- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 42823
- Проверка EDB
-
- Пройдено
- Автор
- PHRACK
- Тип уязвимости
- PAPERS
- Платформа
- MAGAZINE
- CVE
- N/A
- Дата публикации
- 1987-03-29
Phrack #12
Код:
==Phrack Inc.==
Volume Two, Issue 12, Phile #1 of 11
Index
~~~~~
3/29/87
Ok, so we made it through another few delayed weeks of saying a
release was coming soon. But of course, I finally got motivated and got this
issue moving. I'd like to thank many of the people who rushed themselves to
get their articles to me when they didn't know that the release was so soon,
and for those that haven't gotten their articles in in time (for two issues,
mind you [no names mentioned, of course, but I felt a denotation would be
sufficient to provide my feelings in the introduction]) a big, "Oh well."
We're glad you've continued your patronage (Ha!) with Phrack Inc. over the
past year and a half or so and a big thanks to all of the writers who have
kept the publication going for all this time. But after this issue comes a
break. Not a break in putting Phrack out, but a break in the grind and rush
to get it out as I did with this issue. Phrack 13 will be EXTREMELY
different, and I guarantee that to you. Phrack 13 will be released on April
1st (hmm...ring any bells?) so be watching for it! Later
Taran King
Sysop of Metal Shop Private
------------------------------------------------------------------------------
This issue of Phrack Inc. includes the following:
#1 Index of Phrack 12 by Taran King (2.3 k)
#2 Pro-Phile IX on Agrajag The Prolonged by Taran King (6.7 k)
#3 Preview to Phrack 13-The Life & Times of The Executioner (4.9 k)
#4 Understanding the Digital Multiplexing System (DMS) by Control C (18.8 k)
#5 The Total Network Data System by Doom Prophet (13.2 k)
#6 CSDC II - Hardware Requirements by The Executioner (8.1 k)
#7 Hacking : OSL Systems by Evil Jay (8.7 k)
#8 Busy Line Verification Part II by Phantom Phreaker (9.1 k)
#9 Scan Man's Rebuttal to Phrack World News (16.5 k)
#10 Phrack World News XII Part I by Knight Lightning (13.3 k)
#11 Phrack World News XII Part II by Knight Lightning (14.7 k)
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Two, Issue 12, Phile #2 of 11
==Phrack Pro-Phile IX==
Written and Created by Taran King
3/17/87
Welcome to Phrack Pro-Phile V. Phrack Pro-Phile is created to bring
info to you, the users, about old or highly important/controversial people.
This month, I bring to you a name from the past...
Agrajag The Prolonged
~~~~~~~~~~~~~~~~~~~~~
Agrajag was popular on many boards and hung out with many of the
stronger names in the phreak/hack community.
------------------------------------------------------------------------------
Personal
~~~~~~~~
Handle: Agrajag The Prolonged
Call him: Keith
Past handles: None
Handle origin: Fictional character in Hitchhiker Trilogy
Date of Birth: 6/14/67
Age at current date: 19 years old
Height: 6'2"
Weight: 139 lbs.
Eye color: Brown
Hair Color: Depends on the day (Orange, Brown, Black, Hot Pink, etc.)
Computers: TRS Model III, worked his way up to a TVI 950 Dumb
Terminal
------------------------------------------------------------------------------
Agrajag started phreaking and hacking in about 1979 through the help
of some friends of his. He originally started hacking (programming) on a
Vector 8080 in 4th grade. His instructor then is now one of the top 5
computer instructors. Phreaking began with, of course, codes but he was very
interested in how the phone system worked. He had read some books on the
phone company and their evils in their earlier days and he was very interested
in the very idea of becoming an operator. Members of the elite world which he
has met include Tuc, BIOC Agent 003, Broadway Hacker (negative), and Cheshire
Catalyst, all at a Tap meeting he attended. On regular BBSes, there were
listings for other BBSes which turned out to eventually be phreak BBSes. Some
of the memorable phreak boards he was on included WOPR, OSUNY, Plovernet, and
Pirate 80. His phreaking and hacking knowledge came about with the group of
people including Tuc, BIOC, and Karl Marx.
Agrajag was a video game programmer for the last American owned video
game manufacturer, Cinematronix, Inc. (of Dragon's Lair, Space Ace, World
Series, and Danger Zone fame, of which he helped with World Series and a big
part of Danger Zone) which went bankrupt a bit over a month ago.
Agrajag takes interviews for magazines (such as this) which keeps up
his phreak/hack activity. He (and a bunch of others) were written up in a USA
Today article as well as being interviewed by a local paper when The Cracker
(Bill Landreth) got busted (they took pictures of the back of his head in
front of his computer).
Agrajag was never in any major phreak groups except for The
Hitchhikers (Bring your towel!) which was just a group of local friends.
------------------------------------------------------------------------------
Interests: Telecommunications (modeming, phreaking, hacking,
programming), music, concerts, club hopping, and video
games.
Agrajag's Favorite Thing
------------------------
Club/Bar hopping: Tijuanna (TJ)
Most Memorable Experiences
--------------------------
Going officing. Tuc, BIOC, and he were let into a local CO and they used
their copying machine to make copies of their manuals. They
replaced the paper [over 2 reams] later and didn't steal anything
major besides the paper and a few NY Bell signs.
Called supervisors saying that they had witnessed some trunks red-lighting and
there would be severe problems if they didn't contact this guy,
Abbot Went, in San Francisco. There were about 10 supervisors in
mass hysteria (on Thanksgiving) wondering what to do. Later, they
called up Abbot again saying they were the White House switch and
said some kids were fooling around.
Breaking into his school's computer in his senior year mid-semester. He had
scanned it out on a school prefix and the login and password was the
name of his school. It was a TOPS-20 system and he was well enough
versed in TOPS-20 to know what to do. The next day, he told the
vice-principal that he had broken into the computer and that they
had some major security problems. They said he was bullshitting and
he told them to read their mail. Then, later, he brought in his
equipment and showed them with the principal there. He was
threatened by the principal with police, etc. but he told them to go
to hell. He was later offered a job helping the security on the
system but instead, he told them how they could solve the security
problem and didn't take the job.
Agrajag's teacher asking him to do a credit check on someone illegally. He
eventually did part of it, but the teacher was an asshole so he
didn't give all the information to him.
Getting flown to the Tap meeting by a friend.
Some People to Mention
----------------------
Tuc
BIOC Agent 003
Karl Marx
Automatic Jack
All for being friends and all around good people and phreaks.
------------------------------------------------------------------------------
Agrajag is out and out against the idea of the destruction of data.
He hated a person intensely because they posted private lines with
instructions on how to maim a system owned by someone who was already hated.
He deleted the message (he was co-sysop) and it became a bit controversial.
He hated that then and still has no respect for anyone who does this. Where
have all the good times gone?
------------------------------------------------------------------------------
I hope you enjoyed this phile, look forward to more Phrack Pro-Philes coming
in the near future. ...And now for the regularly taken poll from all
interviewees.
Of the general population of phreaks you have met, would you consider most
phreaks, if any, to be computer geeks? The general populus, yes, but good
phreaks, no. Thank you for your time, Agrajag.
Taran King
Sysop of Metal Shop Private
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Two, Issue 12, Phile #3 of 11
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% %
% The Life & Times of The Executioner %
% %
% by Oryan QUEST %
% %
% Written on 3/16/87 %
% %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Introduction:
------------
This file was not written with the intention of being cute, funny or to tell
fellow phreaks and hacks how lame or stupid they are. It was written to open
the eyes of these idiots to see what the REAL story is.
The Executioner/Mikey
---------------------
I'm am sure the majority of you have heard of "Exy." His claim to fame is
simply telling people how lame they are or how great and sexy he is. He also
claims to be wealthy and that Phreak Klass 2600 is the best bulletin board on
this side of the galaxy. Let us examine some key events.
When Metal Shop Private was up, Mr. Sexy Exy (oh and I doubt he really is),
proceeded to rag on everyone on the system with the exception of a few that he
ass-kissed. He then turns around when Phreak Klass 2600 (and I am in no way
ragging on Phreak Klass) goes up, to ask everyone he has annoyed for over 2
months and badgers them to call. Now, Mike, I seriously doubt you are as sexy
as you claim for several reasons. Just by the nature of your attitude, the
way you think you are powerful because you can "tell" people about their lives
and families when you yourself are a Chinese bastard who has an unemployed
father that can barely speak the English language.
"Miko ith no heeahh riiitte nao"
(Michael is no here right now)
You have ragged on Arthur Dent when you know that you will NEVER receive the
admiration or stature whether it be socially or economically he has attained.
You have ragged on Dr. Doom when he has achieved more than you can ever hope
for. You only commenced to rag on him when he turned down your offer to join
PhoneLine Phantoms. This is because he refused to be associated with an
asshole like you. You continually show signs of immaturity (I am not saying I
am perfect) by poking fun at other people's races (blacks, spics, Iranians)
when you yourself are nothing but a rice dick.
You bad mouth people but, when you need their help you beg for it and ask them
to be cool. You write stupid poems and rhymes about people when they are a
TOTAL misrepresentation of facts. You claim Dr. Doom is so ugly he could
never leave his room. Tell me, have you ever met Dr. Doom? Isn't it true
that you ragged on him only because he didn't want anything to do with you,
your group, and your image?
Are you going to rag on me now and prove all the points I have brought out? I
think so. You ragged on me, telling me my family receives government cheese
handouts and telling me what a loser I am when you yourself have never met me
or bothered to seek the real facts. You then proceeded to badger me to join
your new "legion of queers," The Network Technicians telling me how cool it
would be and begging me to help you learn. But don't I receive government
cheese handouts? Aren't I such a loser? Mr. Solid State trusted you and
joined PLP. He thought nothing bad of you at the time. He just considered
all the rumors about you to be false or misrepresentation. When PLP dissolved,
he saw no purpose to be in any longer and dropped out. You proceeded to rag
on him, when you know you aren't half the man he is. You don't even possess
half the knowledge or personality he has. Tell me, what gives you such
authority to rag on people? What makes you so supreme? Why are you so rich,
when you are 18 and don't even have a car, when you go on and on about your
parents?
You rag on Atlantis because you were kicked off. Now you tell people how lame
it is and how stupid The Lineman and Sir William are. When you know that they
were sick of your, "I am supreme attitude," of your childish antics and your
lack of knowledge of any kind.
Well, Exy, rag on me now, tell me how lame I am, insult me. Make your poems,
songs, and raps. Tell me what kind of a loser I am. Insult Solid State, show
us just how childish you can be. Until then, go back into your dream world
and leave us alone.
Oryan QUEST
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Two, Issue 12, Phile #4 of 11
<%><%><%><%><%><P><h><a><n><t><a><s><i><e><%><%><%><%><%>
<S> A Tribunal Communications Ltd. (c) 1987 <S>
<h> <p>
<a>Understanding the Digital Multiplexing System (DMS)<a>
<d> Part 1 <w>
<o> By Control C <n>
<w><%><%><%><%><%><R><e><a><l><m><%><%><%><%><%><%><%><!>
The DMS switching system, is a lot smaller than normal systems. It takes up
less than 16% of the space for the same number of Step-By-Step (SXS) lines and
20% of cross bar. This is done by taking the hardware out of the CO and
putting them closer to a group of subscribers. Then central office services
can be provided over shorter loops.
