This talk is freaking for fun and profit. How we pwned the phone. If this
is not the talk you're looking for, tough you have to sit through it. Didn't anyone tell you?
So who am I? My name is Brad Swanson. You can find me
on Twitter as the d1g1t4l_t3mpl4r. You email me if you like.
I'm a manager of threat intelligence in response for a SAS provider out of San
Francisco. About 25, 26, 27ish years doing digital security. Not all of it was, was
deemed digital security back in the old days. It was just doing computer work.
When I was a kid, I had a very large recreational interest in how phone
systems work. It was really neat to go exploring the phone systems and find out
what, what things we could make them do. When I'm not busy computering, I'm
bobbing around in my Jeep out in the desert outside of Las Vegas where I
live. I love social engineering. One of my favorite things to do outside red
teaming and romantic walks on the beach while sipping Wi-Fi. So the
standard disclaimer. These are my experiences, my opinions, my input, my
thoughts. In no way does this reflect the thoughts, opinions of my employer. Most of
my employee doesn't know I'm here today, so awesome. And then a couple of just simple warnings, so
yeah. Sold by weight, not volume, don't inhale the fumes, etc. So we're going to cover a couple of
things today. We're talking about how the phone system works, and this is going to
be at a very high level. We're not going to get into a lot of the super technical
details because, that's really not the point of this talk. It's going to give a
little background on how it works so that folks understand some of the, some
of the other things. We're gonna talk about types of boxes. Which covers a
little bit of an understanding on how the phone system worked. And how some
of those exploits were able to be leveraged. We're going to talk about
some famous people that used to phreak. Why did they phreak? How did they phreak?
What was they're reasoning behind it? And I cover a couple of interesting
numbers. There's still some, some neat numbers you can use for things that
still work today, even though a lot of the boxes and things no longer work. And if
we have time the very end, I'll go through a couple of
entertainment stories about some interesting numbers and some interesting
experiences in the past. Just about the phone system and how that works. So the older,
the older phone system ran what was called SS5. Signaling System 5. It used
what's called in-band signaling. So that means that, the control challenge for the
phone system went down the same channel as your voice. That's good. The phreakers
were super happy about that because it's very easy now to send each control
signals right through the mouth piece. You din't have to do any crazy high jinks to get
those signals in to the band. You just play it in the mouth piece and off they go.
SS5 was designed to work with intercontinental traffic. This was back
in the early days of satellite, you know. The, the sub-oceanic cables. And so SS5
was, was designed for that. And it used what's called MF tones, multi-frequency
tones. So you dial a telephone you hear multi-tones like... Something about a
touch-tone phone. These are different multi-frequency
tones that the phone system used for signaling. The reason they usedd different
multi frequency tones, is they don't want anybody with a touch-tone phone to be
able to start hacking the phone system. They want to get them to go through some
effort. So then after SS5 started getting just pwned all over the place, they said
we need to fix this, we need to come up with something better, something more
robust, something much more secure. They moved to Signaling System 7. There
was a 6 in between, but it was pretty short lived. 7 was the big one. You still
find a lot of systems running SS7 now. In the big change with SS 7 is,
they took that in-band signaling away. They took all the control frequencies,
all these MMF frequencies and they put them in a separate channel. So now, you
can't just send tone to the mouthpiece and then go interesting places. Now it's
a lot harder to do, you know. This phreaking and the box doesn't work
anymore. People who phreak were not happy about it.
It made them sad. It came out around 1980. It did not roll out right away. You hear talks
of a lot of people. I was able to box calls. I lived in a small town, in
Illinois. Had a small, local phone company. We were able to box calls until 1986. So
yeah, it took em' a long time to roll it out. We'll talk about why, about you
know, why it took so long in a minute here. SS7 has a very, very large vulnerability in it.
