TAP No. 88 - Telecom '83 - Techno Toyland

TELECOM °83 - TECHNO TOYLAND!by Cheshire CatalystOctober 26th began the biggest, greatest, ardmost technologically advanced trade show in tele-communications history. The Telercm series ofconferernces began in 1971 when the 3 InternationalTaelecommunications Union (ITU) decided that theinternational talecomaunications community needed@ trad@# show which could bring together theworld's telecom manufacturers ard the inter-national telecom network managers who bought theequipment. The ITU is the United Nationgspecialized agency which boils cut agreement ofinternational communications standards through itssub-erntities of the Consultative Committee forInternational Radio (CCIR) and the ConsultativeCommittee for International Telephones and Tele-praph (CCITT).Telecom ‘83 was held in the new Palaia cesExposition atross the main highway from GentivaSwitzerland’s Cointrou Airport. The expositionfilled the four main halis, and spilled cwt ontothe outdcor roof of the multi story parkingparege. This outdoor area was filled with satel-—lite earth station antennas of every decryption,from multi horn toroids, to mushroom shapedvadomes containing the self stabilizing antennasused aboard rolling and pitching ahips at sea whencommunicating via Inmarsat, the system which hasnow replaced the outdated Marisat, or MaritinueCommunications Satellite. It also neld the spill-over of the French Pavilion which was to small toaccommodate all the French company's exhibits.Basicas the major manufacturers, a numoer ofinternational Short Wave Radio stations weyerepresented. The European DX Council, PO Bow 4&, StIves, Huntington, Englard PEI17 SFE, is a club ofshort wave listeners around the world. DX is theabbreviation meaning “Distant Xmission”. Briefly,SWL's (Short Wave Listeners) DX (listen to distanttrensmissions). Let’s face it, we computer typesgot “inittel mania” from our han radio buddies.Radio Nederlands, Radio Canada International,Radio Switzerland, and Radio Swaden had a boothtogether displaying the types of small portableshortwave radios which are making this hobbypopular again. While many of the shortwave radiosgold today are of the “Street Box" type of "Let'sbe cool by blasting out the neighborhood” which isbought just because it has alot of fancy buttonsthat never get used, the letters racieved by theseshortwave asetations show that there is ai definiteincrease of shortwave listening around the globe.Many people listen to the news broadcasts of othercountrias, g9° as not to be “locked in” to the newsas put forward by their own government. Whichreminds me that the Voice of Bmerica was also anexhibitor in the “Shortwave Pavilion”, near thebooths of Radio Pieking, and the BBC.In the UGA pavilion, I spoke with one Britishchap who staffs the London office of an Americanbased multi-national company, and he told me thestory of British Telecom, who was showing off ‘abrand new computer on live BBC television. Whenthey went to log in, the screen typed back,"sorry, Ff got here first and changed your pass—word. Here's a little poem to pass the time,though.” The British hacker had then typed in thefirst two verses of my song, The Hackers Anthem(see issve 87) which he must have gotten fromNewsweek (and which Newsweek got from ma, theauthor).The Hiph Tech goodies included total.ydigital central offices, rural telephony links viaradio, advanced telex machine that print Englishand Rrabic characters, and ISDN (IntegratedServices Digital Network) control switches whichmix telex, data, and packet switched services.fmong thrae exhibits were a complete inter—national shortwave radio station operated by theInternationas Red Cross. The invasion of Granadawan underway then, and two Aed Cross volunteerradio operator wers chrogen from those cperating atthe Telecom emhibit, and sent to Barbados. Themajor criterion as to who was chosen, manbasically, who had the time from work, and noother immediate commitments so they could take offwithin 12 hours. [t all] is bared on being ir theright gkace at the right time with the rightekills.I's afraid, aa I read this over, that I haveoutlined Ghortwave Radio as being of the mostinterest. Although there were French terminals The Hobbyist's Newsletter forthe Communications RevolutionNovember 1983 Issue Aadwith games that needed their “Smart Card" or“Credit Card with a Chip” which they passed outlike candy, and television transmission studios towatch yourself freaze framed on 23 video monitors,and fiber optic transmission cables, end satellitetransmission station salesmen everywhere, you haveto realize that even the satellites are usingradio, and very simple radio techniques at that,to bring the rew level of sophisticated digitaltelecowmunications services to most of the world,Future communications engineers will atill bethose people who learned Morse Code and pounded#nough brass to get their Hem Radio ticket(license),One booth that attracted my attention was setup by the ITU itself, and was staffed with seraon-nel from the Technical Cooperation department ofthe ITU. The booth had panels dtaplaying the GNP'sOf various “Less Developed Countries”, and theamount spent on telecommunications, and forcastaof predicted telecom growth in those countries.The ITU was trying to attract development fundsfrom the developed countries to help the LDC'sbring modern communications to these countries.These folks are not trying to put a telephone § inevery hows, because the people in those countriescan*%t afford it, but they are trying to bringtelecommunications to the rural areas in govern-went offices, and primarily for coordination oftrade. The ITU can quote statistics that whenteleconmunications service between countries wasenhanced, trade between the areas also increased.They hope that by the deve loped countriessupporting the LDC's with loans and expertise, itwill help these countries to “bootstrap”themselves out of their poverty, and bring theminto the "trading community of nations",My emphasis on the international view here isbased primarily in my own prejudices that thetechnological revolution