DMS offers remote switching with a bunch of remote modules in a bunch of
sizes and capabilities. Some include SXS replacement or growth, Outside plant
cable relief, and Office feature's. The use of remote modules give the CO
more floor space that would usually be used by the Line Concentrating Modules
(LCMs), Main Distribution Frame (MDF), and cable equipment. The advantage of
these modules is that it extends the service radius of the CO, this means
outside plant savings. Remote modules can be located up to 150 miles away
without messing up transmissions.
Other advantages of the DMS system are that it allows integration between
Transmission facilities and switching systems. It's hardware & software is
designed to give a full range of switching applications for Private Branch
Exchange (PBX) business systems, local, toll, and local/toll requirements. The
same Central Control Complex (CCC) and switching networks are used throughout
the whole system. The only difference between each system is the peripheral
units, and software packages. It has a Maintenance and Administration Position
(MAP) which is a integrated multifunction machine interface that switch
maintenance, line and trunk network management, and service order changes can
be carried out.
The software for the central processor is written in PROTEL, a high level
pascal based language. Peripheral processors use a XMS-Pascal software
language.
DMS has a high line and trunk capacity. It has up to 100,000 lines on a
DMS-100 or 60,000 trunks on a DMS-200. It also gives up to 1.4 million
two-way CCS through the switching network. The processor can accept up to
350,000 call attempts.
Here's a list of the DMS systems in use today:
DMS-100 - is a class 5 local office with the ability to handle 1,000 to
100,000 lines. It can give basic telephone service or expanded to handle IBN
custom calling features. The DMS-100 MTX gives cellular radio services. A
local office can also be adapted to Equal Access End Office (EAEO).
Remote Switching Center (RSC) - Ability to handle up to 5,760 lines.
Remote Line Concentrating Module (RLCM) - Ability to handle up to 640 lines.
It uses host Line Concentrator Module (LCM) that can be used by the RSC or
directly by the host DMS-100.
Outside Plant Module (OPM) - Ability to handle up to 640 lines. This also can
be used by the RSC or directly by the host DMS-100.
Subscriber Carrier Module (SCM-100) - There are three basic types of
SCM-100's:
1- Subscriber Carrier Module Rural (SCM-100R) - This eliminates the central
office Central Control Terminal (CCT) by integrating directly into the
DMS-100 through the DMS-1 span lines.
2- Subscriber Carrier Module SLC-96 (SCM-100S) - This gives a direct
interface between DMS-100 and AT&T's SLC-96 digital loop carrier
systems.
3- Subscriber Carrier Module Urban (SCM-100U) - It's used as an interface
to the DMS-1 Urban. The DMS-1 urban is a digital subscriber carrier
system modified for use in Urban areas. It gives Plan Ordinary
Telephone Service (POTS) and special services between a central office
and residential and business communities. It has the ability to handle
576 lines of POTS and special services.
DMS-200 - Has the ability to handle from a few hundred to 60,000 trunks. This
switch can also serve a Access Tandem (AT) function. The Traffic Operator
Position System (TOPS) puts operator services into the DMS-200. Operator
Centralization (OC) allows a single operator location by using the TOPS
positions to transfer operator services from other DMS-200 toll centers. The
Auxiliary Operator Services System (AOSS) let operator services on calls that
need outside information (Such as Directory assistance).
DMS-100/200 - Allows local and toll features described above but also includes
a Equal Access End Office (EAEO)/Access Tandem (AT) combination. It has the
ability to handle up to 100,000 lines or 60,000 trunks.
DMS-250 - This is a high capacity toll system for specialized common carriers
needing tandem switching operations.
DMS-300 - This is a toll system designed for international use. To my
knowledge there are only two DMS-300 switches in use at this time.
DMS switches are divided into four "Functional" areas designed to do certain
operations. These areas are:
1- Central Control Complex (CCC)
2- Network (NET)
3- Peripheral Modules (PM)
4- Maintenance and Administration (MAP)
Here's a description of those areas.
Central Control Complex
Within the Central Control Complex (CCC), the main program in the switch
controls the processing of calls, maintenance and administrative routines, and
changes the activity for these routines to other areas of the switch. The CCC
sends messages to the network, the maintenance and administrative areas trough
message links and directs the functions to be run in those areas.
Network
The Network Modules (NMs) handle the routing of speech paths between the
Peripheral Modules (PMs) and keep these speech connections for the rest of the
call. The network handles message and speech links between the PMs and the
CCC.
Maintenance and Administration
Within the Maintenance and Administration includes Input/Output Controllers
(IOCs) - IOCs interface local or remote input/output devices. The I/O devices
are used to do testing, maintenance, or administrative functions for the
system.
Peripheral Modules
Peripheral Modules (PMs) are used as interfaces between digital carrier spans
(DS-1), analog trunks, and subscriber lines. The PMs are used for scanning
lines for changes of circuit state, doing timing functions used for call
processing, creating dial tones, sending, receiving signaling, and controlling
information to and from the CCC, and checking the network.
Before 1984 only four types of PMs gave trunk interfaces to the DMS system;
these include Trunk Modules (TMs), Digital Carrier Modules (DCMs), Line
Modules (LMs), and Remote Line Modules (RLMs). Since then ten more have been
added, these include Digital Trunk Controller (DTC), Line Group Controller
(LGC), Line Trunk Controller (LTC), Line Concentrating Module (LCM), Remote
Switching Center (RSC), Remote Line Concentrating Module (RLCM), Outside Plant
Module (OPM), Subscriber Carrier Module Rural (SCM-100R), Subscriber Carrier
Module SLC-96 (SCM-100S), and Subscriber Carrier Module Urban (SCM-100U).
Here's and explanation of those modules:
Trunk Module
The Trunk Module (TM) changes incoming speech into digital format, it has the
ability to handle 30 analog trunks. The Pulse Code Modulation (PCM)
information is combined with the trunks supervisory and control signals then
transmitted at 2.56 Mb/s over speech links to the network.
The TM also uses service circuits such as Multifrequency (MF) receivers,
announcement trunks, and test circuits. Each TM has the ability to interface
30 analog trunks or service circuits to the network over one 32-channel speech
link. The TM is not traffic sensitive so each trunk can carry 36 CCS.
Digital Carrier Module
The Digital Carrier Module (DCM) gives a digital interface between the DMS
switch and the DS-1 digital carrier. The DS-1 signal consists of 24 voice
channels. The DCM takes out and puts in signaling and control information on
the DS-1 bit streams which then makes them DS-30 32-channel speech links. The
DCM can interface five DS-1 lines; 5*24=120 voice channels; into four 32-
channel speech links. The DCM can carry a maximum of 36 CCS of traffic on
each trunk.
Line Module
The Line Module (LM) gives an interface for a maximum of 640 analog lines and
condenses the voice and signaling into two, three, or four DS-30, 32-channel
speech links. Four speech links have the ability to handle 3,700 Average Busy
Season Busy Hour (ABSBH) CCS per LM.
Remote Line Module
The Remote Line Module (RLM) is a LM operating in a remote location from the
DMS host. The RLMs can be located up to 150 miles from the host office,
depending on the transmission facilities.
Digital Trunk Controller
The Digital Trunk Controller (DTC) has the ability to interface 20 DS-1 lines.
Then the DS-1 lines are linked to the network by a maximum of 16 DS-30 speech
links; each trunk is able to handle 36 CCS.
Line Group Controller
The Line Group Controller (LGC) dose medium level processing tasks, with the
ability to use host and remote subscriber line interfaces. The LGC has the
ability to use Line Concentrating Modules (LCMs), Remote Switching Centers
(RSCs), Remote Line Concentrating Modules (RLCMs), and Outside Plant Modules
(OPMs).
The LGC can interface up to 20 DS-30 speech links from the LCMs or up to 20
DS-1 links with the ability to serve RSCs, RLCMs, or OPMs.
Line Trunk Controller
The Line Trunk Controller (LTC) combines the DTC and LGC functions and gives a
way to use all the equipment inside the office. The LTC has the ability to
handle the LCM, RSC, RLCM, OPM, and digital trunk interfaces.
The LTC has the ability to give interfaces to a maximum of 20 outside ports
from DS-30A speech links or DS-1 links to 16 network side DS-30 speech links.
Line Concentrating Module
The Line Concentration Module (LCM) when used with the LGC or LTC is just an
expanded version of the line Module. It can serve up to 640 subscriber lines
interfaced with two to six DS-30A speech links. Using six speech links 5,390
CCS can be handled per LCM.
Remote Switching Center
The Remote Switching Center (RSC) interfaces subscriber lines at a remote
location to a DMS-100 host. It has the ability to handle interface for 5,760
lines and is used a replacements for dial offices or Private Branch Exchanges
(PBXs). It can handle 16,200 CCS with the use of 16 DS-1 links.
The RSC consists of the following:
Line Concentrator Module (LCM) - These modules do line interface function.
They are the same as the LCMs that are used in the DMS-100 host.
Remote Cluster Controller (RCC) - This controller gives DS-1/LCM interface,
Local switching inside the remote, and Local intelligence and signaling when
in ESA.
Remote Trunking - Handles the use of RSC originating or terminating traffic
for digital trunking off the RSC. It can give trunking to a CDO co-located
with the RSC or within the service range of the RSC, Private Automatic Branch
Exchanges (PABXs), or Direct Inward Dialing (DID) trunks.
Remote-off-Remote - Lets the RLCMs and OPMs connect to the RCC through DS-1
interfaces. It lets RLCM and OPM subscribers to use the same lines to the host
as the RSC subscribers.
Emergency Stand-Alone (ESA) - If communication with the DMS-100 is lost this
will allow you to call internal to the RSC. It will give station-to-station
and station-to-trunk calls for POTS, IBN, and electronic business sets.
Remote Line Concentrating Module
The Remote Line Concentrating Module (RLCM) is just a LCM used is a remote
location from the DMS-100 host. The RLCM can handle 640 lines; this can is
sometimes used as a replacement for CDOs or PBXs.
Outside Plant Module
The Outside Plant Module (OPM) is an outside plant remote unit. The OPM can
handle 640 lines over six DS-1 links.
Subscriber Carrier Module
The Subscriber Carrier Module (SCM) gives a direct interface for remote
concentrators.
SCM-100R - It can interface up to five Northern Telecom DMS-1 Rural Remote
Terminals (RTs). A DMS-1 rural remote terminal can interface up to 256 lines.
Communication between the RT and SCM- 100R is done through one or two span
lines for voice and one protection line.
SCM-100U - It can interface up to three DMS-1 Urban RTs. A DMS-1 Urban can
interface up to 576 POTS or special service lines. Communication from the RT
to the SCM-100U us done through a maximum of eight DS-1 links.
SCM-100S - It can interface up to four Mode I (non-concentrated) SLC-96
systems or up to six Mode II (concentrated) systems. A SLC-96 can give
interface for up to 96 lines.
The SCM-100 takes away the need for central concentrating terminals and analog
line circuits at the host.
Operator Features
With the use of DMS-200 or DMS 100/200 switch, operator features are available
by the following:
Traffic Operator Position System (TOPS)
Operator Centralization (OC)
Auxiliary Operator Service System (AOSS)
Traffic Operator Position System (TOPS) gives many operator function on inward
and outward calls. The TOPS integrates the operator system with the DMS-200
or DMS-100/200 toll switch.
One voice and one data circuit are needed for each operator position. The
voice circuit is connected to a port of a three-port conference circuit. The
other two ports are connected to the calling and called parties. The data
circuit is used for a digital modem and is used to transmit data punched in by
the operator to the CCC for processing.
Operator Centralization
Operator Centralization (OC) lets the operator use the services given by the
DMS-200 or DMS-100/200 with TOPS. With OC operator traffic from surrounding
DMS sites can be routed to a central host site.