There's a couple of, a couple of vulnerabilities. One of the big ones, with
SS7, you can track the cell phone user with 70% accuracy. And that only can you
track the location of ss7 your and also intercept and decrypt phone calls so if
you're running 4G and it's running encryption doesn't matter that's a 70
you can decrypt that communication and people have actually used that there's a
case in 2017 in Germany where criminals use this vulnerability to bypass to
conquer and they stole money from people's bank accounts so people would
be like I want to make this transaction my bank the bank is going to factor the
following via SMS pro can intercept that using this ss7 vulnerability so this is
an addition this is different than like you may have heard of sim hijacking this
is yet another way that people were intercepting to factor and it was bad
and they they they kind of knew it was an issue but they didn't fix it right
away and no one's gonna find that well people found it and they leveraged it so
just another reason why you SMS is really a bad idea
here q-factor stuff you use a third party app or or whatever but SMS is not
anybody go as I mentioned it wasn't rolled out as quickly as people had
hoped it would be it's a telco hoped it would be
so precursor joist you know people don't like to explore the phone system we're
excited you know we can keep doing this this is
coming it is near but we can still play until the end comes so why was it so
slow to roll this out it was slow to roll out the cost was
huge I mean it was an extremely excited all your switches it was a great big
infrastructure change which costs money there's also a court ruling that if you
were a phone company and you provided service in two different ladders you had
to have separate infrastructure in each ladder here not by one big that's a
sudden system and using that everywhere you're hoping for one everywhere you're
doing business so that you know the costs exponentially increased based on
that there's a lot of effort well that's a seven there are a lot of differences
between have such five to ss7 so important you just roll it out and just
drop it out there you know just range of people on how it works how to use it how
to roll it out you have to make sure that they understand it before it goes
out so and there are problems your linemen and your people work in the
central office are able to fix that and then you have the actual fiscal roll out
of you till they don't take these that's this box opens out put the ss7 switches
in so with it with us at seven you really roll out all these new switches
we need to keep phone service off while we're doing this we can't just say okay
everybody you're going to being turned off and maybe they'll be back on next
week when the new switches come in let's be a staged approach so there's a lot of
planning involved and then there's the maintenance of it yeah kind of spare so
there's more you know there's more financial out cost for that you need to
make sure that again your wine men are trained on how to maintain this
equipment it's not roll it out you know set it and forget it you didn't need to
make sure that it keeps working because the bones go out people freak out if
your cell service drops for an hour from Verizon people are like torches and
pitchforks right and then they need is there really needs you so you know
homecomings have a finite budget just like all of us have a finite budget
where we work if there's really not a big me they're really not driven to
spend that money and that's a seven role Ben where I lived in central Illinois is
a small phone company small community they didn't really need to roll it out
that's a firework but why should we spend this money now let's wait until we
absolutely to roll this out so sf7 kind of is
leading into the modern day which is boy a lot of a lot of companies are now
using voice over IP and people still freaked but freaker's have become more
hackers than preachers so basically boy turns your handset into
an end point and it calls a server and it rocks your call over the Internet to
another VoIP server often you know Sarah has fallen so if their servers involve
servers gonna be hacked you know there's following the
building's there's all kinds a man should suit any server whether it's a
white server and exchange box or or what-have-you
in fact there was a Melbourne based void company rolled out point servers didn't
panel there's some bad ball and abilities that came out on these servers
they didn't patch and their servers got popped well as soon as it serves you
popped the the bad guys get on the guitar equipment share this information
there's a white provider in Egypt got ahold of these credentials for this
company in Melbourne started routing all their web traffic through this company
in Melbourne the benefits of the Egyptian company they're still charging
their customers the same rate you know it's in a costume for much of this fall
but then has painting point beats because they're routing it off the
melbourne servers box the Melbourne server was still response from the bills
because the bills always have to be paid that's their the phone coming that bill
always has to be paid they ended up writing him over a hundred thousand
dollars just the company in Egypt not counting all the miscellaneous smaller
people that are going in and taking advantage of this and that come to and
out of business six months later because of this there's another company that
said hey we're not going to take Chandra to set up our own our own voyage system
we're gonna manage it ourselves we're gonna take care of it and we'll know
that sure well make sure it gets patched as soon as the patch comes out we're
gonna patch it we're not gonna make the same mistake that Melbourne did except
one of their Edmonds on that box reused password $25,000 on authorized calls and
they yeah because only companies want their money if you've ever had
erroneous charges on a phone bill and ever tried to get those four movies you
know how hard it is the phone company a million okay hey that pillows have to be
have to be paid we're gone so who makes the phone company's income knocking for
it so modern-day freaks are really computer hackers more so than that maybe
the priests of old or more electronics each sort of so instead of a time a new
era that we're going into with with Boyd and butch is gonna get bigger and bigger
treat go so it's gonna it's gonna continue to expand the the happiness
skill set if you will of the modern-day folks so some of us said this is kind of
an overview of how the phone since weren't sent again a super high level
the main thing to do wait a minute SS 5 SS 5 please like it so people sort of
make me these boxes to do crazy stuff on the phone system Bell used to like to
bread and toot their own horn they had a thing called the Bell technical journal
