TAP No. 60 - Lock-Pick Larceny

LOCK-PICK LARCENY by Alexander Mundy I hope all of you TAP readers have either made or acquired your lock picks, because I will teach you how to use them. In order to get started, you will need the following equipment: 1. A pair of tweezers 2. A set of followers No. SUT-0, Size 395 Most commonly a No, SUT-1, Size 495 _ No. SUT-3, Size .600 No. SUT-10, Size .550 Picture from HPC catalogue You TAP readers can make a set of followers from brass or plastic round stock or tubing. The important point to remember, is in making, the follower, the end must match the plug. When you push the follower through the shell, the top pins and springs should not fall down in between the plug and follower. 3. Rim or Mortice cylinders (stay away from the ones with a curved keyway, like Yale and Lockwood and also the ones with mushroom or spool pins, like Corbin and Russwin.) These cylinders are harder to pick for the average beginner. In order to start, remove the tail piece of the cylinder. It is usually held on by two screws or a spring clip. ‘lext, take a follower and remove the vlug from the shell. Be careful not to drop any of the pins. Also, when pushing the plug out of the shell, make sure that the key is slightly turned and that the follower is firmly against the plug. Otherwise, you will jam one of the top pins or springs between the Plug and the follower as you are pushing out the plug. Next, remove all the bottom pins, except one. It's position in the plug does not matter. Also, remove all the top pins and springs, except the one that matches the bottom pin. Now reassemble the plug in the shell. Be Care- ful that the top pin and spring does not fa Into any of the unused pin chambers in the plug. Take your turning wrench and pick (you should use a hook pick like this) Insert your wrench into the cylinder and exert pressure on the plug via the wrench. Next, take your pick and push up the one pin so that it reaches the shear line. The plug will turn in the shell. Congratulations You have just picked a one pin cylinder For your next experiment, try putting different amounts of pressure on the wrench and feel the difference as you push up the pin. Also, use your wrench in the various positions shown. After you get the feel of picking the one pin, try moving that pin to a different pin chamber. Don't forget about the top pin and spring. =~ i NOV-DEC 1979 No. 60 After practicing for awhile, try addin another top and bottom pin and spring to the cylinder and practice some more. ,Keep picking and also remember the feel you are acquiring. Soon you will be able to work your way up to 5, 6, and 7 pin cylinders. P.S. While picking a cyliner, you should keep the cylinder steady by placing it in a vice or other suitable holder. Bottom of Keyway Positions of a turning = wrench in a cylinder Top of Kevway Pressure may be applied either upward or downward on the turning, wrench. Cylinder Spring Top Pin Mushroom Top Pin Ball Bearing and Top Pin used as a Bottom Pin Regular Bottom Pin Shear Line Pin Chamber Plug (the part where the key fits in) ep yne Bottom Pin at the Shear Line : e GHmaAmm oaw> The shell and the plug along with the springs, top pins and bottom pins, forms a cylinder. Well, well, well, here we are again, folks, with our never ending blast against technological ignor- ance, First, congrats to those who sent me letters. T- only received 5 letters from four different people, and I could only answer two, but the information I received was both highly interesting and quite valuable. So read on... There 1s indeed a separate military phone system (see Fut: Deve: nts in Telecommunications by James Martin. Sgt ‘by Prentice-Hall, SpssTe3s, A ook by Martin,and also Adrian R.D. Norman, that sounds interesting is The Gonputerized Society.). It 4s called AUTOVON, which 6 8 for ‘UTosatic VOice Network. (see TAP,#40, p.2) According to Kr. Martin, the letters Q and Z are associated with the 1 button as A,B and C go with 2, and so on. Also, "the called party receives a special ‘precedence’ ringing signal. A unique tome informs telephone users when they are being interrupted by a higher precedence call. If one of these keys is used on a telephone not authorized to use that level of prece- dence, a prerecorded voice (what rank?) tells the caller that, such a call cannot be put through." A California reader (we'll call him "C") wrote "When used--Press "priority" button first, then rest of number. Auto selectors first hunts for an open line-- if none open then person using number is bumped (gets deep signal) only if he is not using a higher priority! Now that you know generally how to wse the military tones, you will need to know how to matrix them. A civilian 7.1. pad and L.D. (Bell Long Lines Dept. . Long Distance) tones are shown matrixed here. Low 697 