Phreaking
Encyclopedia
Phreaking is a slang
term coined to describe the activity of a culture
of people who study, experiment with, or explore telecommunication systems, such as equipment and systems connected to public telephone networks. As telephone networks have become computerized, phreaking has become closely linked with computer hacking
. This is sometimes called the H/P culture (with H standing for hacking and P standing for phreaking).
The term phreak is a portmanteau of the words phone
and freak
, and may also refer to the use of various audio frequencies to manipulate a phone system. Phreak, phreaker, or phone phreak are names used for and by individuals who participate in phreaking. A large percentage of the phone Phreaks were blind. Because identities were usually masked, an exact percentage cannot be calculated.
By rapidly clicking the hook for a variable number of times at roughly 5 to 10 clicks per second, and then keeping intervals of roughly one second, the caller can dial numbers as if they were using the rotary dial. The pulse counter in the exchange counts the pulses or clicks and interprets them in two possible ways. Depending on continent and country, one click with a following interval can be either "one" or "zero" and subsequent clicks before the interval are additively counted. This renders ten consecutive clicks being either "zero" or "nine", respectively. Some exchanges allow using additional clicks for special controls, but numbers 0–9 now fall in one of these two standards. One special code, "flash", is a very short single click, possible but hard to simulate. Back in the day of rotary dial, very often technically identical phone sets were marketed in multiple areas of the world, only with plugs matched by country and the dials being bezeled with the local standard numbers.
Such key-locked telephones, if wired to a modern DTMF capable exchange, can also be exploited by a tone dialer that generates the DTMF tones used by modern keypad units. These signals are now very uniformly standardized worldwide, and along with rotary dialing, they are almost all that is left of in-band signaling. It is notable that the two methods can be combined: Even if the exchange does not support DTMF, the key lock can be circumvented by switch-hooking, and the tone dialer can be then used to operate automated DTMF controlled services that can't be used with rotary dial.
began introducing automatic switches for long distance and certain forms of trunking
carriers in the mid-to-late 1950s. With the introduction of these switches, the general population began, for the first time, to interact with computing power on a large scale. Phreaking can be viewed as an extension of this, where individuals interested in computers and technology, yet unable to further that interest for a variety of reasons, turned to the only available option: the computer controlled telephone network.
AT&T's fully automatic switches use tone dialing, a form of in-band signaling
, and include some tones which are for internal telephone company use. One internal use tone is a tone of 2600 Hz which causes a telephone switch to think the call was over, and could be exploited to provide free long-distance and international calls.
The tone was discovered in approximately 1957, by Joe Engressia
, a blind seven-year old boy. Engressia was skilled with perfect pitch
, and discovered that whistling the fourth E above middle C
(a frequency of 2600 Hz) would stop a dialed phone recording. Unaware of what he had done, Engressia called the phone company and asked why the recordings had stopped. This was the beginning of his love of exploring the telephone system.
Other early phreaks, such as "Bill from New York", began to develop a rudimentary understanding of how phone networks worked. Bill discovered that a recorder
he owned could also play the tone at 2600 Hz with the same effect. John Draper
discovered through his friendship with Engressia that the free whistles given out in Cap'n Crunch
cereal boxes also produced a 2600 Hz tone when blown (providing his nickname, "Captain Crunch"). This allowed control of phone systems that worked on single frequency
(SF) controls. One could sound a long whistle to reset the line, followed by groups of whistles (a short tone for a "1", two for a "2", etc.) to dial numbers.
(MF) controls. The slang term for these tones and their use was "Marty Freeman." The specific frequencies required were unknown until 1964, when Bell System
s published the information in the Bell System Technical Journal
in an article describing the methods and frequencies used for interoffice signalling. The journal was intended for the company's engineers; however, it found its way to various college campuses across the United States. With this one article, the Bell System accidentally gave away the "keys to the kingdom," and the intricacies of the phone system were at the disposal of anyone with a cursory knowledge of electronics.
The second generation of phreaks arose at this time, including the New York
ers "Evan Doorbell", "Ben Decibel" and Neil R. Bell and Californians Mark Bernay, Chris Bernay, and "Alan from Canada". Each conducted their own independent exploration and experimentation of the telephone network, initially on an individual basis, and later within groups as they discovered each other in their travels. "Evan Doorbell," "Ben" and "Neil" formed a group of phreaks known as Group Bell. Mark Bernay initiated a similar group named the Mark Bernay Society. Both Mark and Evan received fame amongst today's phone phreakers for Internet publication of their collection of telephone exploration recordings. These recordings, conducted in the 60s, 70s, and early 80s are available at Mark's website Phone Trips.
. This article featured Engressia and John Draper prominently, synonymising their names with phreaking. The article also attracted the interest of other soon-to-be phreaks, such as Steve Wozniak
and Steve Jobs
, who went on to found Apple Computer
.
1971 also saw the beginnings of YIPL (Youth International Party Line), a publication started by Abbie Hoffman
and Al Bell to provide information to Yippies on how to "beat the man," mostly involving telephones. In 1973, Al Bell would move YIPL over and start TAP (Technological American Party). TAP would develop into a major source for subversive technical information among phreaks and hackers all over the world. TAP ran from 1973 to 1984, with Al Bell handing over the magazine to "Tom Edison" in the late 70's. TAP ended publication in 1984 due mostly to a break-in and arson at Tom Edison's residence in 1983. Cheshire Catalyst then took over running the magazine for its final (1984) year.
A controversially suppressed article "How to Build a 'Phone Phreaks' box" in Ramparts Magazine (June, 1972) touched off a firestorm of interest in phreaking. This article published simple schematic plans of a "black box" used to receive free long distance phone calls, and included a very short parts list that could be used to construct one. Bell sued Ramparts which forced the magazine to pull all copies from shelves, but not before numerous copies were sold and many regular subscribers received them.
and the popularity of computer bulletin board systems (accessed via modem
) created an influx of tech-savvy users. These BBSes became popular for computer hackers
and others interested in the technology, and served as a medium for previously scattered independent phone phreaks to share their discoveries and experiments. This not only led to unprecedented collaboration between phone phreaks, but also spread the notion of phreaking to others who took it upon themselves to study, experiment with, or exploit the telephone system. This was also at a time when the telephone company was a popular subject of discussion in the US, as the monopoly
AT&T
was forced into divestiture. During this time, phreaking lost its label for being the exploration of the telephone network, and began to focus more on toll fraud. Computer hackers began to use phreaking methods to find the telephone numbers for modems belonging to businesses, which they could later exploit. Groups then formed around the BBS hacker/phreaking (H/P) community such as the famous Masters of Deception
(Phiber Optik) and Legion of Doom
(Erik Bloodaxe
) groups. In 1985 an underground e-zine called Phrack
(a combination of the words Phreak and Hack) began circulation among BBSes, and focused on hacking, phreaking, and other related technological subjects.
