~~~~~~~~~~~~~
Although the data signalling interface parameters match those of a
Bell 202 modem, the receiving CPE need not be a Bell 202 modem. A
V.23 1200 bps modem receiver may be used to demodulate the Bell 202
signal. The ring indicate bit (RI) may be used on a modem to indicate
when to monitor the phone line for CND information. After the RI bit
sets, indicating the first ring burst, the host waits for the RI bit
to reset. The host then configures the modem to monitor the phone
line for CND information.

Signalling
~~~~~~~~~~
According to Bellcore specifications, CND signalling starts as early
as 300 mS after the first ring burst and ends at least 475 mS before
the second ring burst

Applications
~~~~~~~~~~~~
Once CND information is received the user may process the information
in a number of ways.

1. The date, time, and calling party's directory number can be
displayed.

2. Using a look-up table, the calling party's directory number can be
correlated with his or her name and the name displayed.

3. CND information can also be used in additional ways such as for:

a. Bulletin board applications
b. Black-listing applications
c. Keeping logs of system user calls, or
d. Implementing a telemarketing data base

References
~~~~~~~~~~
For more information on Calling Number Delivery (CND), refer to
Bellcore publications TR-TSY-000030 and TR-TSY-000031.

To obtain Bellcore documents contact:

Bellcore Customer Service
60 New England Avenue, Room 1B252
Piscataway, NJ 08834-4196
[phone]

30. How do I block Caller-ID?

Always test as much as possible before relying on any method of blocking
Caller-ID. Some of these methods work in some areas, but not in others.

Dial *67 before you dial the number. (141 in the United Kingdom)
Dial your local TelCo and have them add Caller-ID block to your line.
Dial the 0 Operator and have him or her place the call for you.
Dial the call using a pre-paid phone card.
Dial through Security Consultants at (900)PREVENT for U.S. calls
($1.99/minute) or (900)STONEWALL for international calls ($3.99/minute).
Dial from a pay phone. :-)

31. What is a PBX?

A PBX is a Private Branch Exchange. A PBX is a small telephone switch
owned by a company or organization. Let's say your company has a
thousand employees. Without a PBX, you would need a thousand phone
lines. However, only 10% of your employees are talking on the phone
at one time. What if you had a computer that automatically found an
outside line every time one of your employees picked up the telephone.
With this type of system, you could get by with only paying for one
hundred phone lines. This is a PBX.

32. What is a VMB?

A VMB is a Voice Mail Box. A VMB is a computer that acts as an
answering machine for hundreds or thousands of users. Each user will
have their own Voice Mail Box on the system. Each mail box will have
a box number and a pass code.

Without a passcode, you will usually be able to leave messages to
users on the VMB system. With a passcode, you can read messages and
administer a mailbox. Often, mailboxes will exist that were created
by default or are no longer used. These mailboxes may be taken over
by guessing their passcode. Often the passcode will be the mailbox
number or a common number such as 1234.

33. What are the ABCD tones for?

The ABCD tones are simply additional DTFM tones that may be used in any
way the standard (0-9) tones are used. The ABCD tones are used in the
U.S. military telephone network (AutoVon), in some Automatic Call
Distributor (ACD) systems, for control messages in some PBX systems, and
in some amateur radio auto-patches.

In the AutoVon network, special telephones are equipped with ABCD keys.
The ABCD keys are defined as such:

A - Flash
B - Flash override priority
C - Priority communication
D - Priority override

Using a built-in maintenance mode of the Automatic Call Distributor
(ACD) systems once used by Directory Assistance operators, you could
connect two callers together.

The purpose of the Silver Box is to create the ABCD tones.

See also "What are the DTMF Frequencies?"

34. What are the International Direct Numbers?

The numbers are used so that you may connect to an operator from a
foreign telephone network, without incurring long distance charges.
These numbers may be useful in blue boxing, as many countries still have
older switching equipment in use.