Operator Centralization Diagram
Routing - - -
<----- DMS-200 | AMA |
Remote TC / - - -
= = = = = = = /
| ----- ___|_/
| : DMS : |
| : 200 : | Host TC -----
| : : | = = = = = = = = /| POS |
| : (OC:___| | --------- | / |- - -|
| : : | | : DMS-200 : | / |Oper.|
| ----- | | : (TOPS) :__|_/ -----
= = = = = = = \____________|__: : |
Trib Ope Traffic-> ____________|__:OC) : |
/ | : : |
Non-DMS Remote TC / | --------- |
= = = = = = = = = = = = = = = = = = =
| -------- ----- |
| : TDM : : (OC: |
| : Switch : : : | -----
| : : : DMS :_|_____: AMA :
| : : : 200 : | -----
| /-------- ----- |
= = = = = = = = = = =
/Routing <-Trib Opr Traffic
-------> \n
Auxiliary Operator Services System
The Auxiliary Operator Services System (AOSS) is made to handle directory
assistance, intercept, and that type of operator services, automatic call
distribution, call processing, call detail recording, and operator
administration functions for other operator services that do not need call
completion to a called party. AOSS position uses the same hardware as the
TOPS links to the switch.
Equal Access
Equal Access (EA) is accessible through DMS switches with the addition of
software packages. Both Equal Access End Office (EAEO) for the DMS-100 and
Access Tandem (AT) for the DMS-200 provide equal access features.
Equal Access Network Application
--------- __________________________________
(Phone)--------| DMS-100 |___________ |
--------- | |
NON-EAEO | |IC/INC
-------- -------- /--------- TO
(Phone)---| |------------| DMS-200 |------------ ---- IC/INC
-------- --------- ---------/ /----->
| |
--------- ___________| |
(Phone)--------| DMS-100 |__________________________________|
---------
DMS-100 EAEO
The DMS-100 EAEO gives direct access to interLATA (Local Access and Transport
Area) carriers Point of Presence (POP) inside the LATA. The DMS-200 AT gives
a traffic concentration and distribution function for interLATA traffic
originating or terminating inside a LATA. It allows the following:
10XXX and 950-1XXX dialing
presubscription dialing
equal access and normal network control signaling
Automatic Number Identification (ANI) on all calls
custom calling services
Common Channel Interoffice Signaling
Common Channel Interoffice Signaling (CCIS) uses a separate data link to
transmit signaling messages between offices for many trunks and trunk groups.
There are two types of CCIS available in the DMS-200 or DMS-100/200, Banded
Signaling (CCIS-BS) and Direct Signaling (CCIS-DS).
CCIS-BS is for interoffice trunk signaling to give information on digits
dialed, trunk identity, and other class and routing information. This kind of
trunk signaling takes less time to setup calls and put's an end to Blue
Boxing.
CCIS-DS is used to transfer call handling information past what is required
for trunk setup. This type of signaling lets calling card validation,
mechanized calling card services and billed number screening to be used.
Cellular Mobile Radio Service
Cellular Mobile Radio Service is possible with the DMS-100 Mobile Telephone
Exchange (MTX). The MTX has the ability to serve from a few hundred to over
50,000 people in up to 50 cells.
Thanks to Northern Telecom and my local CO.
Control C
ToK!
March 1987
End of Part 1
<%><%><%><%><%>
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Two, Issue 12, Phile #5 of 11
THE TOTAL NETWORK DATA SYSTEM
BY DOOM PROPHET
The Total Network Data System is a monitoring/analysis network used by
several offices within the Telco to analyze various levels of switching
systems in relation to maintenance, performance, and future network planning
purposes. The systems and the offices that use them will be described in
detail in the following text.
All switching entities that are in one particular serving area collect
traffic information that is classified in three ways: peg count, overflow, and
usage. Peg count is a count of all calls offered on a trunk group or other
network component during the measurement interval, which is usually one hour.
It includes calls that are blocked, which is classified as overflow traffic.
The other measurement types that the TNDS network analyzes and collects are as
follows:
Maintenance Usage (for 1ESS, 2ESS, 5XB, 1XB, XBT)
Incoming Usage (for 1E, 2E, 4AETS)
All trunks busy (SxS)
Last Trunks Busy (SxS)
Completions (SxS, 5XB, XBT, 1XB)
Incoming Peg Count (DMS)
Maintenance Busy Count (2E, 3E)
Detector Group Usage (SxS, 5XB, XBT, 1XB)
In ESS and DMS offices, traffic data is collected by the central processor of
the switch. In electomechanical offices such as crossbar, a Traffic Usage
Recorder is used to scan trunks and other components about every 100 seconds,
counting how many are in use. This data when compiled is sent to the EADAS
system, which is located in the Operating Company's Network Data Collection
Centers and runs on a minicomputer. 4ESS and 4Xbar toll offices do not use
EADAS, but their own system called the Peripheral Bus Computer for traffic
data analysis. After receiving the traffic data from up to 80 switching
offices, EADAS performs two basic functions: It processes some data in near
real time (shortly after it is received) to provide hourly and half hourly
reports and a short term database for network administrators. It also collects
and summarizes data that it will pass on to the other TNDS systems via data
links or magnetic tape.
Three other systems receive directly from EADAS. These systems are ICAN,
TDAS, and EADAS/NM. ICAN stands for Individual Circuit Analysis plan and is
used to study individual circuits in central office equipment that have been
specified by network administrators.
TDAS is the Traffic Data Administration System, which formats traffic data
for use by the remaining downstream systems. ICAN and EADAS/NM are the only
two systems with data links to EADAS that don't have their data formatted by
TDAS before reception. TDAS is run on a mainframe in the NDCC and can be
thought of as a distribution facility for the traffic data. EADAS/NM is used
to watch switching systems and trunk groups designated by network managers,
and reports existing or anticipated congestion on a display board at the
Network Management Centers, where the system is located. Problems can be
analyzed with this system and dealt with within a short period of time after
they occur.
Central Office Reporting Systems
--------------------------------
There are five TNDS engineering and administrative systems that provide
operating company personnel with reports about CO switching equipment. These
are the LBS, 5XBCOER, SPCSCOER, ICAN, and SONDS. LBS, the Load Balance System,
helps assure that the customer traffic load is uniformly distributed over each
switching system. It minimizes congestion on the concentrators, which allow
subscribers to share the equipment in the switch. The LBS analyzes traffic
data coming to it from TDAS to determine the traffic load on each line group
that the system serves. LBS generates reports used by the NMC to determine
line groups that can have new incoming subscriber lines assigned to them. LBS
also does a load balance indexes for the entire operating company, indicating
how effectively each CO has avoided congestion.
Crossbar #5 Central Office Equipment Reports (5XBCOER) and Stored Program
Control Systems COER used for 1, 2, and 3 ESS offices, analyze traffic data to
indicate the overall service provided by the switching system and to tell how
much of its capacity is being used. This info helps determine if new equipment
is needed.
ICAN, which was described briefly above, detects switching system
equipment faults by identifying abnormal load patterns on individual circuits.
A series of reports printed at the Network Administration Center helps network
administrators analyze individual circuit usage and verify circuit grouping.
ICAN is located at the BOC main computer center along with 5XBCOER.
The fifth CO equipment reporting system is called the Small Office Network
Data System, or SONDS. SONDS performs a full range of data manipulation
functions, and is used to provide economically the full TNDS features for step
by step offices. Step offices send data directly to this system, and it is not
formatted by EADAS or TDAS, as it doesn't go through these systems. Weekly,
monthly, exception and on demand reports are automatically distributed by
SONDS to the NAC personnel.
Trunk Network Reporting Systems
-------------------------------
These systems are parts of the TNDS used by the Circuit Administration
Center to support trunk servicing and forecasting. The Trunk Servicing System
helps trunk administrators develop short term plans to make the best use of
the trunks that are already in use. It receives and processes data received
from TDAS and computes offered load. Offered load is the amount of traffic a
trunk group would have carried had the number of circuits been large enough to
handle the load without trunk blocking (giving the caller a re-order or all
circuits busy recording). TSS produces weekly reports showing underutilization
of trunks and below grade of service trunk groups which do not have enough
trunks in them. The CAC uses these reports to add or disconnect trunks
according to what traffic requirements exist.
The Traffic Routing and Forecasting System, replacing the Trunk
Forecasting System, forecasts message trunk requirements for the next five
years. Major conversions and similar network changes are all taken into
consideration when determining the future traffic needs. TRFS receives data
from EADAS, TDAS, and TSS and is located at the Operating Company computer
center.
Since TDAS and some of the downstream TNDS systems need much of the same
information, that information is maintained in a system called Common Update.
In this manner, some data does not have to be duplicated in each individual
system. Some of the information includes the configuration of switching
equipment and the trunk network and specifications on traffic registers for
central offices. Numbers recorded by each register are treated consistently by
each system that uses the Common Update data base. There is an update base for
trunking, referred to as CU/TK, and an update on equipment known as CU/EQ. The
trunking part of the Operating Company's data base is coordinated by the Trunk
Records Management System.
Since the TNDS systems are so important to the proper operation of the
network, the CSAR (Centralized System For Analysis and Reporting) is used to
monitor the entire TNDS performance. The NDCC, the NAC, and the CAC are
provided with measurements of the accuracy, timeliness, and completeness of
the data flow through TNDS from beginning to end. It doesn't analyze data from
EADAS/NM, SONDS, or TRFS.
BOC Operations Centers
----------------------
NAC-Network Administration Center. Responsible for optimum loading, and
utilization of installed COE. Performs daily surveillance of COs and trunk
groups to ensure service objectives are being met. The NAC Reviews profiles of
office load relating to anticipated growth. They work with NSEC to initiate
work orders to increase equipment in use. The systems they use are EADAS,
SPCSCOER, CSAR, and SONDS.
NMC-Network Management Centers. The NMC keeps the network operating
efficiently when unusual traffic patterns or equipment failures would
otherwise result in congestion. The NMC analyzes network performance and
prepares contingency plans for peak days, telethons, and major switch
failures. They monitor a near real time network performance data to identify
abnormal situations. The system they use is EADAS/NM.
CAC-Circuit Administration Center. The CAC ensures that in service trunks
meet current as well as anticipated customer demands at acceptable levels of
service. For planned servicing, the CAC compares current traffic loads with
forecasted loads for the upcoming busy season. If the loads are consistent,
the CAC issues the orders to provide the forecasted trunks. When
inconsistencies occur, they examine the variation, develop modified forecasts,
and issue orders based on the new forecast. They review weekly traffic data to
identify trunk groups that need additions and issue the necessary trunk
orders. The systems they use are TSS, TRFS, and CSAR.
NSEC-Network Switching Engineering Center. They plan and design the
network along with the CAC. NSEC develops a forecast of loads for traffic
sensitive switching equipment, sets office capacities, and determines relief
size and timing.
For long range planning, the following offices are utilized.
TNPC-Traffic Network Planning Center. The TNPC determines the most
economic growth and replacement strategies. They handle future network
considerations over a 20 year period for tandem systems, operator services
networks, interconnecting trunks, and switching terminations to accommodate
the trunks.
WCPC-Wire Center Planning Center. This office does the same as the TNPC,
but their jurisdiction includes local switches, the subscriber network, and
interoffice facilities. They have the numbers, types, and locations of
switches and homing arrangements. They also keep track of alternate routes,
tandem centers, etc. Both the TNPC and WCPC provide the CAC and NSEC with
office and network evolution plans for 20 years.