In the early 1990s H/P groups like Masters of Deception and Legion of Doom were shut down by the US Secret Service's Operation Sundevil
. Phreaking as a subculture saw a brief dispersion in fear of criminal prosecution in the 1990s, before the popularity of the internet
initiated a reemergence of phreaking as a subculture in the US and spread phreaking to international levels.
Into the turn of the 21st century, phreaks began to focus on the exploration and playing with the network, and the concept of toll fraud became widely frowned on among serious phreakers, primarily under the influence of the website Phone Trips, put up by second generation phreaks Mark Bernay and Evan Doorbell.
gave rise to many small companies intent upon competing in the long distance market. These included the then-fledgling Sprint
and MCI
, both of whom had only recently entered the marketplace. At the time, there was no way to switch a phone line to have calls automatically carried by non-AT&T companies. Customers of these small long distance operations would be required to dial a local access number, enter their calling card number, and finally enter the area code and phone number they wish to call. Because of the relatively lengthy process for customers to complete a call, the companies kept the calling card numbers short – usually 6 or 7 digits. This opened up a huge vulnerability to phone phreaks with a computer.
6-digit calling card numbers only offer 1 million combinations. 7-digit numbers offer just 10 million. If a company had 10,000 customers, a person attempting to "guess" a card number would have a good chance of doing so correctly once every 100 tries for a 6-digit card and once every 1000 tries for a 7-digit card. While this is almost easy enough for people to do manually, computers made the task far easier. "Code hack" programs were developed for computers with modems. The modems would dial the long distance access number, enter a random calling card number (of the proper number of digits), and attempt to complete a call to a computer bulletin board system (BBS). If the computer connected successfully to the BBS, it proved that it had found a working card number, and it saved that number to disk. If it did not connect to the BBS in a specified amount of time (usually 30 or 60 seconds), it would hang up and try a different code. Using this methodology, code hacking programs would turn up hundreds (or in some cases thousands) of working calling card numbers per day. These would subsequently be shared amongst fellow phreakers.
There was no way for these small phone companies to identify the culprits of these hacks. They had no access to local phone company records of calls into their access numbers, and even if they had access, obtaining such records would be prohibitively expensive and time-consuming. While there was some advancement in tracking down these code hackers in the early 1990s, the problem did not completely disappear until most long distance companies were able to offer standard 1+ dialing without the use of an access number.
as ways to network and
keep in touch over the telephone. It was rare for a phone phreak to legally purchase access to voice mail. Instead, they usually would appropriate unused boxes that were part of business or cellular phone systems. Once a vulnerable mailbox system was discovered, word would spread around the phreak community, and scores of them would take residence on the system. They would use the system as a "home base"
for communication with one another until the rightful owners would discover the intrusion and wipe them off. Voice mailboxes also provided a safe phone number for phreaks to give out to one another as home phone numbers would allow the phreak's identity (and home address) to be discovered. This was especially important given that phone phreaks were breaking the law.
Phreakers also used "bridges" to communicate live with one another. The term "bridge" originally referred to a group of telephone company test lines that were bridged together giving the effect of a party-line. Eventually, all party-lines, whether bridges or not, came to be known as bridges if primarily populated by hackers and/or phreakers.
The popularity of the Internet in the mid-1990s, along with the better awareness of voice mail by business and cell phone owners, made the practice of stealing voice mailboxes less popular. To this day bridges are still very popular with phreakers yet, with the advent of VoIP, the use of telephone company owned bridges has decreased slightly in favor of phreaker-owned conferences.
(MF) phreaking in the lower 48 United States occurred on June 15, 2006, when the last exchange in the continental United States
to use a "phreakable" MF-signalled trunk replaced the aging (yet still well kept) N2 carrier with a T1 carrier
. This exchange, located in Wawina Township, Minnesota
, was run by the Northern Telephone Company of Minnesota. Many phone phreaks from across North America and the world made calls into what was the last group of MF-able inward trunks in the continental United States. A message board was set up for Paul Revere on +1 (218) 488-1307, for phone phreaks across the world to "say their goodbyes" to MF signalling and the N2 in Wawina.
During the days prior to the cutover, many famous phone phreaks such as Mark Bernay, Joybubbles
, Bob Bernay, and Captain Crunch
could be heard leaving their comments on the message board. The official date for the cutover from N2 to T-carrier
was Wednesday, June 14. As early as June 7, there was a noticeable static on what had previously been clear lines. By Monday, June 12, many numbers were unreachable, and the static had peaked. The recording on +1 (218) 488-1307 was generally inaccessible, and MFing through the switch was becoming increasingly difficult due to the increased static. On June 15, at around 1:40 am, Eastern Daylight Time, any new incoming calls were unreachable. As of July 25, 2011, the message played at +1 (218) 488-1307 was simply the current time for Wawina, Minnesota.
in the wires. Long-distance switching remained a manual operation years after short-distance calls were automated, requiring operators at either end of the line to set up the connections.
Bell automated this process by sending "in-band" signals. Since the one thing the long-distance trunks were definitely able to do was send voice-frequency signals, the Bell system used a selection of tones sent over the trunks to control the system. When calling long-distance, the local end-office switch would first route the call to a special switch (this is why it is necessary to dial "1" in North America or "0" in most of Europe for long-distance calls) which would then convert further dialing into tones and send them over an appropriately selected trunk line (selected with the area code). A similar machine at the far end of the trunk would decode the tones back into electrical signals, and the call would complete as normal.