and they would publish articles in it hey this is how we're doing this look
how cool we are awesome oh where we figured out here
look to publish an article on then there really some technical specs on how the
phone system signaling worked in a 1960 issue of this technical journal all
these engineering type and electronics type of people back in the 60s got ahold
of this started reading annoying well they just gave us a key to the kingdom
right here this explains how everything works so we had a small group of people
that were they were playing with the phone system and then exploring I'm
trying to find what happens if I do this where does that go Esquire found out
that there are people in this kind of underground little crew doing this with
the phone system as far as like we should do an article Esquire was a
gentlemen's magazine there was around back then but they're
still around or not they were not huge on like pages and pages and they
interviewed all these famous phone creeps back to maintain and said hey how
does this work show us and this reporter went and would hang out with these
individuals and they would take him out late at night and do things
hey challenge home bones they would show them that the very nitty-gritty nuts and
bolts of all this worked Prince individual wrote an article very
detailed article you know Blaine Johnson's names to protect poets but
that was it so then everybody because it's in this national publication so
basically that blue box works and the blue box was was the the main focus of
this article so if you're below twenty six hundred Hertz tone into a phone it
would capture the trunk and basically what it does it tell us whatever number
you're calling have hung up so you just true twenty six hundred Hertz it
releases the trunk but as soon as you stop blowing that you seize that trunk
again so now you have control of this trunk they use twenty six hundred Hertz
because it's not in a normal speech pattern like you and accent law 2600
Hertz who's talking somebody on the phone your boy 2600 Hertz on a call you
maybe call 50 6070 miles away so you get outside your data you blow that 2,600
Hertz tone the other end things you come home what you call an 800 numbers that's
hanging a billion that 800 things you've hung up releases the trunk well then you
stop blowing and you cease that trunk again and now you can send a key press
signal KP and a number and then s key what you start and it dials that call
she could call London you can call China you could call your neighbor next door
you can call another phone in your house doesn't matter
pretty said okay that's cool but what can we do let's play with it let's
explore you only have this inquisitive minds that we want to know what we did
what else we can do how does it work so they would start stacking trunks they
would say okay I can take I can go from here to London to Brisbane
to Kenya to Canada to South America to New York see the benefit of that and the
freaks that just plain didn't have that niche wanna see them to do it they
didn't have an ulterior motive for it you can call phone numbers you get all
set out special codes in the phone company you could become a directory
assistance operator so $70 five five five one two one two let me get the
operator they get you and then you just mess with them and have fun no the other
thing you can do is you dial internal codes that would give you what's called
a verification line so in the old days if you're trying to call something if
I'm trying to call my coworker Brandon or Hana in the lines busy
for hours I can have the operator break into that call and say excuse me if
Brett's finding an emergency phone call can you please clear the line those
verification lines you can just click into that and just listen and not say
anything this is kind of a very very very early form combining some some
other numbers of the phone company of daxing you listen an eye on a call learn
things about people so it was pretty scary stuff for people to be able to do
that I'll give you could set trunks all around preach did it just because it was
fun because it could and it was cool to hear that I feel like you could call
yourself on another phone after stacking it several times you can say hello and
like three percent Slayer you hear yourself on it oh I need you to stock
yourself back and forth we're all kind of introverts right so who better to
call than yourself yeah and structure real humans that way the Vegas syndicate
found out about those blue boxes they said wait a second okay there's
potential for this you can stack clunk and you can bounce calls and you can
call an 800 number my phone bill shows that I called an 800 number but I'm
really calling someone replace what better use for blue boxes and bookies
but these don't want the cops or anybody to know what they're calling they want
the feds to come in and rate and get their phone records and say oh well you
know they they've called all these people let's you invest it all these
people for illegal gambling that's sad let's let Chuck go to sleep
I'm new at this skinny time I told you my password so the Vegas crime syndicate
said we need to miss blue boxes we want when we get raided we want more like
week all the time and temperature 800 number and Phoenix and that's it all
right the Phoenix time and temperature place let's not have them raid our other
bookies are calling or our other criminal associates let's also make it
very hard for me to trace our phone calls if I call from here to Madison and
they started traced they've got it almost instantly but if I take that call
and I call London and then I bounced that to Paris and then to Tokyo and then
I'm done to Brisbane and then I'm up to San Francisco and then Madison that's a
lot harder for them to trace out because they're tracing each tandem that I've
bounced that across so the mob was like we need these they placed an order with
a gentleman he went by algo el Gilbertson but that's not his real name
he was making blue box isn't selling we settle for $1,500 a piece to people in
the late sixties early seventies that wasn't trying to change her just a low
electronic box the mob comes oasiz 1360 peace dawn so I had that order he
doesn't ever say whether he actually delivered on that and got paid by them
that's kind of a question and that actually went through but suppose we it
didn't she here we have some examples of blue boxes the one on the far left a
large one this is one of the earliest blue boxes this is actually in a museum
and I've waited Sydney Australia and that's what it look like it was a keypad
I had to come with extra buttons on it for doing the 2600 Hertz tone and for
doing the the key press and the start and then a little mouthpiece you just
hold all my speakers sorry they can hold up to the mouthpiece of the phone blue