District based maintenance and administration operations are handled by
the NAC, RCMAC, and the SCC. These can cover 240 square miles of serving area.
Network Operations Centers
--------------------------
The highest level of network operations is the Network Operations Center,
located in the AT&T Long Lines HQ in Bedminster, NJ. The main computers used
by the NOC are in Netcong, about 25 miles away, along with some backups. The
NOC are responsible for interregional coordination between the 12 RNOCs, 27
NMCs, and 2 RNMCs in Canada; for monitoring the top portion of toll switches
(all class 1 Regional Centers, 2 Canadian, about 70 class 2 Sectional Centers,
200 Primary centers, some class 4 Toll centers); for monitoring of the
international gateways, and the CCIS network for these switching systems. The
STP signalling links connect STPs to each other, to switches, and to a
centralized database called an NCP (Network Control Point) of which access is
given to switches directly via CCIS.
The Data Transfer Point, which is a data switch that furnishes the NOC with a
flow of monitoring information for all key toll switches, also gives them
information about CCIS STPs and the IOCCs that they monitor.
The operating system supporting the NOC is the NOCS (the S being System),
which is configured with the DTP, a wall display processor, graphics
processors, receive only printers, and CRT terminals for the technicians. The
NOC also uses EADAS/NM through the DTP. Both the NOCS and the DTP run Unix
operating systems.
The second highest level of these operations centers are the RNOCs, or
Regional Network Operations Centers. The 12 RNOCs monitor the CCIS network and
coordinate the 2-3 NMC's activities for its region. The RNOCs use the EADAS/NM
system and something called NORGEN, Network Operations Report Generator, that
prints out reports from EADAS's traffic data.
The first or lowest level of these centers is the Network Management
Centers. There were 27 EADAS/NM supported NMCs across the United States as of
1983. The NMC was described above, as well as the systems it used.
==============================================================================
Some of this information was taken from Bell System publications and from
trashed materials, and may not be the same for every area. All material is
correct to the best of the author's knowledge. Thanks to The Marauder for
supplying some information. This file was written for educational purposes
only.
-End Of File-
--------------------------------------------------------------------------------
Written March, 1987
==Phrack Inc.==
Volume Two, Issue 12, Phile #6 of 11
/ /\n <[]>==========================================<[]>
/ ^ ^ /
|| PLP [+]The Executioner[+] PLP ||
++ ^ ^ ++
|| [+] PhoneLine Phantoms! [+] ||
++ ++
|| CSDC - Hardware Requirements ||
++ ----------------------------- ++
|| PLP | PHRACK XII - PHRACK XII | PLP ||
/ ----------------------------- /\n <[]>==========================================<[]>
/ Phreak Klass Room 2600 = 806-799-0016 /
|| _______________ Login: Educate ||
++ |The only BBS | Sysop:Egyptian Lover ++
|| |that teaches.| Cosysop:The Executioner||
/ --------------- Board lose:Oryan Quest /\n <[]>==========================================<[]>
/ /
Preface:
========
This is the second part of my CSDC (Circuit Switched Digital Capability)
series, the first being in PHRACK X. It is suggested that you read the first
part and also the file on PACT in PHRACK XI. If I feel the material was not
covered completely, I will make a third addition to this file.
Hardware Interfaces
===================
A NCTE or equivalent network interface equipment, located on the customer
premises, is required to provide the CSDC feature for a customer. The NCTE or
an equivalent circuit, located on the customer's premises, is required to
provide TCM (Time-Compression-Multiplexing) transmission on the 2-wire
subscriber loop. The NCTE also has a remote loopback for testing from CSDC
central office.
Dedicated 2-way CSDC trunk circuits are provided via DCT (Digital Carrier
Trunk) combined alternate data/voice (CADV) units with DCT supervision. MF and
CCIS signalling is allowed on these trunks. They provide signalling, switching
and trunking functions between 1A ESS switch and other CSDC offices. To
provide CSDC, the DCT bank must be equipped with alarm and digroup control
units. A Digital Office Timing Supply (DOTS) is needed to provide network
synchronization for the CSDC feature. A minimum of 3 CSDC maintenance circuits
are needed for the CSDC feature to operate. The circuit provides digital
signals for testing CSDC trunks and loops. They also provide a test
termination for incoming CSDC calls. If an office has superimposed ringing for
4 and 8 party lines, these ringing circuits may be used for loop testing with
the maintenance circuit.
Remote Switching System
=======================
The RSS remote frame contains eight special service slot positions that can be
used for D4 type plug in units (basically allows the RSS to have CSDC
abilities). This allows the CSDC TRXS (Time Compression Multiplexing Remote
Subscriber Exchange) channel units to be housed in the RSS frame. The CSDC
feature is provided via the RSS T1 carrier facilities. The T1 carriers for
CSDC service terminate with position 1 and 0 at the RSS. A ringing and tone
plant is required in the RSS office to ring the phones of special service
channel unit subscribers.
Operation of the CSDC
=====================
An off-hook origination initiates the seizure of an originating register.
A line translation is performed and the CSDC indicator is received from the
Line Equipment Number Class (LENCL) and is stored in the register. A touch
tone service receiver is connected to the line and dial tone is applied. Upon
receiving a digit, dial tone is removed. If the first digit is a '#', digit
collection is set up to collect 2 more digits. Upon receipt of the 2 digits
(99), the PACT (Prefix Access Code Translator) is indexed via the dialed
digits to determine what service has been requested. If the line cannot have
CSDC, an error message is sent. The AB digits (carrier selection) are
collected next. Once the AB digits have been determined to be valid, the CCOL
(Chart Column) is received. The CCOL merely is a code to tell the PACT what is
to be done. Once the AB digits and the CSDC CCOL is received, the original
register is overwritten with the CSDC CCOL. The CSDC office then sends a bit
down the line to tell the equipment that a CSDC call is being processed.
The call is now reinitialized to appear as though no digits have been
collected. Digit collection proceeds until the proper number of digits (7 to
10) has been received. An AMA register is seized at the end of the dialing.
The call is then routed according to the dialed digits on a CSDC outgoing
trunk. Answer guard timing for CSDC calls is 800 ms. Upon answer, the answer
time is recorded in the AMA register.
An outpulsing trunk is seized and a POB is hunted. If an outgoing trunk
and outpulsing device are needed, one will be hunted. Information on the trunk
is stored and a transfer to the outpulsing routine (MF or CCIS) is done. A
verification insures that both calling and called parties are CSDC allowed. If
they are not, the call is routed to an Automatic Intercept Service (AIS).
For MF outpulsing, a junior register is seized, the outgoing trunk is put
into the proper states, and start pulsing signal detection is done followed by
digit outpulsing. For CCIS, call processing is the same as a normal call but a
CCIS continuity check is performed while on the on-hook state.
For an incoming call, the CSDC bit from the Trunk Class Code (TCC) is
stored in the incoming register and a CSDC count is pegged. Digit collection
is performed and a terminating DN translation is performed. Ringing is applied
normally and once it has been answered, the incoming trunk is put in the
off-hook state to pass answer to the next office.
Standard disconnect and trunk guard timing is performed on CSDC calls
when the called or calling party goes off-hook after a talking path has been
established.
Standard CSDC Dynamics
======================
Call forwarding codes dialed after the CSDC code result in reorder.
The Call waiting option is also suspended when a CSDC call is in progress.
Busy tone is given to POTS call that terminates to a CSDC connection. Busy
tone is also given to a calling CSDC party if it encounters a busy line.
In order to have a 800 CSDC feature, the office must have CCIS INWATS ability
in the OSO (Originating Screening Office).
Dialing 911 after the CSDC code is allowed, but 411/611 calls are routed to
error messages.
NCTE (Network Channel Terminating Equipment)
============================================
As covered in Part 1, the NCTE is the equipment that you need to have CSDC.
The NCTE is a piece of hardware that is connected to the CO loop and a
terminal. On the terminal, there are 8 jacks for 8 pins on the NCTE. The
functions of each pin are as followed.
1 - TRANSMISSION DATA
2 - TRANSMISSION DATA
3 - MODE CONTROL
4 - MODE CONTROL
5 - TIP VOICE
6 - RING VOICE
7 - RECEIVED DATA
8 - RECEIVED DATA
==============================================================================
This ends PART II of the CSDC series. Since Taran King was in such a hurry, I
will finish the 3rd file with SCCS integrations, loop structure and RSS
structures.
If you have any questions about this file or any other file, please leave me a
message on either...
Phreak KlassRoom 2600 = 806-799-0016 LOGIN:EDUCATE
My Voice Mail Box = 214-733-5283
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Two, Issue 12, Phile #7 of 11
-/-/-/-/-/-/-/-/-/-/-/-/-
/
/ Hacking : OSL Systems \n /
/ Written by Evil Jay \n /
/ (C) 1987/88 Evil Jay \n /
-/-/-/-/-/-/-/-/-/-/-/-/-
Prologue:
This file is for all those people who are running across the OSL system
and are constantly confused about getting in and what to do once you're in.
Because of the trouble I had getting a manual on the system from ROLM, I
was forced to write this file from what I already know, and what I can do
on the few systems I have gained access to. Since this file is far from
complete (without a manual, most are), I'll leave it to you, to write up
future files on the OSL system. Credit goes to Taran King who got me
interested in writing the file, and who tried to help me get a manual (my
social engineering leaves something to be desired).
What is OSL:
Actually it has been termed as Operating Systems Location, Off Site
Location and a lot of other names. Which? I'm not sure. What I can tell
you is that it's an operating system running on an IBM (?) that does
remote maintenance operations on a ROLM PBX (Referred to as CBX I
believe). As I said, this file is not too complete, and I was unable to
get very much information about the system, or the PBX system itself. I
believe Celtic Phrost wrote a file on ROLM PBX systems, and you might want
to read that or other ROLM files for more information.
Getting In:
If you have trouble logging in, try changing your parity. Also, this
system will only except uppercase. The first thing you should see when you
get a carrier is the following:
MARAUDER10292 01/09/85(^G) 1 03/10/87 00:29:47
RELEASE 8003
OSL, PLEASE.
?
MARAUDER10292 is the system identification. Most of the time, this will
be the name of the company running the OSL system, but occasionally you
will find a system, you will not be able to identify. CN/A it. It might be
your only chance of gaining access to that particular system.
01/09/85. This is a mystery to me. It could be the time that the system
first went up (but sounds unlikely), the date of the current version of
the OSL operating system...etc.
The ^G is a Control-G, and rings a bell at your terminal. I do not know
why, but it does...
The rest of the text on that line is the current time and date.
RELEASE 8003 could be, again, the revision number of the software
package. I don't know.
OSL PLEASE means that you can now attempt to login.
The ? is your prompt. Remember the uppercase only. Naturally we are
going to type "OSL" to login. Once this is done, we will receive this
prompt:
KEY:
This is the password prompt, and so far as I can tell, can be anything
up to, say, 20 characters long. Obviously we are going to try MARAUDERS or
MARAUDER as a password. Here's the tricky part. Some systems do not tell
you whether the password was right or not. Sometimes, if it's right, you
will get a ? prompt again. If not, you will get an ERROR msg. It depends
on the system. Each system is set up a different way. Also, some systems
require all alphabetics, while others require alphanumerics and sometimes
they will require both. Again, you may or may not get an ERROR message.
You can ABORT anything at any time by sending a BREAK. One good thing
about the system is that you have, so far as I can tell, unlimited
attempts at guessing the "KEY". Also, Druidic Death says that "," is a
default, or is commonly used (I don't remember which). Unfortunately, I
have never been able to get this to work myself.