In addition to dialing instructions, the system also included a number of other tones that represented various commands or status. 2600 Hz, the key to early phreaking, was the frequency
of the tone sent by the long-distance switch indicating that the user has gone on-hook
(hung up the phone). This normally resulted in the remote switch also going on-hook, freeing the trunk for other uses. In order to make free lines easy to find, the 2600 Hz tone was continually played into free trunks. Engressia's whistling had triggered the remote switch to go on-hook, but critically, the local switch knew he was still off-hook because that was signaled electrically. The system was now in an inconsistent state, leaving him connected to an operational long-distance trunk line. With further experimentation, the phreaks learned the rest of the signals needed to dial on the remote switch.
Normally long-distance calls are billed locally. Since the "trick" required a long distance call to be placed in order to connect to the remote switch, it would be billed like normal. However there are a class of calls that have either no billing, like calls to directory service, or reverse the billing, like WATS
lines (1-800 numbers). By dialing one of these numbers the user was connected to a remote switch as normal, but no billing record was made locally. A number of people in the 1960s discovered a loophole that resulted from this combination of features that allowed free long distance calls to be made. First you would dial a toll-free number in the area code you wanted to connect to, then play the 2600 Hz tone into the line to return the remote switch to on-hook, and then use a blue box
to dial the number you wanted to connect to. The local Bell office would have no record of the call.
As knowledge of phreaking spread, a minor culture emerged from the increasing number of phone phreaks. Sympathetic (or easily social-engineered) telephone company employees began to provide the various routing codes to use international satellites and trunk lines. At the time it was felt that there was nothing Bell could do to stop this. Their entire network was based on this system, so changing the system in order to stop the phreakers would require a massive infrastructure upgrade.
In fact, Bell responded fairly quickly, but in a more targeted fashion. Looking on local records for inordinately long calls to directory service or other hints that phreakers were using a particular switch, filters could then be installed to block efforts at that end office. Many phreakers were forced to use pay telephones as the telephone company technicians regularly tracked long-distance toll free calls in an elaborate cat-and-mouse game. AT&T instead turned to the law for help, and a number of phreaks were caught by the government.
Eventually, the phone companies in North America did, in fact, replace all their hardware. They didn't do it to stop the phreaks, but simply as a matter of course while moving to fully digital switching systems. Unlike the crossbar, where the switching signals and voice were carried on the same lines, the new systems used separate lines for signalling that the phreaks couldn't get to. This system is known as Common Channel Interoffice Signaling
. Classic phreaking with the 2600 Hz tone continued to work in more remote locations into the 1980s, but was of little use in North America by the 1990s.
Slang
Slang is the use of informal words and expressions that are not considered standard in the speaker's language or dialect but are considered more acceptable when used socially. Slang is often to be found in areas of the lexicon that refer to things considered taboo...
term coined to describe the activity of a culture
Culture
Culture is a term that has many different inter-related meanings. For example, in 1952, Alfred Kroeber and Clyde Kluckhohn compiled a list of 164 definitions of "culture" in Culture: A Critical Review of Concepts and Definitions...
of people who study, experiment with, or explore telecommunication systems, such as equipment and systems connected to public telephone networks. As telephone networks have become computerized, phreaking has become closely linked with computer hacking
Hacker (computer security)
In computer security and everyday language, a hacker is someone who breaks into computers and computer networks. Hackers may be motivated by a multitude of reasons, including profit, protest, or because of the challenge...
. This is sometimes called the H/P culture (with H standing for hacking and P standing for phreaking).
The term phreak is a portmanteau of the words phone
Telephone
The telephone , colloquially referred to as a phone, is a telecommunications device that transmits and receives sounds, usually the human voice. Telephones are a point-to-point communication system whose most basic function is to allow two people separated by large distances to talk to each other...
and freak
Freak
In current usage, the word "freak" is commonly used to refer to a person with something unusual about their appearance or behaviour. This usage dates from the so-called freak scene of the 1960s and 1970s. "Freak" in this sense may be used either as a pejorative, a term of admiration, or a...
, and may also refer to the use of various audio frequencies to manipulate a phone system. Phreak, phreaker, or phone phreak are names used for and by individuals who participate in phreaking. A large percentage of the phone Phreaks were blind. Because identities were usually masked, an exact percentage cannot be calculated.
Switch hook and tone dialer
Possibly one of the first phreaking methods was switch-hooking. It is considered softcore because it has almost negligible toll fraud potential. Nevertheless it allows placing calls from a phone where the rotary dial or keypad has been disabled by a key lock or other means to prevent unauthorized calls from that phone. It is done by rapidly pressing and releasing the switch hook to open and close the subscriber circuit, simulating the pulses generated by the rotary dial. Even most current telephone exchanges support this method, as they need to be backward compatible with old subscriber hardware.By rapidly clicking the hook for a variable number of times at roughly 5 to 10 clicks per second, and then keeping intervals of roughly one second, the caller can dial numbers as if they were using the rotary dial. The pulse counter in the exchange counts the pulses or clicks and interprets them in two possible ways. Depending on continent and country, one click with a following interval can be either "one" or "zero" and subsequent clicks before the interval are additively counted. This renders ten consecutive clicks being either "zero" or "nine", respectively. Some exchanges allow using additional clicks for special controls, but numbers 0–9 now fall in one of these two standards. One special code, "flash", is a very short single click, possible but hard to simulate. Back in the day of rotary dial, very often technically identical phone sets were marketed in multiple areas of the world, only with plugs matched by country and the dials being bezeled with the local standard numbers.
Such key-locked telephones, if wired to a modern DTMF capable exchange, can also be exploited by a tone dialer that generates the DTMF tones used by modern keypad units. These signals are now very uniformly standardized worldwide, and along with rotary dialing, they are almost all that is left of in-band signaling. It is notable that the two methods can be combined: Even if the exchange does not support DTMF, the key lock can be circumvented by switch-hooking, and the tone dialer can be then used to operate automated DTMF controlled services that can't be used with rotary dial.