box are illegal they're very illegal so people in disguise here's a blue box the
size is a calculator hello charging I like old calculators
you could plug in so it had a charging jet
tap the calculator you'd plug your speaker into that if the cops showed up
you unplug your speaker you chuck it and you've got your blue box yeah I know
it's just a calculator officer cops like have a nice day see you this is a new
blue box this is actually built off an Arduino
no blue box is no longer worth here or pretty much anywhere because of the new
signal switch I mean you might be able to use it in some faraway place but what
about is really not working or it's just a just a project it's more of a
nostalgia thing so many peridot how to make blue boxes using Arduino you look
smart we know libraries you know this keypad on the right he's got to ditch
key buy some components and the other blue box again does it work but it's
cool just to have to play with them to talk about conversation piece that's
blue box any questions on blue boxing hey so
there's a black box a black box was used going the other direction see blue boxes
you make calls out for free a black box would allow incoming calls to be free so
the phone company there are two relays in switch one control billing and one
control ring so I've been calling somebody else they could use a black box
and what it would do is normally when you pick up your phone your line voltage
when it's raining drops from that 48 bowl constant not about 10 volts and
that's what trip so it's realized to say okay make the phone stopped ringing and
let's start billing for this call back then everything was by minion welcome to
one of their money using a couple of caps a resistor a Zener diode you can
make this black box it would hold that line bolt to tie enough we're going to
trip the relay to stop the ringing so wasn't driving in Sandy Creek want to
talk to the person but it wasn't enough to trip that billing relay so that
building real I would never trip as far as a phone company thought your phone's
ringing and raining and raining in any and this is before the days where
everybody had voicemail or you know answering machines so this time and
having fallen drink 30 40 times if you're trying to get a hold of somebody
see could get a quick quick message back and forth pretty easily it was one way
so work to people called you wouldn't work if you called out you'd still be
billed normally and these are actually created by an ex-felon point his name
was John Draper it was by Captain Crunch he was there
so figured out that these little toy whistles that you got in boxes the
Captain Crunch in the late sixties would actually blow up 2600 Hertz telling that
you talked about the blue boxes and it was a it sounds kind of loud but sound
like this I'm right-handed about 2600 person he peered out he didn't still
phone calls with that um we're gonna talk a little bit more what John later
it's kind of a cross-table individual because of some stuff I'm going about
today I don't yeah so black box free calls then any question that black boxes
red boxes first and foremost it is still illegal to possess a red box if you have
used it with nefarious intent aka to defraud the phone company right Bob just
don't work anymore because it's at 7 but it's still along the book challenge it's
a legal tire horse outside the tavern on a Tuesday afternoon um ten years in
prison if you have a red box they actually arrested somebody that worked
for 2600 magazine in New York Bernie ass his real name was Ed Cummings he had a
red box didn't even work that's what a red box Oh red box that you generate
coin tones to a payphone nickels dimes quarters so the paper one thinks you're
putting coins in when you're really not you have to change the processing
crystal out this is a RadioShack pocket tone dialer it comes with a 3.5
megahertz processor crystal and so when you turned out you didn't store all the
numbers in and it makes it easy because you can use dial a phone number if you
were to and I would never possess an illegal red box because
illegal was about to sir illegal but if you were to take one of these and swap
out that processing crystal and play five like asterisks with that new
processing crystal Oh
Mustard's a glitch everybody uh it would generate a quarter-ton to a payphone so
if you're called Zimbabwe and they're like $12 for the first minute you would
just never knew live get less every time you do that it's not important people
say don't never do that just make sure to just add risks never never use a red
box illegal ten years Ernie had one he didn't have that crystal yet it's
Saturday then he just had this in a crystal that's like having a gun and a
bullet not in the gun and they charge you for murder
he made a year and a half in prison Peggle prison
yeah beat up pretty bad he was doing strange things to the bone and president
making some phone calls and a larger meaner and made that was in there for
far worse crimes than Bernie was he what were wanting to use the Fallen brains
like let me just wrap up real quick didn't you connect your phone apparently
that wasn't good enough of the guy so he proceeded to knock burned it down and
stopped the space and broken space up pretty bad busted his arm he was in
intensive care global Bob it was there could I make an example of Bern he
released the pictures of Secret Service agents Secret Service's not pleased
about that so the Secret Service kind of for the book Ottoman and best of them
pretty good services actually the one that enforces us so let's not worry
about kind of Atlanta let's not worry about we're telling the
president let's go up Dropbox it doesn't even work anymore because you know
that's where the threat is so the the quarter tone nickels and dimes
they're their combination remember we talked about multi frequency to
frequencies so it's seventeen hundred Hertz at 2200 Hertz a nickel is one a
diamond to headquarters five so he can't see a nickel dime quarter that's all
that's all baseball and they work really good you had to be careful how you use
that ceiling to pop by an operator and third times I'll pop by an operator
operator come on how much money did you actually put in $1 and then like welcome
try putting in real money not using your silly box or I'll call security the bail
trucks on the way the nearest bail office is 200 miles
okay you sit on down oh wait for them um so the telco to find
way to combat that's what they did is they started on like payphones they
would mute the mouthpiece until you put all your money I'm gonna call and then
they would unmute that mouthpiece so you couldn't hold this up to the pole and
play the tones people drown ways around that as well
they cut into the wires coming out of the box and then beep tones in there so
yeah so red boxes super fun no longer work stole illegal any questions about