1 2 3 A Tones 70 4 5 6 5 (iz) gs2 78k 941 * oF # OD civitian 1209 1336 1477 1633 Touch Tones High Tones (H2.) low 700 4 2 4 7 148 Tones 900 3 5 8B 12 1100 6 9 XP 1300 10. KPa2 1500 st 900 1100 1300 1500 1700 High Tones (Bell Long Dist.) The trick to matrixing is to write down the freq.'s of the low tones, in order, and then the high tones. Fill in your digits, and you've got your matrix. This info, and the following, is presented courtesy of an Aldergrove, B.C. TAPper. He sent me photocopies cf pgs. 2-13 and 2-14 of a book called Reference Data "For Radio Engineers. It is apparently available from Howard Sans. Also, we'd like to know what 11 and 12 are used for. The page I have just says "for inward operators". Page 3 of TAP #27 has a letter signed "-KANSAS-" that refers to long distance (L.D. for short) coin collect and return tones, supposedly 700+1700 and 1100+1700, re- spectively, and also a "BV key" on some operator boards. I think that 110041700 must be a typo, since that is regular KP. .The MF tones for 11 and 12 aré 70041700 and 90041700, reepectively. My Nov. 1960 BSTJ (p. 1432) saye that “Assistance operators handling European international ... calls are ... "Code 11” or "Code 12" ops, These ops are called in by transmission of distictive signals ..._ A "Code 11" op is an assistance op who performs the usual functions of an incoming op in manual service. A "Code 12" op is a delayed-ticketing or suspended- call op. When a particular "Code 12" op is desired @ call number is added and follows the "Code 12" signal."(T.Vail's abbreviations) | Until someone figures out, though, Military touch tones: thi 8 "The here are the reader also says: arny numerical High Grow so TAG IBSO TSE -«=scode ie similar to 1020 4 2 3 Fo the long distance é oF codes. However, this 140004 ~=«5 in itself is not 1260 7 8 9 I enough to suggest 0 > that the militery 1380 have their own long Tow Air Force 412 L distence eystent Grou) 2.V¥. Note-They do, Pp though-AUTOVON "Concerning similarity: notice how similar they are when written in a matrix, High Grou; B00 2300 2500 2700 Yor regular Bell code, look else- 190 4 8 0 3 where in this Group 2400 1 7 8 article. 2300 2 6 2500 5 "U.S. Army TA-341/PP Numerical Code" "The army code seems to lack the for KP and ST signals. "N.B. The blue box of issue #26 can be used for the army tones. Just re-tune the oscillators (700 to 1900, 900 to 2100, etc.) and relabel the keys (1 becomes 4, 2 becomes 8, etc.). "I have no ideas on how to use either the air force or army tones. For all I know, the army tones might not even be in use." Thank you very much, TAP- per from Aldergrove. I, Ted Vail, don't know how one would nse the military tones without being directly connected to the military network (AUTOVON), If you were, such as if you strolled over to a phone during a visit/tour to a military base, follow the instructions outlined above by "C", I have a strong suspicion that there is indeed a connection between the military and civilian phone systems, Re-read Kilgore Trout's excellent Re + From End Of The Earth", TAP #37, p.1. He says ther ithe military makes thet) ary makes their own Blue Boxes" (So does Bell--a Blue Box is just an imitation of regular U.D. dialing equdpment]!! They are, I presume, for calling into the civilian system. Kilgore wants to set up a phreak connection between the civ. and mil. systems up there. Hopefully, one wouldn't have to go through a human operator; we're not all good at BSing. NOTE: Kilgore, or anyone else who knows anything about these things, please write me at TAP, Ted Vail, Room 418, 152 W. 42nd St, New York, N.Y. 10036. A number of people think that the special frequency for the military override buttons is 1633 Hz., the fourth column frequency for the civilian T.T. pads. I politely point out "NO! Civilian phones are used only on the regular Bell system, with the A,B,C, D,*, and # buttons used for computer access or quick dialing (some executives have this--they just push, say, the * button and their home number, or other predetermined number is immediately dialed). The special priority tome must be extra on a military phones namely, 1980 Hz (mixed with the appropriate tone). Regarding SF: Flash Bazbo of Iowa (note-- when writing me, include a code name so I can refer to you directly without exposing your initials. It's flattering to see your name (alias) in vrint!)sent me the following letter: fed: According to the information I have (1960 Bell System Tech. Journal), SP signaling was used for “exchange applications". The following quote is straight from the horse's ass, so to speak! "For application in the exchange plant, a new series of transistorized signaling units makes it possible to adapt ing trunks (all under- lines are Flash's) to shor’ carrier systems. The SF units provide loop-signaling--reverse-battery