Australia [phone]
Austria [phone]
Belgium [phone]
Belize [phone]
Bermuda [phone]
Brazil [phone]
British VI [phone]
Cayman [phone]
Chile [phone]
China (Shanghai) [phone]
Costa Rica [phone]
Denmark [phone]
El Salvador [phone]
Finland [phone]
France [phone]
Germany [phone]
Greece [phone]
Guam [phone]
HK [phone]
Hungary [phone]
Indonesia [phone]
Ireland [phone]
Italy [phone]
Japan [phone]
Korea [phone]
Macau [phone]
Malaysia [phone]
Netherlands [phone]
Norway [phone]
New Zealand [phone]
Panama [phone]
Portugal [phone]
Philippines [phone]
Singapore [phone]
Spain [phone]
Sweden [phone]
Taiwan [phone]
Thailand [phone]
Turkey [phone]
UK [phone]
Uruguay [phone]
Yugoslavia [phone] (Belgrade)
367-9841 (Zagreb)
USA from outside [phone] Ext. 107

* Section C: Cellular *

~~~~~~~~~~~~~~~~~~~

01. What is an MTSO?

MTSO stands for Mobile Telephone Switching Office. The MTSO is the
switching office that connects all of the individual cell towers to the
Central Office (CO).

The MTSO is responsible for monitoring the relative signal strength of
your cellular phone as reported by each of the cell towers, and
switching your conversation to the cell tower which will give you the
best possible reception.

02. What is a NAM?

NAM stands for Number Assignment Module. The NAM is the EPROM that
holds information such as the MIN and SIDH. Cellular fraud is committed
by modifying the information stored in this component.

03. What is an ESN?

ESN stands for Electronic Serial Number. The is the serial number of
your cellular telephone.

04. What is an MIN?

MIN stands for Mobile Identification Number. This is the phone number
of the cellular telephone.

05. What is a SCM?

SCM stands for Station Class Mark. The SCM is a 4 bit number which
holds three different pieces of information. Your cellular telephone
transmits this information (and more) to the cell tower. Bit 1 of the
SCM tells the cell tower whether your cellphone uses the older 666
channel cellular system, or the newer 832 channel cellular system. The
expansion to 832 channels occured in 1988. Bit 2 tells the cellular
system whether your cellular telephone is a mobile unit or a voice
activated cellular telephone. Bit's 3 and 4 tell the cell tower what
power your cellular telephone should be transmitting on.

Bit 1: 0 == 666 channels
1 == 832 channels

Bit 2: 0 == Mobile cellular telephone
1 == Voice activated cellular telephone

Bit 3/4: 00 == 3.0 watts (Mobiles)
01 == 1.2 watts (Transportables)
10 == .06 watts (Portables)
11 == Reserved for future use

06. What is a SIDH?

SIDH stands for System Identification for Home System. The SIDH in your
cellular telephone tells the cellular system what area your cellular
service originates from. This is used in roaming (making cellular calls
when in an area not served by your cellular provider).

Every geographical region has two SIDH codes, one for the wireline
carrier and one for the nonwireline carrier. These are the two
companies that are legally allowed to provide cellular telephone service
in that region. The wireline carrier is usually your local telephone
company, while the nonwireline carrier will be another company. The
SIDH for the wireline carrier is always an even number, while the SIDH
for the nonwireline carrier is always an odd number. The wireline
carrier is also known as the Side-B carrier and the non-wireline carrier
is also known as the Side-A carrier.

07. What are the forward/reverse channels?

Forward channels are the frequencies the cell towers use to talk to your
cellular telephone. Reverse channels are the frequencies your cellular
telephone uses to talk to the cell towers.

The forward channel is usually 45 mhz above the reverse channel. For
example, if the reverse channel is at 824 mhz, the forward channel would
be at 869 mhz.

* Section D: Resources *