red boxes everybody has questions you have to talk to a pretty tribe you dial
yet the Wisconsin happy history village come see me one have to talk about this
stuff while you play with it explain how this mysteriously makes weird taunt
randomly then we have the beige box a beige box is basically it's a buck set
for people can't afford about set or can't steal one out of a Southwestern
Bell trunk this Amazon so my old one home one day and you know but super nice
for fighting all what number you're calling from if you wanted to get into
something let's say the statute of limitations in Illinois is let's say you
want to get into the modem at the local pizza just to play just to explore you
go to their their ta9 or like the telephone now we're gonna
make a little telephone box and outside the building you open it up you put then
and you dial a number and we'll tell you what number you're calling from
oh okay now we have all these numbers for all these lines I mean the pizza I'm
gonna start getting all those with my modem and should I find kids a lot of
time rather than Warren Island the entire exchange so beige but and these
are these are integers so I mean it's not bad
70 80 bucks but you know if your if you're a young freak and you're broke
that's a lot of money so people get these cheap one piece $9.00 Walmart
bones one piece for the court and you set it down and hangs up they make beige
boxes out of those you cut the module plug off you put a couple of alligator
clips on the wires and now it's basically the same exact unit you plug
those alligator clips in there you go about set alignment set
here use it not only at the outside of a building or a business or a house at the
network interface box you're gonna telephone can that down at the corner of
the street clip into that if you're in an office area you can clip in the punch
down blocks any anywhere that you could catch a phone signal multiple uses for a
beige box right you could clip on the while ahead of it if you're a jerk you
go to somebody's house you go by the line you make a long-distance call
alright I made this call this person's getting billed for it it's kind of
crappy do just eats up on people okay my my external promoter and I'm like a
creepy stalker weirdo my co-founder lying on the sue she's talking to stuff
like that hiding your captive fraudulent calls so
if you want to maybe make your twenties people it still try to cards you want
order some stuff chrome company XYZ don't somebody else's house to order
that I did that you catch that a stolen car that back tracks it it's run of that
house and not yours you can also use it with a blue box so you use this this
beige box you clip onto a phone line and now you're gonna start blue box recalls
if the telco catches on to you and they try and back trace where this blue box
call came from yeah it's gonna miss house over here maybe whenever did
something like that would tip about it if they weren't complete jerks they
would try and find like an eight year old lady tie into her house because when
the poem come he comes and says you've been blue box in this wonderful little
old lady comes to the dorms no I haven't bored you like some tea in stalin's they
realize okay somebody somebody else is doing it
you're okay lady we're not gonna stick you the bill because remember well the
company always gets paid but they would go to somebody else and these but you
know you said neutral hard to combine different price you got them these are
expensive sometimes you'd find a Bella truck that was unlocked
unlike belt racks were awesome to the hallways at manuals you'd spent an hour
at a none one mellotron no truck in the middle of the night with a
with a camel and just start taking pictures of manuals but the man you
about your home you film developing I have a copy of the important pages out
of that manual not really unlike some of the pictures that we're all taking here
today as we pack badges and trying to coach the caption con same same kind of
theory I'm just older and more old-school because it's about you
usually you wouldn't find something that said I'm like all talk every day
who's the bonus but again at that point here to get criminal justice feel
two big bucks any questions about phase fronts and lassitude assault pretty
quick again if anybody comes up with any questions that's what that pump me down
there's the example the beige box everybody needs like elf super cheapo
phones some of us some only these things in the past absolute garbage but they
weren't good further for doing page boxing cheering it's put some alligator
clips on the end and off they go - guten fairies Hector's things telling you that
touched up some famous freaks the Foxes for good and bad a lot of people got
really interested in falling for a team in the early 70s there's the Esquire
article that we mentioned and the time the article is secret to the little blue
box and I do have wings here if it's going to be too small you know I take
pictures of it if any way you would like I'll put my contact info back up at the
end here reach out to me I'm more than happy to send to slide that collective
poem so he just want to copy the link second I can let you know those as well
so that's probably did an article in 71 that really opened the doors for a lot
of people the LA Times said we can't be out come by as far we need your on an
article so they did one and 71 are the Wall Street Journal in 76 dozen articles
so there there's a lot of coverage there's a lot of big-name publications
there were telling people how to do this this telephone from so a lot of people
right this is kind of cool some of these people you know wise the jobs so Steve
Wozniak read the article in Esquire and watch was very technical he was a
builder guy you know why is this guy that build stuff and Jobs was a guy
that's old stuff so I was reading this article
he gets super jazzed she's like half way through because of jobs and says oh my
gosh yet your countries article they talk about the state and I'm pretty sure
it's fiction I'm pretty sure it's a made-up article but you got to read it
it's so cool to be sauce with this word so they read it and they got excited
they went to the Berkeley library and they did some reading and they found out
that all the Articles that made up these tones actually work so wise builds the
first blue marks so trouble making it work so he gets all of the giant Draper
who's mentioned in the article the Captain Crunch guy John goes and visits
Steve and Steve and says oh you're doing it wrong I mean let me show you how to
do this teaching them how to blue box well at that point was a jobs like this
is something big they start building like Y starts just cranking out blue
boxes and jobs start selling them on campus other students hey you want a way