Your IN!:
Okay, first thing we need to do is type HELP. If you have access, which
again, differs from system to system, you will get a menu that looks like
so. (Maybe not, but I am through telling you how strange this system is.)
PLEASE ENTER ONE OF THE FOLLOWING COMMANDS
LREP - DISPLAY REPORT MENU
LST - LIST REPORT COMMANDS CURRENTLY STORED
ACD - ADD AN ACD COMMAND
DEL - DELETE AN ACD COMMAND
MOD - MODIFY AN ACD COMMAND
SUS - SUSPEND AN ACD COMMAND
ACT - ACTIVATE AN ACD COMMAND
LREP: This lists a menu of reports you can view.
LST : This lists all the commands that have been stored in the buffer.
ACD : This activates a command.
DEL : This deletes a command in the buffer.
MOD : This modifies a command in the buffer.
SUS : This suspends a command in the buffer.
ACT : This activates a command in the buffer.
Commands Explained:
Okay, so now we'll go through all of these commands and show you what they
do, and of course, explain each example.
LREP:
LREP lists a number of reports which can be ran. Here is an example:
REP# NAME SYNTAX
---- ---- ------
1 - CURRENT STATUS ACD 1,(FIRST),(LAST),(START),(INT),(#INT),(CLR),(REP)
2 - CUMULATIVE STATUS ACD 2,(FIRST),(LAST),(START),(INT),(#INT),(CLR),(REP)
3 - TRUNK DISPLAY GROUP ACD 3,(FIRST),(LAST),(START),(INT),(#INT),(CLR),(REP)
4 - POSITON PERFORMANCE ACD 4,(FIRST),(LAST),(START),(INT),(#INT),(CLR),(REP)
5 - ABBREVIATED AGENT ACD 5,(FIRST),(LAST),(START),(INT),(#INT),(CLR),(REP)
6 - DAILY PROFILE ACD 6,(FIRST),(LAST),(START),(INT),(#INT),(CLR),(REP)
7 - CUMULATIVE AGENT ACD 7,(FIRST),(LAST),(START),(INT),(#INT),(CLR),(REP)
Current Status : Gives you the current status of the PBX system.
Cumulative Status: Quite obvious.
Trunk Display Grp: Obvious again.
Position Prfrmnce: ???
Abbreviated Agent: ???
Daily Profile : Gives you a report of how the PBX ran on date 00/00/00.
Cumulative Agent : ???
ACD:
I purposely skipped all the other commands, since they are pretty obvious.
They all have to do with adding commands to the buffer, modifying them and
running them..etc. If you get access to a system, it would be wise to LST
all of the commands that the operators have been running and then try them
yourself. No biggy, but oh well. The ACD command activates a command and
lists the desired report on your terminal. While the whole thing can be
typed on one line, you can just type ACD <REPORT NUMBER> <CR> and do it
step by step (a little easier to get the hang of it). Now we'll go through
this, and show you an example of building a command to list the Trunk
Display Report.
?ACD 3
<CTRL-G>FIRST GP OR AGENT ID: (Try 1)
<CTRL-G>LAST GP OR AGENT ID: (Try 2)
START TIME: (Enter START TIME in army time such as 22:52:00)
INTERVAL: (Not sure, hit return)
# OF INTERVALS: (Not sure, hit return)
CLEAR(Y/N): (Type Y, but this is stored in the last cleared log)
REPEAT DAILY?: (No!)
PRINT LAST CLEARED(Y/N): (Here's where the last cleared shows up)
It then prints out the command and executes it, showing you the desired
report.
The end result:
Some other things can be done, such as commands like C and M and a host
of others, but unfortunately, as I said, these systems are very strange
and it's hard to find two alike. The computer is not worthless, and
lots of things can be done on it, but this file is getting quite lengthy.
If there is enough demand, I will write a follow-up. In the meantime, if I
have made any mistakes, or you have more knowledge that you would like to
share with me, I can be reached on the following boards:
ShadowSpawn Private, Hell Phrozen Over, Phantasie Realm and a few others.
-/-/-/-/-/-/-/-/-/-/-/-/-
/
/ An Evil Jay/Phrack, Inc. \n /
/ Presentation \n /
-/-/-/-/-/-/-/-/-/-/-/-/-
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Two, Issue 12, Phile #8 of 11
BUSY LINE VERIFICATION PART II
WRITTEN BY PHANTOM PHREAKER
This file is meant to be an addition to the first file that was included
in Phrack Inc. Issue XI. It is assumed that the reader has read and understood
the previous file. Most of this information will be taken from Bell System
Publications so you don't have to worry about it being incorrect.
First off, I'd like to correct a minor error included in the first file. I
use the format 'KP+0XX+PRE+SUFF+ST' to show the MF routing that is used. This
is not correct AT&T syntax though, the correct format is KP+0XX+NXX+XXXX+ST.
This is minor detail, but some people are very picky.
The Verification Network
------------------------
In a TSPS office, a verification circuit is associated with a 4-wire
OutGoing Trunk (OGT) and a 3-way/4-wire bridging repeater arrangement. This is
the circuit that does the speech scrambling. The speech and other tones (like
busy and re-order) are frequency shifted, but are still recognizable by a TSPS
operator.
TSPS verification trunks are connected via dedicated lines to incoming
verification trunks in a toll office. The toll office provides either a link
to an outgoing trunk and dedicated facilities to another toll office, or an
outgoing toll connecting trunk and dedicated facilities to an incoming
verification trunk in a local office. Each toll office has ways to check the
security of verification trunks. In electronic toll offices (ESS offices), two
independent office data translations provide security of the trunk. Electro-
mechanical toll offices (Such as a CrossBar Tandem (XBT)) use an electrical
cross-office check signal or a segregated switching train to control trunk
connections. Verification trunks relay supervisory signals (such as answering
supervision) to TSPS from the line being verified. Also, if verification
trunks are busy, the TSPS operator will receive a re-order.
The functions of the VFY key
----------------------------
When the operator presses the VFY key, several checks are made upon the
number that has been entered. These are:
A Check to see if the line is within the verification network accessible
by that particular TSPS. If the line is not, the VFY key will flash.
A check to see if the owner of the line wishes BLV to be possible or not.
If the line is something like a police emergency line, then the VFY key will
flash, similar to the first check.
Important TSPS keys
-------------------
When the VFY lamp lights steady (doesn't flash), indicating the process is
acceptable, the operator puts the calling customer on hold and accesses an
idle loop on the operator position. The ACS (Access) lamp lights steady if a
verification trunk is available at that time. Then, the operator presses the
ST key which sends out the complete number to be verified, in MF. The
verification circuit activates, and the operator listens for scrambled speech
and also watches the CLD (Called) lamp on her console. The CLD lamp is lighted
when the operator loop was accessed, and will remain lit if the line being
verified is on-hook. The operator has two ways of seeing if the line is in
use, by listening, and by watching the CLD lamp. If the CLD lamp light goes
out, then the line is off-hook.
If a successful BLV/EMER INT is performed, the operator presses the REC
MSG MSG (Record Message) key, which completes the verification. If the EMER
INT lamp is lit, the charges for the interrupt and the verification are
automatically billed. If the VFY key is pressed twice, it indicates the
verification should not be billed. This could be due to a customer error or a
customer disconnect.
Charging capabilities
---------------------
A customer can pay for a BLV/EMER INT in several ways. They can have the
charges put on their phone bill, if they are calling from their home, they can
bill the charges to an AT&T Calling Card, or pay directly from a coinphone.
Details of the BLV/EMER INT function are recorded on AMA tape, which is later
processed at the RAO (Revenue Accounting Office).
The classes of charge are as follows: STATION PAID, which means exactly
what it says, STATION SPECIAL CALLING, in cases where billing is handled by a
Calling Card or third number billing, and NO AMA, in unusual billing cases.
Also, for BLV/EMER INT calls that originate from a hotel, TSPS can send
charges to HOBIS (Hotel Billing Information System), HOBIC (Hotel Billing
Information Center), or a TTY at the hotel.
AMA records for BLV/EMER INT are recorded in basically the same format
that normal calls are recorded. The only difference is that a numeric data
group is added. The leftmost digit in the data group is a 1 if only a BLV was
done, but it is a 2 if both a BLV and an EMER INT were done. In case of an
aborted BLV, the billing record is marked 'No charge'.
Inward Operator differences
---------------------------
When an Inward operator does BLV/EMER INT, the class of charge is always
NO AMA, because billing is handled at the local TSPS site. Inwards also do not
use the REC MSG key when a TSPS would, they use the VFY key in it's place.
The Speech scrambling technique
-------------------------------
The speech scrambling technique that exists to keep the customers privacy
intact is located in the TSPS console, and not in the verification trunks. The
scrambling technique can only be deactivated by an operator pressing the EMER
INT key, or a craftsperson using the console in a special mode. When the
scrambler is deactivated by an operator doing an EMER INT, the customer hears
an alerting tone (as mentioned in the first BLV file) made up of a 440Hz tone.
This tone is initially played for two seconds, and then once every ten seconds
afterwards until the operator presses her Position Release (POS RLS) key.
Operator trouble reporting
--------------------------
When operators have trouble in handling a call, they can enter trouble
reports that are technically called 'Operator keyed trouble reports'. These
cause messages to be printed on the maintenance TTY and on the trouble report
TTY channel. There are different trouble codes for different things, such as
trouble with the speech scrambler, trouble in the verification network, or
trouble in collecting charges from a customer.
In my area there are 20 such TSPS trouble codes. These are done in MF.
They are entered with the KP TRBL (Key Pulse Trouble) key followed by a two
digit trouble code followed by an ST. A trouble code for beeper trouble could
be entered as KP TRBL+62+ST, and speech scrambler trouble could be KP
TRBL+89+ST. Some of the other reasons for trouble codes are: Crosstalk, No
ring, Noisy, can't hear, improper supervision toward the called and calling
parties, cutoff, positions crossed, coin collecting trouble, third re-order,
distant operator no answer, echo, data transmission, no answer supervision, ST
key lit for more than 4 seconds, and others for person-to-person and
station-to-station completed collect calls.
Maintenance and traffic measurements
------------------------------------
These reports can be output from a maintenance or engineering and service
data TTY, daily or hourly. Each daily report contains data for the previous
day. Some traffic counts are as follows:
Total Verification attempts, VFY key depressions, VFY key depressions when
the requested number is out of TSPS range, VFY key depressions in which the
requested number wasn't verifiable, BLV trunk seizures which pass an
operational test, and EMER INT attempts. Other traffic counts include the
measurements for usage of BLV trunks, the amount of time BLV trunks were
unavailable, and the number of times BLV trunks were seized.
I hope this file has helped people further understand how the BLV system
works. If you haven't read part I, get a copy of Phrack Inc. Issue XI and read
file #10.
As said earlier, most of this information comes directly from Bell System
Publications and so it should be viewed as correct. However, if you do find
any errors then please try to let me know about them so they can be corrected.
Suggested reading
-----------------
TSPS Part I: The console-Written by The Marauder, LOD/H Technical Journal
Issue No. 1, file #4
Busy Line Verification-Phrack Issue XI, file #10
Busy Verification Conference Circuit-Written by 414 Wizard
Verification-TAP issue 88, Written by Fred Steinbeck
Acknowledgements
----------------
Bell System Technical Journal, Vol. 59, No 8.
Bell Labs RECORD periodical
And the following people for contributing information in some form:
Mark Tabas, Doom Prophet, The Marauder
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Two, Issue 12, Phile #9 of 11
Rebuttal to Phrack Issue 8 and 11 (File 11)
Written by Scan Man.....