2600 hertz
The precise origins of phone phreaking are unknown, although it is believed that phreak-like experimentation began with widespread deployment of automatic switches on the telephone networks. In the United States, AT&TAT&T
AT&T Inc. is an American multinational telecommunications corporation headquartered in Whitacre Tower, Dallas, Texas, United States. It is the largest provider of mobile telephony and fixed telephony in the United States, and is also a provider of broadband and subscription television services...
began introducing automatic switches for long distance and certain forms of trunking
Trunking
In modern communications, trunking is a concept by which a communications system can provide network access to many clients by sharing a set of lines or frequencies instead of providing them individually. This is analogous to the structure of a tree with one trunk and many branches. Examples of...
carriers in the mid-to-late 1950s. With the introduction of these switches, the general population began, for the first time, to interact with computing power on a large scale. Phreaking can be viewed as an extension of this, where individuals interested in computers and technology, yet unable to further that interest for a variety of reasons, turned to the only available option: the computer controlled telephone network.
AT&T's fully automatic switches use tone dialing, a form of in-band signaling
In-band signaling
In telecommunications, in-band signaling is the sending of metadata and control information in the same band or channel used for data.-Telephone:...
, and include some tones which are for internal telephone company use. One internal use tone is a tone of 2600 Hz which causes a telephone switch to think the call was over, and could be exploited to provide free long-distance and international calls.
The tone was discovered in approximately 1957, by Joe Engressia
Joybubbles
Joybubbles , born Josef Carl Engressia, Jr. in Richmond, Virginia, USA, was an early phone phreak. Born blind, he became interested in telephones at age four. Gifted with absolute pitch, he was able to whistle 2600 hertz into a telephone . Joybubbles said that he had an IQ of “172 or something.” ...
, a blind seven-year old boy. Engressia was skilled with perfect pitch
Absolute pitch
Absolute pitch , widely referred to as perfect pitch, is the ability of a person to identify or re-create a given musical note without the benefit of an external reference.-Definition:...
, and discovered that whistling the fourth E above middle C
Piano key frequencies
This is a virtual keyboard showing the absolute frequencies in hertz of the notes on a modern piano in twelve-tone equal temperament, with the 49th key, the fifth A , tuned to 440 Hz...
(a frequency of 2600 Hz) would stop a dialed phone recording. Unaware of what he had done, Engressia called the phone company and asked why the recordings had stopped. This was the beginning of his love of exploring the telephone system.
Other early phreaks, such as "Bill from New York", began to develop a rudimentary understanding of how phone networks worked. Bill discovered that a recorder
Recorder
The recorder is a woodwind musical instrument of the family known as fipple flutes or internal duct flutes—whistle-like instruments which include the tin whistle. The recorder is end-blown and the mouth of the instrument is constricted by a wooden plug, known as a block or fipple...
he owned could also play the tone at 2600 Hz with the same effect. John Draper
John Draper
John Thomas Draper , also known as Captain Crunch, Crunch or Crunchman , is an American computer programmer and former phone phreak. He is a legendary figure within the computer programming world.- Background :Draper is the son of a U.S...
discovered through his friendship with Engressia that the free whistles given out in Cap'n Crunch
Cap'n Crunch
Cap'n Crunch is a product line of sweetened corn and oat breakfast cereals introduced in 1963 and manufactured by Quaker Oats Company. Quaker Oats has been a division of PepsiCo since 2001. The product line is heralded by a cartoon mascot named Cap'n Crunch, a sea captain .-Development:Pamela Low,...
cereal boxes also produced a 2600 Hz tone when blown (providing his nickname, "Captain Crunch"). This allowed control of phone systems that worked on single frequency
Single-frequency signaling
Single-frequency signaling is line signaling in which dial pulses or supervisory signals are conveyed by a single voice-frequency tone in each direction...
(SF) controls. One could sound a long whistle to reset the line, followed by groups of whistles (a short tone for a "1", two for a "2", etc.) to dial numbers.
Multi frequency
While single frequency worked on certain phone routes, the most common signaling on the then long distance network was multi-frequencyMulti-frequency
In telephony, multi-frequency signaling is an outdated, in-band signaling technique. Numbers were represented in a two-out-of-five code for transmission from a multi-frequency sender, to be received by a multi-frequency receiver in a distant telephone exchange...
(MF) controls. The slang term for these tones and their use was "Marty Freeman." The specific frequencies required were unknown until 1964, when Bell System
Bell System
The Bell System was the American Bell Telephone Company and then, subsequently, AT&T led system which provided telephone services to much of the United States and Canada from 1877 to 1984, at various times as a monopoly. In 1984, the company was broken up into separate companies, by a U.S...
s published the information in the Bell System Technical Journal
Bell System Technical Journal
The Bell System Technical Journal was the in-house scientific journal of Bell Labs that was published from 1922 to 1983.- Notable papers :...
in an article describing the methods and frequencies used for interoffice signalling. The journal was intended for the company's engineers; however, it found its way to various college campuses across the United States. With this one article, the Bell System accidentally gave away the "keys to the kingdom," and the intricacies of the phone system were at the disposal of anyone with a cursory knowledge of electronics.
The second generation of phreaks arose at this time, including the New York
New York
New York is a state in the Northeastern region of the United States. It is the nation's third most populous state. New York is bordered by New Jersey and Pennsylvania to the south, and by Connecticut, Massachusetts and Vermont to the east...
ers "Evan Doorbell", "Ben Decibel" and Neil R. Bell and Californians Mark Bernay, Chris Bernay, and "Alan from Canada". Each conducted their own independent exploration and experimentation of the telephone network, initially on an individual basis, and later within groups as they discovered each other in their travels. "Evan Doorbell," "Ben" and "Neil" formed a group of phreaks known as Group Bell. Mark Bernay initiated a similar group named the Mark Bernay Society. Both Mark and Evan received fame amongst today's phone phreakers for Internet publication of their collection of telephone exploration recordings. These recordings, conducted in the 60s, 70s, and early 80s are available at Mark's website Phone Trips.
Blue boxes
In October 1971, phreaking was introduced to the masses when Esquire Magazine published a story called "Secrets of the Little Blue Box" by Ron RosenbaumRon Rosenbaum
-Life and career:Rosenbaum was born into a Jewish family in New York City, New York and grew up in Bay Shore, New York. He graduated from Yale University in 1968 and won a Carnegie Fellowship to attend Yale's graduate program in English Literature, though he dropped out after taking one course...