supervision toward central office switching equip- ment, and in-band AC signaling toward the line. These units also include the 4-wire terminating sets required for converting between the 4-wire line facility and the 2-wire loop. The terminating sets are suitable from a transmission standpoint for ex- change, tandem and .toll-connecting trunks. "The originating terminal Tnetudes 2 recieving circuits: one a 2600 Hz. receiver, to detect trunk status signals, the other a Hz, receiver to detect the revertive ses. ie terminating end of the trunk only a 2600 Hz. receiver is required to détect trunk control signals, but 2 transmitters are provided: the revertive pulses are transmitted by oscillator, while the trunk status extra tone needed the 2000 channel for the re- vertive pulses is quite wide in order to accomodate the high-speed signals. As indicated, pulsing speeds of up to 32/sec. are used low! ce you will--the SF "keyer" is refer- red to as a "loop signaling trunk". If there are any of these old fashioned senders in existence (knowing Pa Bell they must bet) it should be possible to build just a 2000 & a jz. oscillator, put the 2000 on a@ normally open dial contact & let your phingers do the walking! To speed things up a bit, aljuse the dial governor so it puts out more pulses/sec. I am currently constructing one to phool around with in a dial trimline I "borrowed" from a local phone store. I will inform TAP readers of the outcome at a later date. I also understand (same Bell-bull) that a 3700 He. tone can be interrupted at dial speed to send you phar, phar away. It was called SF out-of-band and the equipment was "types N,O,& ON". Any reader supplied info would be greatly appreciated. 2600, FLASH BAZBO Thank you very much, "Flash", You would probably be able to go all over the world with this sort of beeper, since even an antiquated ex- change has a modern dual-freq. "blue box" for communi- cating with other exchanges. The old exch. would receive your old-style beeps and convert them to the newfangled DF for re-transmission to the rest of the world. Kilgore Trout (iss. 37, p.1, column 1 at bottom) outdoor coin phone. If one wants to split the discovered SF independently (I guess). Again, anyone who knows about this; please write, as usual. On the back page of #37 was an article by Tom called Bell's Boxin' Us In, in which Tom described another black cloud on the phreak horizon, namely C.C.1.S., which is Blue Box proof. The ESS long dist. exchanges used for CCIS stop Black Boxes, too, since they don't connect the audio until the receiving end definitely answers, at which time the ESS sends the initiating end (which 1s doing the billing) a definite "receiving party answered" signal. What a hassle! Does anyone know how to defeat this? I would like to know how Bell's new Blue Box detector/tracer is used, and how it works. The news clip on p.1 of iss. 46 is a bit hazy on the technical end; phrases like "protective electronic fog" sound nice to the general public but are electronically meaningless (perhaps deliberately?). The thing that's real. scary about this gadget, assuming it's not a hoax (I don't think it is), is that it can trace right back to the phone on which the Box is being used, within seconds! t mig) e possible to determine what kind of equipment your local Telco has by looking at the little notations in the lower corners of coin phone dialing instruction cards. However, one would need access to some internal Western Elec. info to "decode" the meanings . To any of you who work for Bell and know how this works, deciphering should be easy. Two inst. cards I saw recently said "ISPS PRE 0-555" and the other said "PRE/POST 0". Rather than hazard a guess or two right now, I'll wait for some reader response on thes and together we'll figure it out. I would also appreciate some details on TSPS (what it is and does). And while we're on this, I'd also like info on IOTC. Please do not include subscription orders or other TAP business with your letters to me. I am not in New York very bften, so the mail is forwarded to me. If an order and a letter to me are on the same page, that sheet stays in New York and I never see it. This happened to a reader from the Uhicago (4.0.312) area--and I don't know his name or address because that, and his order, and the rest of his letter were shredded in NYC before I saw them. If that reader would like to write again...? The - letter was written with a black felt tip pen on the back of some math problem ditto sheets, 80 the writer was probably an ‘elementary school teacher, but that's all I know about hin (her?). Several readers would like to know how to get the Abbie Hoffman books other than Steal. According to Bowker's Books in Print Index, Revolution For the Hell of It is available for $1.25 from Pocket