It has been requested of Taran King (Who doesn't agree with KL on this subj)
to put this somewhere in the next issue of Phrack (12) for proper
distribution. Whether he does or not I cannot say.
Well a number of months have gone by now and I have been written about
accused of and had rebuttals written for me, all of which were about as clear
and factual as mud. And that includes the rebuttal that Telecomputist has in
effect tried to stand with me, and making matters only worse by inaccurate
information. But then all of this started with inaccurate information from
PWN, didn't it. KL has resorted to interfering in other peoples lives in order
to promote his so called news publication. To this I say, if you are going to
call it news then make it facts. I can buy the Enquirer if I want sensational-
istic readership boosting and inflated gossip. You do no justice to yourself
or your publication. I really shouldn't dignify any of this with comment but
shall as the entire matter has been blown so far out of proportion and since I
have been phreaking since these kiddies were still messing their diapers I
feel it a little more than an inconvenience, particularly since these
gentlemen (and I use the term loosely) can't seem to accomplish anything but
guesswork and conjecture and have cost me (and my wife and son) a $50,000 job
so the least I can do is get a few FACTS out.
First, I was (and I stress was) employed by a company called Telecom
Management Corporation. Notice the initials of this company (TMC). Telecom
Mgnt is a management company, and a management company manages other
companies. Among the companies it manages are 6 TMC Long Distance markets
(none of which are in Vegas), two of which are in Charleston where I live and
NY where I worked (up until two snotty nose teenagers (KL & SR) decided to
stick there nose where didn't belong). At any rate I was hired and paid by
Miami, lived in Charleston, and worked in NY. And yes with regard to your "he
must have been quite an asset to them," I was an asset to them. And KL you
seem to think it was surprising that they flew me to NY every week. I don't,
and I'm sure the other 100 businessmen on my flights who I traveled with
regularly would be surprised that they carried the unique distinction of being
somehow in the wrong for having their companies send them to NY every week.
I'll have to tell them this one for a good laff next time I get a 50,000
dollar a yr job that sends me to NY. Moving right along, I will add that I was
employed as a Systems Analyst. When I was originally hired, my interview was
by a fellow from Miami (Telecom Mgnt) and the interview was conducted in the
Chas office (one of the few times I was ever in there). This however doesn't
explain why Pauline Frazier and Ben Graves knew me or didn't care for me. The
reason for this was quite simple: they both knew about me and the bulletin
board and had also been trying to catch me stealing calls from there company
(don't know where they ever got that idea <grin>). At any rate they obviously
were quite unhappy because I got that job.
The next comment in rebut to Telecomputist which was a rebut to PWN Phrack
Issue 8 (what a nightmare), was, and I quote, "I claimed not to have any ties
with Vegas but didn't claim not to have ties with TMC." Boy talk about factual
journalism, really grabbing for straws aren't you. Anything to make me look
bad huh? Wonder why. Wouldn't be for more copies for your next issue would it?
As you could see at the beginning of this rebuttal I clearly stated that
Telecom Management ran 6 TMC markets as well as other companies and that they
were connected but separate from each other. Although none of it is relevant
to any of this, but that doesn't matter when you are out to get copies for
your next issue does it KL. At any rate this also shows where Telecomputist,
although trying to do a good thing, got their facts mixed up too by
misunderstanding the fact that Telecom Managements initials were the same as
TMC and were unrelated companies when actually they are.
In you next comments you say, "The rest of my statements are highly debatable"
(might try looking at a few (no make that all) of your own). You also said
that my statements have no proof (as if yours are so damn factual). First, I
don't have to prove a thing to assholes like you or anyone else for that
matter. You also state your decision (as if you have the right to make any
decisions about me, (shit boy you don't even know me, but you may soon) was to
do nothing because of lack of proof. And you call what you came up with truth?
Based on what, your vast personal knowledge of me, your knowledge of something
some phone phreak told you, because of having worked with me? As for providing
more ammunition to the idea, I'm not what I claim to be. I have claimed to be
nothing, it's you doing all the claiming. And there is no "ammunition" to be
had from the Telecomputist article as it was about as accurate as yours have
been. Shows you what two people who know nothing about nothing can do if they
put their minds to it. I might add that this is the first and last statement I
have personally written that has anything to do with any of this. You also
stated that, "after three months you had proof," yet you have shown only
words, not a speck of proof or truth. You have taken the Telecomputist article
apart and tried every way there was to tear it apart, most of which was
guesswork and innuendo. Examples of this are your quotes of, "Gee isn't that
awful expensive," "Notice how he didn't say he had no ties with TMC,"
"Statements were highly debatable," "Now that he has had a few months to come
up with a story," etc., that's some real facts there KL, you're a real
journalist who deals only with facts. You're not out for gossip or character
assassination. Riiiiiight. I've just been waiting for you to put your foot in
your mouth (in this case both feet). (Don't worry, I'm sure they will fit
nicely)
I think it's also time to tell the story of how all this got started. It's
really a comedy of errors (only I'm not laffing). As I stated earlier I was
paid by Miami, as that's where the home office was. This meant that on
occasion I also went to Miami as well as NY. In Dec of 85 I learned of a new
organization being formed called the CFCA (Communications Fraud Control
Association) although in addition to communications, they support computer and
credit security as well. Knowing that all the top security people were going
to be there and being a good phone phreak on the eternal quest for inside
knowledge, I wanted in on this conference which was held the 6th, 7th and 8th
of Feb 86 in Miami. Soooooo I convinced Telecom that we should check these
People out for some benefit to our company with regard to my job (Systems
Analyst) as after all it was my job to not only develop and operate the
companies' computers but keep them secure as well. So I had had the perfect
excuse to get me in the conference. They agreed with me and went for it and
paid for my flight down there and the conference fee. Moving right along, it
was the 1st day into the conference when just at lunch I was talking to a guy
from Pac NW Bell named Larry Algard (whose name I had forgotten til Sally Ride
showed up on the BBS saying Larry the Algardian had sent me a couple of weeks
later). At any rate while talking to this guy, a security agent from one of
the other LD companies that was there came up and said, "Aren't you Scan Man,
the guy that runs P-80?" Needless to say I about shit, and had to come up with
a damn good answer in about a 100th of a second. Knowing I was there legally
with the authority of my company, I answered back (in front of Larry Algard),
"Yes, but unbeknownst to my members it's an undercover board for TMC the
company I work for." And since Telecom Management Corporations initials were
TMC and they did manage 6 TMC LD companies I knew I was safe if he decided to
check me out, which I was worried about because earlier this same guy (the one
that said, "Aren't you Scan Man") had made a comment about the security of the
meeting and that he believed hackers had infiltrated the meeting. At any rate,
I was out of the fire with this guy and everyone (about 7 others) standing
around in our circle. It does however get worse. Two weeks later I got a new
user on the board named Sally Ride saying, "Larry The Algardian sent me" and
the msg subj was titled Scott Higginbotham. I answered the msg asking him
where he got that name (Scott Higginbotham, my real name) but he thought I
meant where did he get the name Larry the Algardian (see msg reprint below).
His reply is as follows (actual copy of msg)
Scan Man, I got the name from an electronic memo from Sec. Mgr. Larry Algard
to his boss, George Reay. Since I've access to these files via PNB's UNIX AOS,
I read about Algard's meeting with Scott at a CFCA Conf. in Miami. It's nice
to be able to know what the other side is up to, but how did you infiltrate
CFCA? I was able to infiltrate PNB Sec. thru their own system. But, to attend
such a meeting of the toll carriers of the nation and learn their plans to
combat us is a real coup! Understand where I'm coming from?
Sally Ride:::Space Cadet
Now from this msg you can see two things: first that Sally Ride is a two faced
little S.O.B., plus you can also see why he would think I was fed. I can
almost (again I stress almost) understand why he was suspicious. This msg also
points out that at least in his msgs to me he was of the opinion that I had
infiltrated the conference (not that his opinion about anything matters).
Then, on a social ladder climbing binge, he turns it around to me being one of
them (as if he was the only person in the world who could infiltrate
something). To this I say again, I was doing this when you were still in
diapers (SR). Even though I can legitimately understand why he would think I
was a fed as this at least "APPEARS" to be proof that I'm a fed, by that I
mean if I had broken into a telco security computer and found a msg saying
that so and so was running a sting board, I would be prone to believe it
myself. What Sally didn't know was that I had to say that at that conference
to keep from being fried myself when confronted by a security agent who
recognized me. But then what are the odds of someone breaking into the very
computer reading that very msg. If it were me and I was going to take this
information to the phreak community I would have to state the facts, which
were that he found this msg, "then print msg". I would not go into the
guessing that he and KL did in the original Phrack article (or this last one,
since the first obviously wasn't enough). But back to the point of all of
this, "WHAT WOULD YOU SAY STANDING IN THE MIDDLE OF 500 TOP TELCO SECURITY
PEOPLE AND ONE WALKS UP AND SAYS, "AREN'T YOU SO AND SO THAT RUNS SO AND SO
BBS?" See what I meant about a comedy of errors? Do you also see why
sometimes what is apparently the truth isn't always what it appears as. Do you
also see what I mean about gossip and poor journalism? This is not the first
time that Sally or KL has tried to distort facts and interfere with people's
lives. I am referring to the past David Lightman incident. Instead of
belaboring this point, I shall, in the fashion of the great journalists (KL &
SR), reprint another msg from Sally regarding this other incident in order to
show what kind of individual we are dealing with (a 19 yr old who if he spent
as much time hacking and phreaking as he does stretching the facts and butting
into peoples lives might be a good phreak/hack).
From: Sally Ride
Well a couple of things..first about Phrack World News..the above mentioned
article about Blade Runner and David Lightman was credited to David Lightman
and Blade Runner and someone else, maybe K.L. I really don't know either David
or Blade that well, but when someone is accused of being a cop, or a phone
cop, or whatever, I see no reason to keep that a secret from the phreak-world.
Everyone is able to make their own conclusions based on the information
provided and considering the sources. Finally, and I hope this ends all
discussion about this on the "Elite" section of this BBS. Is that what is
allowed for discussion here? Really, character assassination should be kept to
the War Room of some other K-Rad luzer BBS. Secondly, thanks to all who kept
me up to date on the status of the BBSes that had suddenly dropped out of
sight all for separate unrelated reasons. I found The Twilight Zone, now the
Septic Tank, it's back at 203-572-0015, old accounts intact. Taran King's
Metal Shop Private should be back up within hours of this message, see PWN 6
for the details. And Stronghold East is still down as far as I know, should be
back around 7/1. Broadway's always been weird but turning informant? Will
wonders never cease? And, TUC has a board again? And, here I thought he was a
"Security Consultant", per W.57th St. Who knows who's side who is on? Scan
Man, here's news from your neck of the woods. A company named Advanced
Information Management Inc. run by Robert Campbell. The June 23rd issue of
Communications Week says this guy and his 17 consultants are all over the BBS
world. They are based in Woodbridge, VA. Know anything about them? Sound like
some more narcs to worry about. What is the true story on Ralph Meola? PWN 6
says he's the head of AT&T Security. Has anyone ever heard of him before?