. This article featured Engressia and John Draper prominently, synonymising their names with phreaking. The article also attracted the interest of other soon-to-be phreaks, such as Steve Wozniak
Steve Wozniak
Stephen Gary "Woz" Wozniak is an American computer engineer and programmer who founded Apple Computer, Co. with Steve Jobs and Ronald Wayne...
and Steve Jobs
Steve Jobs
Steven Paul Jobs was an American businessman and inventor widely recognized as a charismatic pioneer of the personal computer revolution. He was co-founder, chairman, and chief executive officer of Apple Inc...
, who went on to found Apple Computer
Apple Computer
Apple Inc. is an American multinational corporation that designs and markets consumer electronics, computer software, and personal computers. The company's best-known hardware products include the Macintosh line of computers, the iPod, the iPhone and the iPad...
.
1971 also saw the beginnings of YIPL (Youth International Party Line), a publication started by Abbie Hoffman
Abbie Hoffman
Abbot Howard "Abbie" Hoffman was a political and social activist who co-founded the Youth International Party ....
and Al Bell to provide information to Yippies on how to "beat the man," mostly involving telephones. In 1973, Al Bell would move YIPL over and start TAP (Technological American Party). TAP would develop into a major source for subversive technical information among phreaks and hackers all over the world. TAP ran from 1973 to 1984, with Al Bell handing over the magazine to "Tom Edison" in the late 70's. TAP ended publication in 1984 due mostly to a break-in and arson at Tom Edison's residence in 1983. Cheshire Catalyst then took over running the magazine for its final (1984) year.
A controversially suppressed article "How to Build a 'Phone Phreaks' box" in Ramparts Magazine (June, 1972) touched off a firestorm of interest in phreaking. This article published simple schematic plans of a "black box" used to receive free long distance phone calls, and included a very short parts list that could be used to construct one. Bell sued Ramparts which forced the magazine to pull all copies from shelves, but not before numerous copies were sold and many regular subscribers received them.
Computer hacking
In the 1980s, the revolution of the personal computerPersonal computer
A personal computer is any general-purpose computer whose size, capabilities, and original sales price make it useful for individuals, and which is intended to be operated directly by an end-user with no intervening computer operator...
and the popularity of computer bulletin board systems (accessed via modem
Modem
A modem is a device that modulates an analog carrier signal to encode digital information, and also demodulates such a carrier signal to decode the transmitted information. The goal is to produce a signal that can be transmitted easily and decoded to reproduce the original digital data...
) created an influx of tech-savvy users. These BBSes became popular for computer hackers
Hacker (computer security)
In computer security and everyday language, a hacker is someone who breaks into computers and computer networks. Hackers may be motivated by a multitude of reasons, including profit, protest, or because of the challenge...
and others interested in the technology, and served as a medium for previously scattered independent phone phreaks to share their discoveries and experiments. This not only led to unprecedented collaboration between phone phreaks, but also spread the notion of phreaking to others who took it upon themselves to study, experiment with, or exploit the telephone system. This was also at a time when the telephone company was a popular subject of discussion in the US, as the monopoly
Monopoly
A monopoly exists when a specific person or enterprise is the only supplier of a particular commodity...
AT&T
AT&T
AT&T Inc. is an American multinational telecommunications corporation headquartered in Whitacre Tower, Dallas, Texas, United States. It is the largest provider of mobile telephony and fixed telephony in the United States, and is also a provider of broadband and subscription television services...
was forced into divestiture. During this time, phreaking lost its label for being the exploration of the telephone network, and began to focus more on toll fraud. Computer hackers began to use phreaking methods to find the telephone numbers for modems belonging to businesses, which they could later exploit. Groups then formed around the BBS hacker/phreaking (H/P) community such as the famous Masters of Deception
Masters of Deception
Masters of Deception was a New York-based hacker group. MOD reportedly controlled all the major telephone RBOC's and X.25 networks as well as controlling large parts of the backbone of the rapidly emerging Internet....
(Phiber Optik) and Legion of Doom
Legion of Doom (hacking)
The Legion of Doom was a hacker group active from the 1980s to the late 1990s and early 2000. Their name appears to be a reference to the antagonists of Challenge of the Superfriends...
(Erik Bloodaxe
Erik Bloodaxe (hacker)
Chris Goggans, who used the name Erik Bloodaxe in honor of the Viking king Eric I of Norway, is a founding member of the Legion of Doom group, and a former editor of Phrack Magazine...
) groups. In 1985 an underground e-zine called Phrack
Phrack
Phrack is an ezine written by and for hackers first published November 17, 1985. Described by Fyodor as "the best, and by far the longest running hacker zine," the magazine is open for contributions by anyone who desires to publish remarkable works or express original ideas on the topics of interest...
(a combination of the words Phreak and Hack) began circulation among BBSes, and focused on hacking, phreaking, and other related technological subjects.
In the early 1990s H/P groups like Masters of Deception and Legion of Doom were shut down by the US Secret Service's Operation Sundevil
Operation Sundevil
Operation Sundevil was a 1990 nation-wide United States Secret Service crackdown on "illegal computer hacking activities." It involved raids in approximately fifteen different cities and resulted in three arrests and the confiscation of computers, the contents of electronic bulletin board systems ,...
. Phreaking as a subculture saw a brief dispersion in fear of criminal prosecution in the 1990s, before the popularity of the internet
Internet
The Internet is a global system of interconnected computer networks that use the standard Internet protocol suite to serve billions of users worldwide...
initiated a reemergence of phreaking as a subculture in the US and spread phreaking to international levels.
Into the turn of the 21st century, phreaks began to focus on the exploration and playing with the network, and the concept of toll fraud became widely frowned on among serious phreakers, primarily under the influence of the website Phone Trips, put up by second generation phreaks Mark Bernay and Evan Doorbell.
Toll fraud
The 1984 AT&T breakupBell System divestiture
The Bell System divestiture, or the breakup of AT&T, was initiated by the filing in 1974 by the U.S. Department of Justice of an antitrust lawsuit against AT&T. The case, United States v...
gave rise to many small companies intent upon competing in the long distance market. These included the then-fledgling Sprint
Sprint Nextel
Sprint Nextel Corporation is an American telecommunications company based in Overland Park, Kansas. The company owns and operates Sprint, the third largest wireless telecommunications network in the United States, with 53.4 million customers, behind Verizon Wireless and AT&T Mobility...
and MCI
MCI Inc.