Books, 630 Pifth Ave. New York City 10020. Puck the System is a phlet included in the back of R. for the He: I have seen Woodstock Nation, and fon't think muc! of it. A Northern Ill. reader sent me some info that other Illinoisans might enjoy: Skokie, Il1., the world's largest village (over 50,000 pop.), has an excellent library, which contains all of Abbie's books, and a copy of the Nov. 1960 Bell System Tech Journal that started it all. A Skokie bathroom stall contained the follow- i affitus: . NB BALL THE WORLD'S A STAGE, SO LET'S ROB IT", Signed, JESSE JAMES Appropriate? Hmmm... There's also a #, (312) 796-9600, that can be called to find out the name and address that correspond with any given tel. nr. Just give them the nr. and they'll give you the info you want. That’ (512) 796-9600. Neat! As far as petty theft goes, those TAPpers interested in free drinks (and glasses!) might be interested in | this: At "Red Lobster" restaurants, you take a numbered ticket at the door which you exchange for drinks, The bar tender gives you a bill with the amount on it, which you give to the waitress. The idea is that you don't pay ‘till you leave after eating, so if you leave in apparent disgust, empty-handed, nothing is suspected. Moving on to telephones, I have two ideas to share. First, TAPpers living in colder northern climes can get a roll of ducttape, a torch, a funnel with the end flattened, and a container or two holding 2 gal. of fresh water and drive on a very cold night to an hone wide open, one needs only to tape up the phone! holes, seams and cracks, and pour the water in, fill- ing up the phone to the ton. After an hour or less, depending on the temp., the ice's expansion will shatter the housing's brittle cast iron. Thawing with the torch should remove the pieces. Careful melting will expose the back bolts, allowing the nefarious perpetrator to cart the pieces, plate and all back home.(Four water through funnel intocoin slot) Once this hypothetical character gets it all unfrozen, he removes the locks, remembering which went into the upper housing and which the lower. He knows that the lowers (coin boxes) are individual}, keyed, and he also knows that the uppers (electronics} are all keyed the same, according to region; that is, the Upper: housings in one region are the same. There are 3 diff. ones for N.Y.City, because that is 80 populous, He takes the upper lock to a competent, cool locksmith to get a key made for it. Bell probably has a special, private blank, but others may fit into the keyway. In desperation, a piece of sheet metal can be bent into the zig-zag pattern and cut into a key. The local locksmith had better be very cool, or he'll suspect that the lock is a special, industrial high-security lock which common people aren't supposed to have.(True enough.) But a determined person could eventually have a key to all the coin phones in his/her area. Of course, the coin boxes couldn't be opened with the key, but since all but 4 weak bolts can be removed easily with the upper housing off, and the rest can be pried/levered out, this isn't a biz problem, That's enough for now, And, lastly, for ail those who care, I nave round what TASI 1s. In Fa's own words,"A YASI system jsigns a speech channel to a talker only when a channel is required, and when a channel is not required it is prepared to ewitch that channel to another talker requiring a channel." This is why the beginnings of words are often cut off during a long dist. conversation. Finished 9 August '78. dith these thoughts I leave you,...TED VAIL ‘TAP has sold out of "Ma Bell Is A Cheap Mother" T-shirts, Please do not order them anymore. We still have a quantity of TAP T-shirts in stock, Back Issues are 50f each. Issue #50 ts $1.00, ‘Budscriptions - 19 tasues - US Bulk rate $6, US First Class in plain sealed envelope $7. Canada & Mexico First Class $7, Foreign $8. Include mailing Inbal oF Xerox copy when writing to TAP about your subscription, = SOfeach, A - DC Basics, B- AC Basics, C- Phone Basics, D- Amplifiers. TAB Moas - $4.50. IAP Teshicts ~ $4, 60, Specity size and color : Small, Mediam, Larye, Extra Largo, Black or red T-sbirt ‘with white TAP logo, ‘TAR "Cracked Bel!" Button 50° each, TAB Casseue ‘Tape = $3.50. Hear Capt Crunch, Al Bell, Joe Engressia, and Bell Security Chet John Doherty. TAR "The Teleshcne, #3" artist print - $3.50. M2unting Tostructions far Bax concestment included, TAP "Ma Bell is A Chesp Mother etch - $1. 50. 1s Sot (y < Xa < 4 OTe TAP is published bi-monthly for informational purposes only by Youth Hot Line Reports, Inc. Address al mail to: TAP, Room 603, 147 W. 428t., New York, N.Y. 10038, TANDEM TRICKS by Napoleon Solo To stack world tandems you will need: 1. A 750 Hz oscillator - the Touch Tone 770 Hz will do. 2, A 228) Hz oscillator. In order to use the Single Frequency or SF 77) Hz tone, simply depress the #4 & 5 push buttons of a standard Bell ‘Touch Tone pad simultaneously. Now let's call ourselves around the world and stack a few tandems in the process: 1. Get on Cakland (Ca) 415-186. 