Sally Ride:::Space Cadet
I believe your words were, "character assassinations should be kept on some
k-rad Luzer war board" (try taking some of your own advice, or is it different
when it's your friend). You also made the statement that everyone should be
able to make their own decisions based on the sources. In my case it's two
guys that don't know me or really anything about me (KL & SR). Did anyone also
notice Sally's tendency toward a persecution complex? Everyone he mentioned in
the msg is thought to be a phone cop. I mean, really, take a good look at that
msg. It's quite obvious this boy is playing God and deciding who is and isn't
on who's side (you're not the only one who saves msgs). He's either attacked
or defended (mostly attacked or insinuated) about 5 people in one msg of being
the bad ole phone cop. Who set you two up as judge and jury? As to how I feel
about it, I'll use an old saying with a new twist, "If you want to hear the
jukebox, you damn well better have a quarter," better known as "pay the
piper". Does it sound like I'm upset? I mean how would you feel if you had
trouble keeping your family fed, heated, and housed because some asshole that
just hit puberty stuck their nose into your life. Tell your son, no he can't
go skating because you don't have the money because........etc.....Also I
might add that a number of us old guards who were phreaking before there were
computers and BBSes such as my old friend, Joe Engressia (Secrets of Little
Blue Box, Esquire 71) (avail P-80) and others have done actual security work
(not busting heads) defeating security systems on new payphones (test before
marketing) etc for yrs. I don't see anyone jumping up and yelling phone cop on
these guys. People who are admitted security people who also claim to be
phreaks are ignored. So why all the stink with me? In closing I would like to
say that I have little doubt that in their usual fashion KL and/or SR will
attempt to go over every word I have typed looking for more SO CALLED FACTS.
Any way you try to reword it will only be more twisting and supposition. Sooo
be my guest. You will get no more comments from me. The next time either of
you two hear from me, you better have your Quarter for the jukebox cause it
will be time to pay the piper.
P.S. KL do me a favor and call my board and let me know whether you will be at
this phreak conf in St Louis. If so I recommend old cloths, and clean
underwear.
(Oh yes and a quarter.)
Scan Man (3-10-87)
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Two, Issue 12, Phile #10 of 11
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
PWN PWN
PWN >>>>>=-*{ Phrack World News }*-=<<<<< PWN
PWN Issue XII/1 PWN
PWN PWN
PWN Created, Compiled, and Written PWN
PWN by Knight Lightning PWN
PWN PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
Local News March 20, 1987
~~~~~~~~~~
This issue of PWN marks the anniversary of Metal Shop Brewery.
Things are looking up. Metal Shop Private is back and all previous members
are asked to call back. The same passwords and logons still work and even
better, the old posts have been saved despite the hard drive crash a few
months ago.
Phrack XIII will be released on April 1, 1987; April Fool's Day!
It features joke files, fiction files, humorous files, and of course, rag
files. With all the seriousness of the regular issues of Phrack, this is a
chance to release some building flashes of comedy. Please note that files for
Phrack XIII can only be submitted by members of Metal Shop Private. This does
not apply to other issues of Phrack. Don't miss it!
SummerCon 1987
~~~~~~~~~~~~~~
For those that don't already know, TeleComputist Newsletter and Phrack Inc.
are sponsoring this year's big phreak gathering in St. Louis, Missouri. As
many of you may note, St. Louis is the home of Metal Shop Private, Phrack
Inc., and TeleComputist Newsletter. We all hope that since St. Louis is in
the middle of the country that it will be easy for people to attend. We
extend an invitation to anyone who wants to come. We will have a conference
room and two suites in a hotel in St. Louis.
The official date for SummerCon 1987 is June 19,20. This is far enough into
the summer that everyone of the younger generation should be out of school and
early enough that no one has to worry about facing reality right away. This
date has also been chosen specifically as to not interfere with the St. Louis
VP Fair (Vale Profit).
If you are going to attend SummerCon, we ask that you contact Knight
Lightning, Taran King, or Forest Ranger for more details. The TeleComputist
Information Line is (314) 921-7938. The names of those attending will be kept
confidential so as to not cause anyone discomfort, however we do ask that you
identify yourself at the conference by means of a name tag or some form of
identification. Security personal is welcome to attend, but we request that
you let us know ahead of time. If anyone, especially security personnel,
would like to speak at SummerCon please also let us know and we will schedule
you in.
:Knight Lightning
______________________________________________________________________________
Hackers Caught Using Credit Card To Buy More Equipment February 20, 1987
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By Ben L. Kaufman of The Cincinnati Enquirer
"I was uneasy about the pickup."
Two young "hackers" in Milford using an electronic bulletin board to get
stolen credit card numbers and buy hardware to expand their computers. Now
they're in big trouble because unauthorized use of a credit card is a federal
offense and the Secret Service caught them. "Computer-aided credit card fraud
is increasingly common, said special agent in charge, James T. Christian on
Tuesday, "but using the filched name and number to enhance computer clout was
a unique touch."
The two youths had a $1,300 order sent to an abandoned house on Ohio 131E,
Christian said, but when they picked it up an agent was waiting with the UPS
deliveryman.
John Martin Howard, 21, 5788 Meadowview Drive, Milford was cited before U.S.
magistrate J. Vincent Aug Jr., who accepted his plead to guilty Monday and
released him on his promise to return when summoned.
"I was uneasy about the pickup," Howard recalled in a telephone interview. The
risk of getting caught "was in the back of my mind." And it was an awful
moment when the Secret Service agent confronted him and his juvenile buddy,
Howard added. "I think they were surprised," Christian said. Howard was
charged with attempted use of an unauthorized credit card. His juvenile
partner -- who refused to comment Tuesday -- was turned over to his parents.
Christian said the youths ordered equipment from Computer-Ability in suburban
Milwaukee paying with the stolen credit card. A sharp-eyed store employee
noted purchases on that credit card were coming in from all over the country
and called the Secret Service. Within two weeks the trap in Milford was set.
Howard said his young friend knew the Cincinnatian who led them to the
bulletin board filled with the names and the numbers of stolen credit cards.
"We got it from somebody who got it from somebody who got it from somebody on
the east coast," Howard recalled. That new acquaintance also boasted of using
stolen card numbers from electronic bulletin boards to buy expensive
accessories and reselling them locally at bargain process.
He and his friend used the stolen credit card to upgrade his Atari 800 system,
Howard said. "We ordered a bunch of hardware to use with it." In addition to
the purchase that drew the secret service to them, Howard said they "ordered
other stuff, but before we received anything, we were picked up." Howard said
he'd had the Atari about two years and was getting bored with it and home
computers in general.
He had taken computer programming for eight months after high school, he said,
but hadn't used it. He would like to try computer-aided design and
engineering, but right now, he's working in a pizza parlor. Christian said
Howard's parents had been enthusiastic about his computer interests and
friends who shared them. "They though it would keep them out of trouble."
Assistant U.S. attorney Kathleen Brinkman and Christian said the Cincinnati
area investigation was continuing and numerous juveniles, some quite young,
may be involved.
Thanks to Grey Elf
Re-typed for PWN into lowercase by Knight Lightning
______________________________________________________________________________
Hang On... Phone Rates Are Falling Again! March 1987
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>From Changing Times Magazine March 1987 Issue
No news that long-distance rates are still headed down, but now local rates
are poised to follow, at least in some areas.
Competing long-distance carriers have already been forced to react to AT&T's
January rate cut, which averaged 11.2%, with cuts of their own. Now the
Federal Communications Commission [FCC] may propose that an additional $1 or
$2 be added to the subscribers line charge, the $2-a-month access charge that
every residential customer pays. If that happens it would compensate.
Since AT&T's divestiture in January 1984, the telephone services component of
the consumer price index has risen 17.4%, reflecting a 36.7% increase in local
rates at the same time long-distance charges were falling. But price
increases for overall service have moderated each year, falling 2.7% in 1986
from 4.7% in 1985 and 9.2% in 1984. That trend should continue as local rates
stabilize and even fall. Wisconsin and Vermont, for example, have ordered
local companies to make refunds, and a number of states - New York,
Pennsylvania, Washington - are considering lowering rates to reflect the
improved financial position of local phone companies. Those companies will
benefit from tax reform, and lower inflation and interest rates have resulted
in lower expenses in several other areas.
Things are not looking good for some of AT&T's competitors in the long
distance business, however. Forced to follow AT&T's rate cuts, both MCI and
US Sprint are hard-pressed financially, and analysts don't rule out the
possibility that one or both could get out of the long-distance business,
potentially leaving AT&T a monopoly again. But that would be "politically
unacceptable," says analyst Charles Nichols of E.F. Hutton. Some
alternatives: allowing regional phone companies to enter the long-distance
business or allowing AT&T to keep more of the profits it earns from increased
efficiency instead of forcing the company to cut rates. That would take some
pressure off competitors.
Special Thanks to Stingray
______________________________________________________________________________
Police Arrest Computer "Hacker" Suspect March 15, 1987
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>From the St. Louis Post-Dispatch
"MCI told police it was losing $2.7 million a month to such 'hackers.'"
A computer software engineer [Robert Wong] has been arrested at his home in
Maryland Heights, Missouri on suspicion of trying to get into the computer
system of MCI Telecommunications Corporation.
The case is the fourth in this area involving computer "hackers" who have
tried in recent months to get into MCI's computer system, police say.
Detective John Wachter of the Maryland Heights Police Department said the
department would seek a warrant today charging the suspect with "tampering
with computer users," a felony.
The charge is being sought under a state law enacted last year to deal with
hackers - people who try illegally to tap into other computer systems.
The suspect is Robert Wong, 23, of the 2000 block of Maverick Drive, Maryland
Heights, Missouri. Police tracked down Wong by a court-sanctioned "trap" on
his phone after MCI learned that someone was trying to tap into its
long-distance lines.
In a written statement to police, Wong said he "came across" MCI's programs
and access codes. He said he was "amazed" when he got into the system. "I
know it was illegal, but the urge of experimenting was too great," he told
police.
Typed For PWN by Taran King
______________________________________________________________________________
PWN Quicknotes
~~~~~~~~~~~~~~
In upcoming months P-80 will be moved from her ole TRS Model 1 to an IBM PC
compatible. In addition to a boost in storage capacity (amount still
undecided), P-80 will be adding a new "user to user" direct file/program
transfer thus allowing the membership the ability to privately send text or
programs directly to another user. There will also be the ability to forward
a message with text/program attached) to another user after receipt. (2/26/87)
Information from
<S><C><A><N> <M><A><N> & P-80 Information Systems
------------------------------------------------------------------------------
If you consider yourself a phreaker or a hacker in any way, shape or form,
then read on! The Telecom Security Group is sponsoring the first on-line
hack/phreak survey. It consists of about 30 minutes work of answering
questions (or until you want to stop) that pertain to phreaking, hacking, the
security, and the attitudes surrounding it all.
You are allowed to identify yourself during the survey if you wish or you may
remain totally anonymous. It's really just the general answers that will
count. Call now: 914-564-6648 (914-LOG-ON-IT) and type SURVEY at the main
prompt to get the survey. Thanks for your involvement, and do spread the word
to any board that considers itself phreak/hack oriented.
Information by Taran King & Tuc (2/6/87)
------------------------------------------------------------------------------
Telecommunications giant AT&T is lying in its advertisements that claim it has
an exclusive toll-free number for foreign clients to reach U.S. businesses,
its competitor says in a lawsuit.
Worldwide 800 Services Inc. says that it has filed suit against AT&T with the
FCC, charging AT&T with false advertising. The ads by AT&T claim that it can
provide a global telephone network that would allow clients in foreign
countries to call a toll-free number to reach businesses in the United States.
AT&T claimed that "You won't find this type of service anywhere else."