MCI, Inc. is an American telecommunications subsidiary of Verizon Communications that is headquartered in Ashburn, Virginia...
, both of whom had only recently entered the marketplace. At the time, there was no way to switch a phone line to have calls automatically carried by non-AT&T companies. Customers of these small long distance operations would be required to dial a local access number, enter their calling card number, and finally enter the area code and phone number they wish to call. Because of the relatively lengthy process for customers to complete a call, the companies kept the calling card numbers short – usually 6 or 7 digits. This opened up a huge vulnerability to phone phreaks with a computer.
6-digit calling card numbers only offer 1 million combinations. 7-digit numbers offer just 10 million. If a company had 10,000 customers, a person attempting to "guess" a card number would have a good chance of doing so correctly once every 100 tries for a 6-digit card and once every 1000 tries for a 7-digit card. While this is almost easy enough for people to do manually, computers made the task far easier. "Code hack" programs were developed for computers with modems. The modems would dial the long distance access number, enter a random calling card number (of the proper number of digits), and attempt to complete a call to a computer bulletin board system (BBS). If the computer connected successfully to the BBS, it proved that it had found a working card number, and it saved that number to disk. If it did not connect to the BBS in a specified amount of time (usually 30 or 60 seconds), it would hang up and try a different code. Using this methodology, code hacking programs would turn up hundreds (or in some cases thousands) of working calling card numbers per day. These would subsequently be shared amongst fellow phreakers.
There was no way for these small phone companies to identify the culprits of these hacks. They had no access to local phone company records of calls into their access numbers, and even if they had access, obtaining such records would be prohibitively expensive and time-consuming. While there was some advancement in tracking down these code hackers in the early 1990s, the problem did not completely disappear until most long distance companies were able to offer standard 1+ dialing without the use of an access number.
Diverters
Another method of obtaining free phone calls involved the use of so-called "diverters". Call forwarding was not an available feature for many business phone lines in the 1980s and early 1990s, so they were forced to buy equipment that could do the job manually between two phone lines. When the business would close, they would program the call diverting equipment to answer all calls, pick up another phone line, call their answering service, and bridge the two lines together. This gave the appearance to the caller that they were directly forwarded to the company's answering service. The switching equipment would typically reset the line after the call had hung up and timed out back to dial tone, so the caller could simply wait after the answering service had disconnected, and would eventually get a usable dial tone from the second line. Phreakers recognized the opportunity this provided, and they would spend hours manually dialing businesses after hours, attempting to identify faulty diverters. Once a phreaker had access to one of these lines, he could use it for one of many purposes. In addition to completing phone calls anywhere in the world at the businesses' expense, they could also dial 1-900 phone sex/entertainment numbers, as well as use the phone line to harass their enemies without fear of being traced. Victimized small businesses were usually required to foot the bill for the long distance calls, as it was their own private equipment (not phone company security flaws) that allowed such fraud to occur. By 1993, call forwarding was offered to nearly every business line subscriber, making these diverters obsolete. As a result, hackers stopped searching for the few remaining ones, and this method of toll fraud died.Voice mail boxes and bridges
Prior to the BBS era of the 1980s phone phreaking was more of a solitary venture as it was difficult for phreaks to connect with one another. In addition to communicating over BBSs phone phreaks discovered voice mail boxes and party linesParty line (telephony)
In twentieth-century telephone systems, a party line is an arrangement in which two or more customers are connected directly to the same local loop. Prior to World War II in the United States, party lines were the primary way residential subscribers acquired local telephone service...
as ways to network and
keep in touch over the telephone. It was rare for a phone phreak to legally purchase access to voice mail. Instead, they usually would appropriate unused boxes that were part of business or cellular phone systems. Once a vulnerable mailbox system was discovered, word would spread around the phreak community, and scores of them would take residence on the system. They would use the system as a "home base"
Dead drop
A dead drop or dead letter box is a method of espionage tradecraft used to pass items between two individuals by using a secret location and thus does not require them to meet directly. Using a dead drop permits a Case Officer and his Agent to exchange objects and information while maintaining...
for communication with one another until the rightful owners would discover the intrusion and wipe them off. Voice mailboxes also provided a safe phone number for phreaks to give out to one another as home phone numbers would allow the phreak's identity (and home address) to be discovered. This was especially important given that phone phreaks were breaking the law.
Phreakers also used "bridges" to communicate live with one another. The term "bridge" originally referred to a group of telephone company test lines that were bridged together giving the effect of a party-line. Eventually, all party-lines, whether bridges or not, came to be known as bridges if primarily populated by hackers and/or phreakers.
The popularity of the Internet in the mid-1990s, along with the better awareness of voice mail by business and cell phone owners, made the practice of stealing voice mailboxes less popular. To this day bridges are still very popular with phreakers yet, with the advent of VoIP, the use of telephone company owned bridges has decreased slightly in favor of phreaker-owned conferences.
Cell phones
By the late 1990s, the fraudulent aspect of phreaking all but vanished. Most cellular phones offered unlimited domestic long distance calling for the price of standard airtime (often totally unlimited on weekends), and flat-rate long-distance plans appeared offering unlimited home phone long distance for as little as $25 per month. International calling could be made very cheaply, as well. Between the much higher risk of being caught (due to advances in technology) and the much lower gain of making free phone calls, toll fraud started to become a concept associated very little with phreaking.End of multi-frequency
The end of multi-frequencyMulti-frequency
In telephony, multi-frequency signaling is an outdated, in-band signaling technique. Numbers were represented in a two-out-of-five code for transmission from a multi-frequency sender, to be received by a multi-frequency receiver in a distant telephone exchange...
(MF) phreaking in the lower 48 United States occurred on June 15, 2006, when the last exchange in the continental United States
United States
The United States of America is a federal constitutional republic comprising fifty states and a federal district...
to use a "phreakable" MF-signalled trunk replaced the aging (yet still well kept) N2 carrier with a T1 carrier
T-carrier
In telecommunications, T-carrier, sometimes abbreviated as T-CXR, is the generic designator for any of several digitally multiplexed telecommunications carrier systems originally developed by Bell Labs and used in North America, Japan, and South Korea....