to make three phone calls will say this box well I'll teach how to use it the
sales from their blue boxes gave them the startup capital to start Apple
computers this is where they had the money to build the Apple one so if it
weren't for blue boxing then freaks none of that iPhones or iMac sure iPads
or iPods or any high things they were they were so jazzed about it and some of
their some of their actual direct quotes are like Waze says of all the articles
I've ever read in my life the Esquire articles here's a little blue box was
the one that affected my life the most every day but that's true right because
they read this they started getting money they start Apple and look at these
guys now I mean apples does a huge I mean it all started because they read an
article in a magazine and built the little box I was on a job says
experience like experiences like that taught us the power of ideas that sounds
jobs like doesn't it if we hadn't have had those blue box experiences there
never would have been an Apple Computer so yeah that's fine maybe think about
how big Apple is now in how many places Apple is and the fact
that it all started from wash picking up an armored car pick up a magazine
reading article one night it's kind of neat to see that that that transgression
off transitional it's been a long day so the abilities box they gain confidence
hey we're good all the times we made this thing it works we can do stuff with
it it's cool we explore stuff this is fun we like this good small jazz and
it's at that point we can change the world and they did which is very cool
and again you know Draper worked with was and the very beginning of times to
kind of teach him the ropes and they say to touch in fact Draper ended up working
for Apple and between prison stints writing some softer form but that's
another story we'll get to that Oh Rhett not so uh my apologies that you
have a temper but it's actually John great brother how Carl got it so he goes
by Captain Crunch because again he was the individual to discover that the was
soul football 2600 Hertz you get blue box with it
here's in the Air Force you're stationed up in Alaska I've never been to Alaska
but I'm assuming there's not a whole lot to doing a lot of stuff so John had a
lot free time on his hands he would get like all Air Force radios or treat him
and build them up and make things he made some radio stations he started
teaching other servicemen to these dinners how to make free calls from
Alaska because back then was expensive to call from Alaska back on the mainland
because the telephone company always gets paid there's a blind individual
named Ginny Theresa it turns out that there is a large group of blind freaks
back then Denny contacts challenges hey we want you to
build this electronic box for us and it's going to generate these weird tones
build this so john built on the blue box then he found after building the blue
box learning about the challenge he found out about the whistle the Esquire
article he was interviewed and mentioned his name in the article as a
result in 1972 he was arrested for toll fraud as a telephone company have always
been paid and were since the five years probation
easy peasy right well not really my job he meets he teaches laws have box was
like oh you're a cool guy like you know I can work for Apple
she Johnson yeah he went to work for Apple and and wrote Easy Rider much like
an earlier word processor never got paid what he was supposed to and they had
kind of a falling out he also wanted to make charlie boxes for the Apple it
would allow you it's kind of a modem that would allow you to call wats line
watch lines like eight hundred-number said they're called inbound wats it
wouldn't be a way to talk have your computer talk to these wats lines that
point in time woz and jobs like modems and there's not really cool no one's
really gonna like talking to other computers that much not to read about
that and a couple years later Draper sold his charlie box idea to another
company announced used in like voicemail systems and then all kinds of stuff
again he didn't get credit for it and so deputies took it he couldn't stop boxing
on couldn't stop explain the phone system so he he continued to explore and
continue to get caught so he saw prison sentences in 1976 and 1978 both times
for toll fraud he's very well known all the freaks new Captain Crunch was they
would call him in the middle of the night just to talk to him he was
eccentric always has been kind of eccentric often
felt he's being watched people would come up and his first goodness this is
like being traced who are you recalling from why trauma
it's very paranoid you and then do you like strange conversations with some of
the people that call them um recently he's been accused of some stuff hasn't
been convicted but there are enough accusations that I heels in the same
town I do it come on Mia so um he claims he and two
other freaks to bring out all phone services the entire you us he like a lot
of like kind of out there there is an ideas some people again maybe bit of
take a lot more than two other freaks yeah but uh a large group could drop all
the phone systems but it'd be more than three people and basically they were
just stacked all the clumps and busy out all the trunks in the whole you guys I
don't think a lot of people would do that brings us to Joe Joe and rested in
jr. he's also known as Whistler anybody hadn't seen the movie sneakers with
Robert Redford and the movie sneakers there's a Whistler that character was
based off of Joe and Gracia loosely Joe is born blind he had perfect pitch he
could whistle any note perfectly he was really into the telephone he was blind
he was left without like a babysitter uh he his dad didn't laugh when he would I
think before he's even born his racist by his mom shouldn't work full time to
be able to take care of the ball so he was just left all of this babysitter
that really didn't give a crap about you sooner and entertain yourself yeah so
you do that he would start calling people at like four years old and start
playing on the phone he'd call like like time and temperature numbers just to
hear people just to have some sort of interaction with something because all
the way up he's blind he's lost one sense he wanted that that contact that
he wasn't getting it from human so let's play the phone the phone will he's
talked to me I can call random people and talk to him at five years old he
turn on a switch tricked I'll switch your dialing on on an older phone that
has like a handset that you actually hang up on the receiver there there's
two buttons that come up and the handset pushes down when you hang up you can
take those in Tampa min dial phone number that's a whole styling paste is
what it is even if your phone is set the tone holes will still work so if you