~~~~~~~~~~~~~~~~~~~~

01. What are some ftp sites of interest to hackers?

N 204.215.84.2 /pub/dmackey
2600.com (2600 Magazine)
aeneas.mit.edu (Kerberos)
alex.sp.cs.cmu.edu /links/security (Misc)
asylum.sf.ca.us (CyberWarriors of Xanadu)
N atari.archive.umich.edu /pub/atari/Utilities/pgp261st.zip (Atari PGP)
athena-dist.mit.edu /pub/ATHENA (Athena Project)
atlantis.utmb.edu (Anti-virus)
bellcore.com (Bellcore)
cert.org (CERT)
ciac.llnl.gov (CIAC)
clark.net /pub/jcase (H/P)
cnit.nsk.su /pub/security (Security)
coast.cs.purdue.edu /pub (Security/COAST)
coombs.anu.edu.au /pub/security (Security)
csrc.ncsl.nist.gov (NIST Security)
dartmouth.edu /pub/security (Security)
ds.internic.net (Internet documents)
N dutiws.twi.tudelft.nl /pub/novell
etext.archive.umich.edu /pub/Zines/PrivateLine (PrivateLine)
N fastlane.net /pub/nomad
ftp.3com.com /pub/Orange-Book (Orange Book)
ftp.acns.nwu.edu /pub (Mac Anti-virus)
ftp.acsu.buffalo.edu /pub/security & /pub/irc (Security & IRC)
ftp.alantec.com /pub/tcpr (Tcpr)
ftp.armory.com /pub/user/kmartind (H/P)
ftp.armory.com /pub/user/swallow (H/P)
ftp.auscert.org.au /pub (Australian CERT)
ftp.cerf.net /pub/software/unix/security (CERFnet)
ftp.cert.dfn.de (FIRST)
ftp.cisco.com (Cisco)
ftp.commerce.net /pub/standards/drafts/shttp.txt (Secure HyperText)
ftp.cs.colorado.edu
ftp.cs.ruu.nl /pub/SECURITY (Security & PGP)
ftp.cs.uwm.edu /pub/comp-privacy (Privacy Digest)
ftp.cs.vu.nl
ftp.cs.yale.edu
ftp.csi.forth.gr /pub/security
ftp.csl.sri.com /pub/nides (SRI)
ftp.csn.org /mpj (Cryptology)
ftp.csua.berkeley.edu /pub/cypherpunks (Crypto)
ftp.delmarva.com
N ftp.demon.co.uk /pub/misc/0800num.txt (0800/0500 numbers)
ftp.denet.dk /pub/security/tools/satan
ftp.digex.net /pub/access/dunk
ftp.dsi.unimi.it /pub/security/crypt (Crypto)
ftp.dstc.edu.au /pub/security/satan
ftp.ee.lbl.gov
ftp.eff.org /pub/Publications/CuD (EFF)
ftp.elelab.nsc.co.jp /pub/security (Security)
ftp.etext.org (Etext)
ftp.fc.net /pub/deadkat (TNO)
ftp.fc.net /pub/defcon (DefCon)
ftp.fc.net /pub/defcon/BBEEP (BlueBeep)
ftp.fc.net /pub/phrack (Phrack)
ftp.foobar.com
ftp.funet.fi /pub/doc/CuD
ftp.gate.net /pub/users/laura
ftp.gate.net /pub/users/wakko
ftp.giga.or.at /pub/hacker/ (H/P)
ftp.greatcircle.com /pub/firewalls (Firewalls)
ftp.IEunet.ie /pub/security (Security)
ftp.ifi.uio.no
ftp.indirect.com /www/evildawg/public_access/C&N/
ftp.info.fundp.ac.be
ftp.informatik.uni-hamburg.de
ftp.informatik.uni-kiel.de /pub/sources/security
ftp.inoc.dl.nec.com /pub/security (Security)
ftp.isi.edu
ftp.lava.net /users/oracle/ (H/P
N ftp.leo.org/pub/com/os/os2/crypt
ftp.lerc.nasa.gov /security
ftp.llnl.gov /pub (CIAC)
ftp.luth.se /pub/unix/security
ftp.lysator.liu.se
ftp.mcs.anl.gov /pub/security
ftp.microserve.net /ppp-pop/strata/mac (Mac)
ftp.near.net /security/archives/phrack (Zines)
ftp.nec.com
ftp.net.ohio-state.edu /pub/security/satan
ftp.netcom.com /pub/br/bradleym (Virii)
ftp.netcom.com /pub/da/daemon9 (H/P)
ftp.netcom.com /pub/fi/filbert
N ftp.netcom.com /pub/gr/grady
N ftp.netcom.com /pub/il/illusion (H/P+Virus)
N ftp.netcom.com /pub/je/jericho (H/P)
ftp.netcom.com /pub/le/lewiz (Social Engineering)
N ftp.netcom.com /pub/ty/tym (TYM)
ftp.netcom.com /pub/va/vandal (DnA)
ftp.netcom.com /pub/wt/wtech/