. This exchange, located in Wawina Township, Minnesota
Wawina Township, Minnesota
Wawina Township is a township in Itasca County, Minnesota, United States. The population was 110 at the 2000 census.-Geography:According to the United States Census Bureau, the township has a total area of 36.5 square miles , of which, 36.5 square miles of it is land and 0.03% is...
, was run by the Northern Telephone Company of Minnesota. Many phone phreaks from across North America and the world made calls into what was the last group of MF-able inward trunks in the continental United States. A message board was set up for Paul Revere on +1 (218) 488-1307, for phone phreaks across the world to "say their goodbyes" to MF signalling and the N2 in Wawina.
During the days prior to the cutover, many famous phone phreaks such as Mark Bernay, Joybubbles
Joybubbles
Joybubbles , born Josef Carl Engressia, Jr. in Richmond, Virginia, USA, was an early phone phreak. Born blind, he became interested in telephones at age four. Gifted with absolute pitch, he was able to whistle 2600 hertz into a telephone . Joybubbles said that he had an IQ of “172 or something.” ...
, Bob Bernay, and Captain Crunch
John Draper
John Thomas Draper , also known as Captain Crunch, Crunch or Crunchman , is an American computer programmer and former phone phreak. He is a legendary figure within the computer programming world.- Background :Draper is the son of a U.S...
could be heard leaving their comments on the message board. The official date for the cutover from N2 to T-carrier
T-carrier
In telecommunications, T-carrier, sometimes abbreviated as T-CXR, is the generic designator for any of several digitally multiplexed telecommunications carrier systems originally developed by Bell Labs and used in North America, Japan, and South Korea....
was Wednesday, June 14. As early as June 7, there was a noticeable static on what had previously been clear lines. By Monday, June 12, many numbers were unreachable, and the static had peaked. The recording on +1 (218) 488-1307 was generally inaccessible, and MFing through the switch was becoming increasingly difficult due to the increased static. On June 15, at around 1:40 am, Eastern Daylight Time, any new incoming calls were unreachable. As of July 25, 2011, the message played at +1 (218) 488-1307 was simply the current time for Wawina, Minnesota.
2600 Hz
In the original analog networks, short-distance telephone calls were completed by sending relatively high-power electrical signals through the wires to the end office, which then switched the call. This technique could not be used for long-distance connections, because the signals would be filtered out due to capacitanceCapacitance
In electromagnetism and electronics, capacitance is the ability of a capacitor to store energy in an electric field. Capacitance is also a measure of the amount of electric potential energy stored for a given electric potential. A common form of energy storage device is a parallel-plate capacitor...
in the wires. Long-distance switching remained a manual operation years after short-distance calls were automated, requiring operators at either end of the line to set up the connections.
Bell automated this process by sending "in-band" signals. Since the one thing the long-distance trunks were definitely able to do was send voice-frequency signals, the Bell system used a selection of tones sent over the trunks to control the system. When calling long-distance, the local end-office switch would first route the call to a special switch (this is why it is necessary to dial "1" in North America or "0" in most of Europe for long-distance calls) which would then convert further dialing into tones and send them over an appropriately selected trunk line (selected with the area code). A similar machine at the far end of the trunk would decode the tones back into electrical signals, and the call would complete as normal.
In addition to dialing instructions, the system also included a number of other tones that represented various commands or status. 2600 Hz, the key to early phreaking, was the frequency
Frequency
Frequency is the number of occurrences of a repeating event per unit time. It is also referred to as temporal frequency.The period is the duration of one cycle in a repeating event, so the period is the reciprocal of the frequency...
of the tone sent by the long-distance switch indicating that the user has gone on-hook
On-hook
In telephony, the term on-hook has the following meanings:# The condition that exists when a telephone or other user instrument is not in use, i.e., when idle waiting for a call. Note: on-hook originally referred to the storage of an idle telephone receiver, i.e., separate earpiece, on a switchhook...
(hung up the phone). This normally resulted in the remote switch also going on-hook, freeing the trunk for other uses. In order to make free lines easy to find, the 2600 Hz tone was continually played into free trunks. Engressia's whistling had triggered the remote switch to go on-hook, but critically, the local switch knew he was still off-hook because that was signaled electrically. The system was now in an inconsistent state, leaving him connected to an operational long-distance trunk line. With further experimentation, the phreaks learned the rest of the signals needed to dial on the remote switch.
Normally long-distance calls are billed locally. Since the "trick" required a long distance call to be placed in order to connect to the remote switch, it would be billed like normal. However there are a class of calls that have either no billing, like calls to directory service, or reverse the billing, like WATS
Wide Area Telephone Service
In U.S. telecommunications, a Wide Area Telephone Service is a long distance service offering for customer dial-type telecommunications between a given customer [user] station and stations within specified geographic rate areas employing a single telephone line between the customer user location...
lines (1-800 numbers). By dialing one of these numbers the user was connected to a remote switch as normal, but no billing record was made locally. A number of people in the 1960s discovered a loophole that resulted from this combination of features that allowed free long distance calls to be made. First you would dial a toll-free number in the area code you wanted to connect to, then play the 2600 Hz tone into the line to return the remote switch to on-hook, and then use a blue box
Blue box
An early phreaking tool, the blue box is an electronic device that simulates a telephone operator's dialing console. It functioned by replicating the tones used to switch long-distance calls and using them to route the user's own call, bypassing the normal switching mechanism...
to dial the number you wanted to connect to. The local Bell office would have no record of the call.
As knowledge of phreaking spread, a minor culture emerged from the increasing number of phone phreaks. Sympathetic (or easily social-engineered) telephone company employees began to provide the various routing codes to use international satellites and trunk lines. At the time it was felt that there was nothing Bell could do to stop this. Their entire network was based on this system, so changing the system in order to stop the phreakers would require a massive infrastructure upgrade.
In fact, Bell responded fairly quickly, but in a more targeted fashion. Looking on local records for inordinately long calls to directory service or other hints that phreakers were using a particular switch, filters could then be installed to block efforts at that end office. Many phreakers were forced to use pay telephones as the telephone company technicians regularly tracked long-distance toll free calls in an elaborate cat-and-mouse game. AT&T instead turned to the law for help, and a number of phreaks were caught by the government.