want to dial up read a five would be if you're ready you dial the phone that way
so he's charged payment but then it's 760 funnies time a temperature numbers
he's seven years all these Lizzy's numbers about this point they're
starting kind of all she like whistles coats
ovens listen hamster whistle at 2600 Hertz ton the recording stops he's a
that's weird hangs up he calls it back maybe this is
a seven-year-old kid and the guy was a genius had an IQ I thinking like 172
he's a smart smart dude so he calls her back and say oh he's fine now what was I
doing what how did I make that happen I always do everything this song
according goes dead shows up oh I'm onto something if I whistled this song why
and then he calls with the phone company and says hey so I called this number and
I was listening this song and it made the line drop and I noticed when I
whistled his song it was like the et above middle C iana a piano
he had a friendly mind man said oh yeah that's the 2600 Hertz tone that's gonna
drop the tannin and reese's it you know and joe said well that's that's really
cool can I come down to get a turn the phone company and see how this works in
person and the guy's like okay ma'am you know you could make an appointment or
business office and Joe says oh I'm not a lady I'm a seven year old boy named
John I'm blind and I want to learn about phones well this is this light inside
this is Joe if someone's praying to me you know
okay okay okay Joe you know Joe wait on the phone come take a city bus with with
a babysitter and off they went capture the central office he was blind
so he's feeling all of these things to kind of understand how it worked and did
that help drive that interest of the phone company that Joe had so you became
very well-known people would call him a Nightwing like multiple precone every
night just say so it's so cool to meet you you know this is this is an honor to
privilege on the BLA yeah that's kind of like you're you're walking to the hotel
lobby see you see some famous security person that you know and your younger
true saying you know oh look it's Jason Street I've gotta get a hug you know
things like that that's that's kind of how how Joe was he
would call mom and that was his form of communicating with the outside world
that was that was how he just kept himself entertained
he went to school down in the University of South Florida and everybody likes
because of his phone phreaking ability right so he's that desperate left her
some of my self-worth my value comes from I'm gonna help all my fellow
students get free phone calls he starts helping them get free calls and gets
busted toll fraud it doesn't do anything have a couple of days we waited sitting
judge gets out people want to get a job at AT&T ATT's if you got busted we're
not hiring you so much work for a small child code Memphis and loved it did that
for a number of years then moved to Minneapolis he had some emotional stuff
going on they all do who doesn't right but he wanted to be a five year old kid
again there was a happy time in his life for him now he was playing at the phone
system had busted and so he declared himself to be fine and changed his name
to Joy bubbles some people enormous joy what was some
homeless was there some homeless Joe and he ended up dying of congestive heart
failure and Minneapolis as as a kid here look out the then it was it was like
there's a child and enjoyed it so don't you go to sleep again alright so those
are a couple of famous people that that kind of got freaking where it is or
where it was a couple of years ago it's just some cool number so we used to play
with loops so a little bit a telephone company test number there's two sides
you look my high side and the low side he called one side you hear a tone to
call the other side to hear nothing when he called his two side you get connected
to whoever's on the other side she freaked should use this a lot of these
loops because their access number didn't build even though it was in some weird
area code you'd call them be an on supervised number like the building one
kick in so if I wanted to talk to my friend Dave who is in San Francisco and
I'm in New York none of us wants to pay for that call
phone company always gets paid unless it's a phone company's own number sort
of call loop number we be can actually talk to free wouldn't cost
Lewton still exists you can still find roots and certain exchangers I'm gonna
talk about some of those in a second here there's also a Mac and a ni ni is
what your caller ID runs off of announces the number that you're calling
from Enoch is is the same type of thing but it's it's a more base level it's
much harder to scoop a Mac than a night a night they make fall until the spoon a
night for you a Mac still works so if you're ever had a phone and you can use
this not only for nefarious freaking purposes but if you're if you're
installing some phone lines at work and you're punching stuff down about I don't
remember what line this says plug it with a little etc summit and call it a
night number and I'll read the number of activity or calling from super handy or
if you're trying to have a local Pizza Hut and you're in their telephone
network box calling a night number trying to find out what the phone
numbers are saying is formed with your motivator if Saturday is a toll-free a
napkin it's super easy to remember it's eight hundred four four four four four
four four hard to forget it's almost like clouds there's one a 1.1.1 or you
know 8.8.8.8 Albuquerque New Mexico has one Anderson Wisconsin has one now the
Anderson number if you call that number it will read back your number it will
not give you the MPA or the area code but if you know like where you're at
when you're calling it you kind of know the area code is there at a place some
then there's called the birders you can call it the burner number usually an 800
number hit the other party to answer you know
hello Xerox and you can say oh I'm sorry I thought I
was talking about wrong number of my bad okay they hang up you don't hang out you
hang out after about a minute that line resets you get a dial tone and that's
the diverter dial tone you know a dial tone
up their system so the phone can be seized if you dial in 800 ever they're
gonna kill you for that you didn't call from there to Singapore
well company always gets paid that company page that I call the Singapore
cna she is as that goes customer name and address and cna was a number that
you could call you could say yeah this is this is bill from the central office
over on three one two and i'm gonna see an a on this phone number you give them
a phone number they've chose that customer's name and
that customers address this guy uses an early form of dachshund back in the day
if you had a phone number for somebody you had to name get their address super