N ftp.netcom.com /pub/zi/zigweed (H/P)
ftp.netcom.com /pub/zz/zzyzx (H/P)
ftp.netsys.com
ftp.ocs.mq.edu.au /PC/Crypt (Cryptology)
ftp.ox.ac.uk /pub/comp/security
ftp.ox.ac.uk /pub/crypto (Cryptology)
ftp.ox.ac.uk /pub/wordlists (Wordlists)
ftp.paranoia.com /pub/toneloc/tl110.zip (ToneLoc)
N ftp.pipex.net /pub/areacode (uk areacodes)
ftp.pop.psu.edu
ftp.primenet.com /users/i/insphrk
ftp.primenet.com /users/k/kludge (H/P)
ftp.primenet.com /users/s/scuzzy (Copy Protection)
ftp.primus.com /pub/security (Security)
ftp.psy.uq.oz.au
ftp.psy.uq.oz.au /pub/DES
ftp.rahul.net /pub/conquest/DeadelviS/script/vms/
ftp.rahul.net /pub/lps (Home of the FAQ)
ftp.sert.edu.au
ftp.sgi.com
N ftp.smartlink.net /pub/users/mikes/haq
ftp.std.com /archives/alt.locksmithing (Locksmithing)
ftp.std.com /obi/Mischief/ (MIT Guide to Locks)
ftp.std.com /obi/Phracks (Zines)
ftp.sunet.se /pub/network/monitoring (Ethernet sniffers)
ftp.sura.net /pub/security (SURAnet)
ftp.technet.sg
U ftp.technion.ac.il
ftp.tis.com /pub (TIS)
ftp.tisl.ukans.edu /pub/security
ftp.uni-koeln.de (Wordlists)
ftp.uspto.gov
ftp.uu.net /doc/literary/obi/Phracks (Zines)
ftp.uwp.edu /pub/dos/romulus/cracks (Copy Protection)
ftp.vis.colostate.edu
ftp.vix.com
ftp.vortex.com
ftp.warwick.ac.uk /pub/cud (Zines)
ftp.wi.leidenuniv.nl /pub/security
ftp.win.tue.nl /pub/security (Security)
ftp.winternet.com /users/nitehwk (H/P)
ftp.wustl.edu /doc/EFF (EFF)
ftp.zoom.com
ftp.zrz.tu-berlin.de/pub/security/virus/texts/crypto (Cryptology)
garbo.uwasa.fi /pc/crypt (Cryptology)
N gemini.tuc.noao.edu /pub/grandi
gti.net /pub/safetynet
gumby.dsd.trw.com
hack-this.pc.cc.cmu.edu (Down for Summer)
heffer.lab.csuchico.edu (Third Stone From The Sun)
hplyot.obspm.fr
info.mcs.anl.gov
N infonexus.com /pub (The Guild)
jerico.usc.edu
l0pht.com (The L0pht)
lcs.mit.edu /telecom-archives (Telecom archives)
lod.com (Legion of Doom)
mac.archive.umich.edu
mary.iia.org /pub/users/patriot (Misc)
monet.ccs.itd.umich.edu
N net-dist.mit.edu /pub/pgp
net.tamu.edu /pub/security/TAMU (Security)
net23.com /pub (Max Headroom)
nic.ddn.mil /scc (DDN Security)
nic.sura.net /pub/security
oak.oakland.edu /pub/hamradio (Ham Radio)
oak.oakland.edu /SimTel/msdos/sound (DTMF decoders)
oak.oakland.edu /SimTel/msdos/sysutil (BIOS attackers)
parcftp.xerox.com
prism.nmt.edu /pub/misc (Terrorist Handbook)
pyrite.rutgers.edu /pub/security (Security)
relay.cs.toronto.edu /doc/telecom-archives (Telecom)
rena.dit.co.jp /pub/security (Security)
research.att.com /dist/internet_security (AT&T)
ripem.msu.edu /pub/crypt (Ripem)
N rmii.com /pub2/KRaD (KRaD Magazine)
rtfm.mit.edu (Etext)
rtfm.mit.edu /pub/usenet-by-group (Usenet FAQ's)
scss3.cl.msu.edu /pub/crypt (Cryptology)
N sgigate.sgi.com /Security (SGI Security)
sierra.stanford.edu
spy.org (CSC)
N src.doc.ic.ac.uk /usenet/uk.telecom (uk.telecom archives)
suburbia.apana.org.au /pub/unix/security (Security)
sunsolve1.sun.com
theta.iis.u-tokyo.ac.jp /pub1/security (Security)
titania.mathematik.uni-ulm.de /pub/security (Security)
toxicwaste.mit.edu /pub/rsa129/README (Breaking RSA)
ugle.unit.no
unipc20.unimed.sintef.no
vic.cc.purdue.edu
vixen.cso.uiuc.edu /security
N web.mit.edu
whacked.l0pht.com (Mac + H/P)
wimsey.bc.ca /pub/crypto (Cryptology)
N wuarchive.wustl.edu /pub/aminet/util/crypt