Worldwide 800 says that their company provides toll-free service from any
foreign city to the U.S., whereas AT&T can only provide toll-free service on a
countrywide basis. An AT&T spokeswoman denied all of the charges, stating
that the advertisement in question was neither fraudulent or deceptive. If
Worldwide 800 Services wins the case, they state that they will demand
corrective advertising and seek monetary damages.
Information from Lucifer 666 (3/1/87)
______________________________________________________________________________
--------------------------------------------------------------------------------
==Phrack Inc.==
Volume Two, Issue 12, Phile #11 of 11
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
PWN PWN
PWN >>>>>=-*{ Phrack World News }*-=<<<<< PWN
PWN Issue XII/2 PWN
PWN PWN
PWN Created, Compiled, and Written PWN
PWN by Knight Lightning PWN
PWN PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
Toll-Free Woes January 26, 1987
~~~~~~~~~~~~~~
>From Time Magazine; reprinted in the February 1987 Issue of CO Magazine
While Oral Roberts struggles with budgets, fundamentalist preacher Jerry
Falwell faces a different kind of money pinch. The Lynchburg, VA,
televangelist has long used toll-free phone numbers to assist viewers seeking
spiritual help.
For many months Falwell foes, aware that each phone-in cost $1, have purposely
clogged his lines. An Atlantan programmed his computer to dial Falwell every
30 seconds. Before Southern Bell stepped in, the stunt cost Falwell $750,000.
Late last year, the Daily Cardinal student newspaper at the University of
Wisconsin -- Madison ran a column advocating "telephone terrorism" and listed
several targets, including Falwell.
The TV preacher estimates that annoyance calls cost him more than $1 million
last year, not counting lost donations. Falwell, who is considering legal
action, regards the calls as "unlawful activities" that do "injury to the
cause of Christ."
[Well now...isn't that special? And just where did all these people get the
idea to do "injury to the cause of Christ?" From me, Knight Lightning? No, I
don't think so. From oh maybe Phantom Phreaker? No, I don't think so.
Possibly Lucifer 666, but the big question is... Could it be... SATAN!!!?]
Typed For PWN by Knight Lightning
______________________________________________________________________________
Voice numbers: Are They Really Necessary? March 5, 1987
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
A recent series of events on ShadowSpawn BBS has attracted much attention in
the hack/phreak community. It seems that the sysop, The Psychic Warlord,
denied access to Lex Luthor, Kerrang Khan, and Silver Spy because of their
failure to leave valid voice phone numbers. The following messages have been
taken from ShadowSpawn BBS. [Some posts have been re-formatted].
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
32/50: This board...
Name: The Psychic Warlord #1
Date: 6:36 pm Thu Feb 26, 1987
Alright goddamn it, I'm so fucking pissed off that I'm just about ready to
say Fuck It and take down the board for good. Why? Seems that few people are
happy with the way I run this board. No, not really with the way I run it,
but more like the way I choose to validate my users. Ok, fine... You don't
like it then get the fuck out and quit complaining.
I set certain rules that people have to abide by to get access to this
board. Very simple fucking rules. And now I'm finding out that people don't
want to abide by these rules, and basically tell me I'm fucked in the head for
having and going by them. What rules? For one thing, and this is the major
bitch-point here, new users (no matter WHO THE FUCK they are) are *REQUIRED*
to leave a valid voice number where I or Ctrl can reach them at for
validation. No big fucking deal... Just a goddamn phone number.
"Oh, but I can't give you my voice number. I'm a hacker, and I do untold
amounts of illegal things and I can't risk my number getting out." Riiight.
Like I'm really some fucking Fed who's gonna bust yer ass, or some geek who
gives out peoples phone numbers to any-fucking-body who asks. BULLSHIT!
I'm the Sysop of a (hopefully) respected BBS, and along with that goes a
certain responsibility. I'm not about to go passing out peoples numbers. *I*
have respect for other hackers privacy, unlike some people who choose to
invade mine just for the fucking hell of it. I require that new users leave
their voice numbers for a number of GOOD reasons:
1) Trust -- If they can trust me with their voice numbers, then I can trust
them with access to my board. I need that kind of trust between
me and my users. If they feel that they can't trust me enough to
give me a lousy phone number, then how in God's name am I supposed
to be expected to trust them at all?? My ass is on the line just
as much (if not more) than any user of this board!
2) Security -- Ok... So how do I know if someone is really a Fed or not? I
don't! I go by instinct. Having a person's voice number let's
me call them for validation and get to know them a helluva lot
better than I could through e-mail. Plus, if suspicion ever
arose about a user of my board being a Fed or not, how could I
check this out? If I don't have their voice number, I have no
leads as to where to find or who the fuck this person really
is. Now I don't go checking everyone on the board via the
numbers they give me. I have NEVER had to do that for ANY
user, but the possibility is there. And rather than throw a
possibly innocent person off the board merely on a hunch, we
might be able to prove whether or not it's true. This is
extremely hypothetical, but like I said... the possibility is
there.
Ok, so why the hell should I have to require that established people, like
Lex Luthor and Silver Spy, leave valid voice numbers? Is it fair to the other
users? Hell no. If I required only certain people to give me their numbers,
then what does that do to their trust in me?? It's like me saying, "Well, I
don't trust you... I don't know you that well. You have to sacrifice more
than these guys to get access." That's BULLSHIT, and I'm not about to do it.
If one person is required to give a valid voice number, then every damn user
is required to!
I've been getting a lot of shit the past couple days because I've denied
access to some very well known and respected people in the hack/phreak world.
Namely Lex Luthor, Silver Spy, and Kerrang Khan. I denied all of them access
because they all refused to leave a voice number. Fine. Then they don't get
access. Ctrl [Ctrl-C is a cosysop on ShadowSpawn] said I was crazy. Taran
said pretty much the same. Taran also tried to get me to change my mind...
to condescend, or go against what I believe in and how I believe this board
should be run. He (Taran) said that by my denying Lex and the others access
that I would be hurting this board more than helping it. ***I DON'T GIVE A
DAMN***
I'm not impressed in the least with any of those peoples reputations. I
never have been a "groupie" and I'm not about to start now. Whether or not
they are good or not isn't the issue here, and some people don't seem to
realize that. Yes, Lex is good. He's well known. He's even a nice guy...
I've talked to him before and personally I like him. But I don't play
favorites for anyone. Not Lex, not Silver Spy, and not Kerrang Khan. Nobody.
What really pissed me off, and I should have told Taran that I resented it
at the time, is that TK said that apparently this board is "elite". That I
consider this board to be too good. Personally I think this fucking board is
overrated, and yes Taran... I resented that remark. I can't remember exactly
what he said, but it was something like, "In your logon message you have
'We're not ELITE, we're just cool as hell,' but apparently you ARE elite."
This board isn't "elite" and if I come off seeing that way sometimes, it's
only because people are getting half the picture of what I'm doing.
Ok, so I deny Lex Luthor access to this board. That's all you people seem
to think about. The actual denying of access. You think, "How can he do
that?! What gall! He must be a real egotistic bastard to think that Lex
Luthor isn't good enough to be on this board!" If you think that, and most of
you have thought only that, then you're fucked in the head.
Yes, I realize who these people are! Yes I know their reputations and how
they are renowned for their skills as hackers and phreakers... But like I
said before, that's not the issue. It never was. I *KNOW* how good these
people are. I *KNOW* about their reputations and I respect them for it, but I
don't care. That's not why they've been denied access!
When I deny someone access to this board it's usually for one of two
reasons;
1) They left a false voice number or
2) They either blew off or left really crappy answers to the filter.
Personally I'd be thrilled to have Lex or Silver Spy on the board... and
any of a number of people. But these people can't find it in themselves to
trust me. If they can't trust me, then I can't trust them. It's as simple as
that.
I'm not about to let anyone on this board that I can't trust. It's not
fair to the other users, and it's damn stupid of me. I run this board the
best way I know how. I do what I do in respect to new user validations
because it's the best way, through trial and error, that I have found to
handle it. If people can't respect the way in which I choose to run my board
then I'd appreciate it if they never called. And when regular users of my
board start questioning the way I do thing, and telling me that I'm WRONG for
doing things the way I believe they should be done, then I really start to
wonder what the fuck I'm doing it for at all. I'm not a quitter, and I don't
like the idea of giving up and taking down the board. I'm going to run this
board the way I think is best, and I'm not about to conform to what other
people think I should do.
I've probably stepped on some toes and offended some people with this, but
that's just too damn bad. I hate fighting the topic but I'll fight it if I
have to.
--==The Psychic Warlord==--
37/50: Take a fucking valium
Name: Taran King #45
Date: 9:02 am Sat Feb 28, 1987
You're known for an explosive temper, PW as well as sometimes being extremely
irrational. My policy is to let people on the my board with voice numbers
only. Through the history, I've made maybe 5 exceptions. Some of 'em include
Lex, Spy (at first), Tabas, Videosmith, and Phucked Agent 04. Now, I never
got anything out of PA04 because he got a "call" soon after he got on the
board, but the rest of the members have contributed extremely well to the
board. I just made sure I knew it was really them by referencing and cross
referencing.
If your morals are that unbendable, PW, then you need to relook at the purpose
of this board. If it's to spread phreak/hack knowledge as you said on the
phone, then to have those people on with the experience that they have would
hardly hinder the board. I seriously doubt anyone would feel offended if any
of the forementioned people got on here without leaving a valid voice number,
being that they're not on any other board with a voice number.
I know that Lex is not giving out his number to even the best of his
friends. Spy is really careful about it these days. Not so sure about
Kerrang but he's travelling about now so he's not in one place for too long
nowadays. It's your board and I was trying to give you some constructive
criticism, but you took it the wrong way. You don't have to claim you're
ELITE to be elite. Elite merely means that you've got the respected members
of the community on board. Well, you've got 'em. If you don't like it, I
suggest you go through and purge the log like a big dog. Actually, fuck it.
I'm tired of getting into arguments for trying to help someone. Feel free to
delete my account if you feel that I've not contributed enough information to
the board, or if you've rethought the purpose and decide that it's not for
what I've contributed, dump me. Fuck dis
-TK
44/50: Well...
Name: The Psychic Warlord #1
Date: 4:57 pm Sun Mar 01, 1987
I'm glad that some people agree with me on this. I can understand Lex's
point of view, too. I can also remember a time when I myself refrained from
giving my number to any sysops. But... I've changed my point of view
considerably after living the Sysop life for well over 1.5 years. Now if I
ever wanted access to a board, and the Sysop of that board asked for my voice
number, I'd give it to him.
I've given Lex access to this message base for a short period of time so
that he can check out the discussion. He called me voice the other day and we
talked for a while about this whole biz. I'd like him, and Spy, on the board,
and possibly they'll change their minds. If not, that's cool. I'm just going
to let the whole thing kind of slide from here on out. If they change their
minds, great... Well, Adios.
--==The Psychic Warlord==--
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Kerrang Khan, when notified that he must leave a voice number, said "there is
no reason Psychic Warlord would need any user's phone number." He also stated
that the fact that PW insisted on voice numbers was very "suspicious."
Silver Spy, when notified that he must leave a voice number, never bothered
calling again.
Lex understood the whole situation and remained cool. He said he could see
why a sysop would need voice numbers of his users. Lex was worried about the
board he left it on getting busted and the authorities getting his number. So
PW, in response to this deleted all users phone numbers from the board and
encrypted them in a hidden sub-directory. Now the numbers are there only and
are totally hidden.
Information Provided By
Lucifer 666/Psychic Warlord/ShadowSpawn BBS/Taran King
______________________________________________________________________________
--------------------------------------------------------------------------------- Источник
- www.exploit-db.com