easy and then there's various various cool exchanges nine five eight nine
fifty-nine and most area codes those are reserved as telephone types exchanges so
we're what for would for today yes q dot Portland born nine five eight you start
hunting through numbers in there you might find some interesting numbers that
the telephone company uses for testing loops will be in ninety five eight nine
five nine technically the bird I'm sorry I've seen eight what's up could be in a
ninety five eight nine five nine a lot of times invite a nineteen eighty nine
and then nine five eight nine five nine and then there's weird exchanges this is
part of an urban legend and kind of I don't know how true it is I've never
been able to verify myself because I don't have a number and I've enjoyed I
want to find the number but there's exchange eight four oh it worked in
several different area codes it was a specific number after the eight four oh
it was only one or two numbers in that entire eight poro dialing range that
actually reached somebody and it turned out it was a government installation and
somebody stumbled across it so you know called it off this lady answers operator
he's thinking what number died call check what number did you dial oh well I
died blah blah blah you know that's not this number click well that's that's
interesting what is this what are they buying
keeps calling keeps calling it he's an uncle that works with the intelligence
community gives it the number goes I can't care what this is I thought what
is this his uncle comes back up way later don't ever call that number again
forget you knew that number apparently it was a facility where the president
goes in the event of a large-scale threats basically like the president's
bomb shelter yeah you don't know how true that is but it's bored and you want
to want to play it the phone number might be one you want to play with and I
do anyone to avoid sorry gonna time okay we got a few minutes here um critics
Troy Tom's trying to give you a couple of couple of stories restaurants
instructing so before I was an IT guy many many I was a cook working
restaurants high-end executive restaurants he cooked at the front of
the house always said of foam yeah we could call and make reservation there's
no dial on the buttons of agile is an IND on phone only they don't want people
making calls the waitresses would get bored they like trotting to call out I
need to call my boyfriend my mom wait I know how to switch shopping so I would
teach the waitresses how to switch I was the most popular usually wake easily
cooked up get along while I was most popular cooking there as possible um
angry operators if your blue box you know call our website if your red boxing
a call and the quarters too fast or you have too much of a pattern sequence you
get made believable you're putting quarters in sometimes you get a live
operator yeah put your little toy way put money in the corner I've gone secure
you always entertaining the mess of the full but because of you that there's no
tension else in here do what held it get that paper on your app but something got
three years long gone I'm skip Reese what's up and said that the last
crashing freaks used to trash all the time which
is exactly what it sounds like a euro dump 20 jumping are you trying to avoid
the bags sold like they give them a lunchroom because those are pretty gross
but usually phone company trash is pretty clean it's usually papers and
there are a lot of interesting papers you can find by all old Bell manuals
that had all kinds of technical information which was great you read
through those learn about the phone company one time we hit a local telco
they're also nice P they had DSL back in 95 which was awesome I was like a block
from the CEO either passes there baby testing it for its awesome we found
a printout of all the usernames and passwords for every shell account on
their network nicely printed out hold it up neatly on track your feet paper so we
played with that a little bit and then call him up hey you guys realize you
threw this away you should change all your passwords same Jellico we would
Johnson to the priests witches we would dial in and switches telephone company
there's a morning report on that switch for diagnostic purposes we found that
number one or diving we're down then we would just watch
switch traffic all day now there's entertaining we report we're kids yeah
what else you're gonna do so the phone company realized we were
dying in their stretch and watching stuff we're gonna do any damage we were
curious very exploring we weren't criminals we weren't trying to hurt the
phone company we wanted to learn how it worked they called you up one day Fred
you see you guys have been on our switch oh yeah now where the kids have an
interest in the phone company huh well yeah I know how the phone systems work
that's cool yeah we like it and we were just upgraded to switch we have an extra
switch here but you kids like it to play with yes please
yeah we have a GTE GTD 120 a switch we have all the soft reports building all
line car just come pick it up okay let me get a truck we'll be there in half an
hour and I'm calling my buddies dude you're gonna get a truck where we're
gonna try I don't care steel when we get a switch and we got a pole phone stretch
we've rolled it into one of our basements and set up around a little
mini PBX system off it was awesome it's so cool to learn from I'm not going to
the soccer whatever happens if like we've almost like oh no but call oh okay
there was a it was super cold so you know it's it's like anything right
creaking can be used for good and evil you just learn and to explore to expand
your knowledge or it me used to do bad things
um so the the key is I guess you know use the good things
freaking stone thing it's just changed but it's still out there and yeah so
this is basically just a historical talk about how we used to play the phone
company and the fun that we had with it so in
closing if you'd like a copy to debt or any of the links or anything from this
that's still really small everybody wants to run up and just take a picture
that they want cool otherwise again I'm over in the hacker history village speak
by say hi we have a couple of paper tapes if you want for your badge we have
got a speaker capture the con card for 25 points if you want does anybody have
any questions comments stories of your own and you think if you'd like to
contribute this is a social talk you know more what happened here what he
wants does anything ya know what's up Raven no I was afraid to cat um there
would it take a long time because this town was in the middle of nowhere so we
would we just blew I'm gonna pay for him you know consumer hi thinkers a little
slower but yeah any other questions alright hey thank you everybody for
coming out and come to the talk I appreciate it
you