2, Dial Australia - 61 + 3 - This puts you into Melbourne. + 153 - This puts you into Sidney. +81 - This puts you into the overseas sender. +ST - This finishes the MF part of the call. Now you can throw your Blue Box out the window! 3. SF 750 - 991 - Equivalent to KP-2 + 44 - Country code for England. +2 - Language digit. + 421728 - This puts you back into the London overseas sender, + ST - To send ST you hold down the 750 Hz tone for one second. Once this one second burst of 750 Hz occurs, any other burst of 750 Hz won't interfere with this call. 4, SF 2280 - 61 + 3 - This puts you back into Melbourne (Your second time around!). +153 - This puts your tired finger back into Sidney. +81 - Back out to, .. (Goodness knows where!). Let's call'the U.S. of Amerika. 5. SF 750 - 991 - Equivalent to KP-2. +1-U.S, country code. +2 - Language digit. + AC - Area code, +No. - Number (Your other line). + ST - Start - Again the one second burst of 750 Hz. Note: You can't go back to England again because you will Screw up the first England part of the call with 2280 Hz. NOW!11 IF you haven't screwed up, IF you haven't gotten busted, IF you put 200 watts of audio down your line, IF none of the circuits were busy, IF your other phone wasn't left off the hook so it will be able to ring, IF you dialed the correct numbers, IF when you pick up the phone and IF it isn't a friend calling or IF it isn't the FBI, CIA, or Bell Security calling, you will hear a soft hiss and after what seems like an eternity, you will hear a bizarre series of weird tones. Don't be alarmed, it's only the supervision ‘Signal on its way to make that "nasty" little "tick" on your ticker tape. It will take quite a while. When all the gleeps, gloops, glitches, peeps, poops, and grunts are over, you have just gurdled the globe! With your cute little Princess Phone say hello into one phone and listen to the other. With @ stop-watch measure the time it takes. If you are lucky, you will hear some talking. It will be you!!! 25,000 miles away! Really far out! (with apologies to John Denver.) Be sure to hang up the phone you called from because the best is yet to come. Listen to the "hang-up". It really takes a long time and is real "gone"! By the way, don't be too Surprised if after the 100th try it works, It will take about. that long. You have everything in the world against you and only one thing for you and that's patience. But WOWI!1 The feeling of success when you do it is really a gas! It makes you feel like you just ruled the world! You did - at least the- world tandems! And don't forget to go out and get the Blue Box you threw out the window! “Helle, This ta the ‘tmechanteal answering device attached to the number you dialed. ‘When you hear the tone, please give your aumber, identity and reasan for calli & Later date, G Help Stamp Out Lotters 10 MANY people find ft hard to ‘rasp the reason for the new IScent price of a firstelass stamp that I want to break down the eost in easy-to-understand Of that 15 cents, 28 cents goes to Geltvering the mail tate. Years ago, ‘when mail was simply delivered an time, Lt cost the post office almost acthing. ‘Today, however, with the high price of Getalning a letier, the cost bas skyrock- FREY H Understatt, chiet of the Post- special mail-mangling plains: “In the old days, we ir i / 1 delivery, but now al compa ne, a the came time ax rugeteaning elreu- “Converting to slower special deliv. ery was quite expensive.” eald Under. ‘aueh mall arrives ig that the purpose Is to St foare people to ute “alr express.” ‘whieh cor iF letter there Bs alekdy especial ellrery used T asked him how he managed to slow down special ‘he sald it had meant buying a lot of old livery 20 effictently, and far I biplanes, but even that Ira ies tte e fo more. peapi fosing equipment, which has replaced pains of 500 He, ceeutional lezy. oF eraay portman “ris postal official continued: “We're cramer tin gt Drecrnces ces By neighborhood children piaying hide O°%4'to the post effice. by eking ry . Doky and exorbitant that the public will Of the 18 cents, sal6 Undersiaft, L& be discouraged from writing ietters If cents goes into fewer mall box Deople persist la sending letters indi. af day. Ws very ceslly, he rm tag yeu that plekap thnes have Been a8 iH it H Hy U.S. BSPARTMENT ‘up another dollar s quart,” seid W. C Flels aver 0 long ago. (Nothing has changed, Mr. Fields) 'T: COST OF LIVING has gone TAP Room 603 147 W. 42 St. New York 10036 60 GP GUREAUS —" FILLING Our THOSE _ CERTAINLY 1. JUST ‘You NeED HELP FEDERAL FoRMsS> FILL OUT THis FEDERAL AssispANcE Reoutsr FoRm.