Eventually, the phone companies in North America did, in fact, replace all their hardware. They didn't do it to stop the phreaks, but simply as a matter of course while moving to fully digital switching systems. Unlike the crossbar, where the switching signals and voice were carried on the same lines, the new systems used separate lines for signalling that the phreaks couldn't get to. This system is known as Common Channel Interoffice Signaling
Common Channel Signaling
In telephony, Common Channel Signaling , in the US also Common Channel Interoffice Signaling , is the transmission of signaling information on a separate channel from the data, and, more specifically, where that signaling channel controls multiple data channels.For example, in the public switched...
. Classic phreaking with the 2600 Hz tone continued to work in more remote locations into the 1980s, but was of little use in North America by the 1990s.
Famous phone phreaks
- John DraperJohn DraperJohn Thomas Draper , also known as Captain Crunch, Crunch or Crunchman , is an American computer programmer and former phone phreak. He is a legendary figure within the computer programming world.- Background :Draper is the son of a U.S...
(Captain Crunch) - Mark AbeneMark AbeneMark Abene , better known by his pseudonym Phiber Optik, is a computer security hacker from New York City. Phiber Optik was once a member of the hacker groups Legion of Doom and Masters of Deception....
(Phiber Optik) - Denny TeresiDenny TeresiDenny Teresi is a blind former phone phreak and radio disk jockey, most famous for being the person who introduced John Draper to the field. Both Draper and Teresi were doing Pirate radio broadcasts in the San Jose, California area...
- JoybubblesJoybubblesJoybubbles , born Josef Carl Engressia, Jr. in Richmond, Virginia, USA, was an early phone phreak. Born blind, he became interested in telephones at age four. Gifted with absolute pitch, he was able to whistle 2600 hertz into a telephone . Joybubbles said that he had an IQ of “172 or something.” ...
(Joe Engressia, The Whistler) - Patrick Kroupa (Lord Digital)
- Kevin MitnickKevin MitnickKevin David Mitnick is a computer security consultant, author, and hacker. In the late 20th century, he was convicted of various computer- and communications-related crimes. At the time of his arrest, he was the most-wanted computer criminal in the United States.-Personal life:Mitnick grew up in...
- Kevin PoulsenKevin PoulsenKevin Lee Poulsen is a former black hat hacker. He is currently News Editor at Wired.com.-Biography:...
(Dark Dante)
- Steve WozniakSteve WozniakStephen Gary "Woz" Wozniak is an American computer engineer and programmer who founded Apple Computer, Co. with Steve Jobs and Ronald Wayne...
(Berkeley Blue) - Jered MorganLucky225Lucky225, a.k.a. Jered Morgan, is a Southern California phone phreak and White Hat Security Professional. He is most known for his social engineering abilities, co-hosting internet radio show Default Radio and exploration and knowledge of caller ID spoofing, Calling Party Number , and Automatic...
(Lucky225) - C. Douglas Brickner (doug)
- William QuinnDirect Access Test UnitDirect Access Test Units are special PSTN phone numbers that terminate at the central office switch in a telephone company's local exchange that provide switchmen and telco technicians with a circuit for testing lines in various ways....
(decoder) - Brad CarterPhone Losers of AmericaThe Phone Losers of America is an American phreaking group founded in the 1990s, active on the hacking scene. The PLA e-zine was first written in 1990, and the went up in 1994. It has ranked at the top of Alexa's "Prank Call" category.- History :...
(RBCP) - Matt BlazeMatt BlazeMatt Blaze is a researcher in the areas of secure systems, cryptography, and trust management. He is currently an Associate Professor of Computer and Information Science at the University of Pennsylvania; he received his PhD in Computer Science from Princeton University.In 1992, while working for...
(M.F. Tones)
See also
- 2600: The Hacker Quarterly2600: The Hacker Quarterly2600: The Hacker Quarterly is an American publication that specializes in publishing technical information on a variety of subjects including telephone switching systems, Internet protocols and services, as well as general news concerning the computer "underground" and left wing, and sometimes ,...
- BlueBEEPBlueBEEPBlueBEEP was a popular blue boxing computer program for MS-DOS written between 1993-1995 by a young German programmer known by the pseudonym Onkel Dittmeyer. Used correctly, it could be used to exploit vulnerabilities in the CCITT Signaling System No. 5, used by international telephone switches of...
- Busy line interruptBusy line interruptBusy line interrupt, also known as emergency breakthrough, is a function on land line telephones that allows a caller to interrupt a phone conversation of another caller, especially one who does not have call waiting....
- In-Band SignallingIn-band signalingIn telecommunications, in-band signaling is the sending of metadata and control information in the same band or channel used for data.-Telephone:...
- Hacking
- Phone hackingPhone hackingPhone hacking is a term used to describe the practice of intercepting telephone calls or voicemail messages, often by accessing the voicemail messages of a mobile phone without the consent of the phone's owner...
- Phone Losers of AmericaPhone Losers of AmericaThe Phone Losers of America is an American phreaking group founded in the 1990s, active on the hacking scene. The PLA e-zine was first written in 1990, and the went up in 1994. It has ranked at the top of Alexa's "Prank Call" category.- History :...
- PhrackPhrackPhrack is an ezine written by and for hackers first published November 17, 1985. Described by Fyodor as "the best, and by far the longest running hacker zine," the magazine is open for contributions by anyone who desires to publish remarkable works or express original ideas on the topics of interest...
- Phreaking BoxesPhreaking boxesPhreaking boxes are devices used by Phone Phreaks to perform various functions normally reserved for operators and other telephone company employees....
- Social engineering (security)
- CrackingSoftware crackingSoftware cracking is the modification of software to remove or disable features which are considered undesirable by the person cracking the software, usually related to protection methods: copy protection, trial/demo version, serial number, hardware key, date checks, CD check or software annoyances...
External links
- Secrets of the Little Blue Box – article with photos
- Telephone World – Sounds & Recordings of Wawina, Minnesota
- Textfiles.com / phreak Large collection of phreaking related text files. See also, audio conferences.
- Digital Information Society
- The History of Phone Phreaking
- Phone Trips Large collection of historical phone recordings.
- Phreaky Boys A collection of recordings made in 1990 of voice mail box systems compromised by phreakers.