02. What are some fsp sites of interest to hackers?

None at this time.

03. What are some newsgroups of interest to hackers?

alt.2600 Do it 'til it hertz
N alt.2600hz
N alt.2600.codez
N alt.2600.debate
N alt.2600.moderated
alt.cellular
alt.cellular-phone-tech Brilliant telephony mind blow netnews naming
alt.comp.virus An unmoderated forum for discussing viruses
alt.comp.virus.source.code
alt.cracks Heavy toolbelt wearers of the world, unite
alt.cyberpunk High-tech low-life.
alt.cyberspace Cyberspace and how it should work.
alt.dcom.telecom Discussion of telecommunications technology
alt.engr.explosives [no description available]
alt.fan.kevin-mitnick
alt.fan.lewiz Lewis De Payne fan club
alt.hackers Descriptions of projects currently under development
alt.hackintosh
alt.locksmithing You locked your keys in *where*?
alt.hackers.malicious The really bad guys - don't take candy from them
alt.ph.uk United Kingdom version of alt.2600
alt.privacy.anon-server Tech. & policy matters of anonymous contact servers
alt.radio.pirate Hide the gear, here comes the magic station-wagons.
alt.radio.scanner Discussion of scanning radio receivers.
alt.satellite.tv.europe All about European satellite tv
alt.security Security issues on computer systems
alt.security.index Pointers to good stuff in misc.security (Moderated)
alt.security.keydist Exchange of keys for public key encryption systems
alt.security.pgp The Pretty Good Privacy package
alt.security.ripem A secure email system illegal to export from the US
comp.dcom.cellular [no description available]
comp.dcom.telecom Telecommunications digest (Moderated)
comp.dcom.telecom.tech [no description available]
comp.org.cpsr.announce Computer Professionals for Social Responsibility
comp.org.cpsr.talk Issues of computing and social responsibility
comp.org.eff.news News from the Electronic Frontiers Foundation
comp.org.eff.talk Discussion of EFF goals, strategies, etc.
N comp.os.netware.security Netware Security issues
comp.protocols.kerberos The Kerberos authentification server
comp.protocols.tcp-ip TCP and IP network protocols
comp.risks Risks to the public from computers & users
comp.security.announce Announcements from the CERT about security
N comp.security.firewalls Anything pertaining to network firewall security
comp.security.misc Security issues of computers and networks
comp.security.unix Discussion of Unix security
comp.virus Computer viruses & security (Moderated)