is not political innature, and that the benefits should be spreadamong those who want to use the technology tobetter life on Earth. When you start manufacturingin outer space, a8 in the Spacelab on board theSpace Shuttle, you look out the window (when Owenhasn't got his damn Ham Radio antenna clutteringup the window) and you only see the Earthy not theborders. You can start learning about othercountries by listening to their shortwavebroadcasts. You can find the times and frequenciesin Popular Communications magarine, and worldRadio Guide.Telecom ‘83 was a high tach cornocopia oftechnical information, and this brief articledosen't do justice to the 68 lbs of literaturethat followed ma home by mail, or was dragged hosein my duffle bag. The Friday night irreguiars hadtheir fun pawing through it at my “De-briefing"party. I'm already looking forward to the informa—tion from the International TelecommunicationsUnion (Place des Nations, {211 Geneva 26, Gwitzer-land) on Telecom '47. Gee you there! and ExPEL C apa dbbes youreauneengathal potenweit Phreaking with the TI~-89/4Aby the Naw England ArchivistI’ve just purchased a TI-99/4A for purposes ofbowing, and have a few words to say to anybodyintending to do the same. First of all, I haven'thad a chance to try it for anything so far exceptas an automatic digzler, but it shouuld work okayfor other stuff as well. The TI-99/4A can play upto three tones olus a fourth noise tonesimultaneously, The freauencies of the tones aresoecified to the nearest hertz and the duration tothe nearest millisecond. The responses I got werepretty close on mine below about 1@kHz, and belowabout 3kHz the frequencies were always within 1@Hz. Were's a list of some of the frequencies I'vetested:What I What IWanted Got116 116.@ (The lowest possible697 699.1 frequency)7ee €399.1aS52 633.99008 9@2.%941 948.91886 996.71198 1696.71200 1202.81209 1282.81216 1213.31308 1288.71336 1331.61477 1471.815@@ 1491.53633 1645.61706 1694.32060 1997.52206 2193.42689 2601.43206 3993.644,733 37.286.6 (The highest possiblefrequency)The sounds are generated by a CALL S8DUNDrouting call. A CALL SOUND routine call takesabout FA milliseconds to get going. Since thepulses for a quarter in a red box should be ISuson, 35 off five times, then by laaving a 34mgspace in DbDetween pulses we can excecute thefollowind program)i@ FOR i=1 79 53e@ CALL SOUND(35, 1700, 8, 2280, 9)30 NEXT IThe 33 is the duration in milliseconds, 1760and 2200 the two frequencies, and the reroes arethe volumes for each tone (6 is the loudestvolume, 3@ the quietest). For auto-dialling, aduration of 100 milliseconds seams to work well.The audio output is across 2@ of the pins goinginto the modulator) as you're looking at the backof the TI where the modulator piugs im, the audiooutput in in the pin at 9 o'clock and the audiopround is the pin below that. TI selis a 628.06headphone edapter to let you listen to this, butyou can build the thing yourself for a little over63.00 with a couple of S-pin DIN plugs (one male,ore female) at Radio Shack, hooking up the audiooutput leads to a headphone jack or whatever.Looking at the wave it put out on anoscilloscope, I saw that it puts out a very squarewave with voltage apikes whenever the wave shiftedfrom a low to high state or high to low. Aftersticking a .27mfd capacitor across the audioleads, however, I: pot a very triangular wave thatlooks like it’1) produce sounds up to about 4kHzwithout too much attenuation, with no harmonics,The frequency measurements were sade with theeapacitor and jacks hooked up as described.Bo far I've been dialing by coupling a speakerfrom the computer to a handset. I'm trying to puttogether sowe simple sort of direct coupling withthe telephone line now, and am interested inanyone else doing anything with the TI.1S\ 46wy %mm< >Le Ss wy“OTA HIGHWAY RADAR JAMMINGMost drivers wanting to make better time onthe open road will arm themselves with anexpensive radar detector. However this devicewill not work against a gun type rader unit inwhich the radar signal is not present untill thecop has your car in his sights and pulls thetrigger. Then it 1s too Jate to slow down,better method is to continously jam anyS{gnal with a radar signal of your own. I havetested this idea with the cooperation of a jocalcop and found that his unit reads randomnumbers when our car approached him. It {ssuprisingly easy to make a low power radartransmitter. A nifty little semiconductor calleda Gunn diode will generate microwaves whenSupplied with 5 to 10 vdce and enclosed {n thecorrect size cavity (resonator). An 8 volt 3terminal regulator can be used to get thisvoltage from a car's system. However the correctconstruction and tuning of the cavity {sdifficult without good microwave measurementequipment. Police radars commonly operate on theK band at 22 ghz. or more often on the X band at10.525 ghz. Most microwave intruder alarms andmotion detectors(mounted over automatic doors 1ASupermarkets, etc.) contain a Gunn typetransmitter/reciever combination that transmitsaout 10 mitliiwatts at 10.525 ghz. These unitswork perfectly as jammers. If you can't get onelocally wrtte to Microwave Associates inBurlington, Mass. and ask for info on"Gunnplexers" for ham radio use. When you getthe unit 1f may be mounted fn a plastic box onthe dash or in a weatherproof enclosure behindthe plastic grille. Switch on the power when onthe open highway. The unit will not jam radar tothe side or behind the car so don't go speedingpast the radar trap.An tnteresting phenomena you will notice isthat drivers in front of who are usingdetectors will hit their brakes as you approachlarge metal signs or bridges. Your signal 1sbouncing off these objects and triggering theirdetectors.Mave fun...Bleck Boxing Updateby The Stainless Steal RatBen Piper Recently, I moved to a new city and all myold phriends called me and ended up with a largePhone bill. Since not many of my phriends hedtouch=tone phones or dialer pads I couldn't tellthem to g° and uze a SCC. So I went thro allmy back lssues of TAP and found a set of biackbox plans.After a bit of experimentation I came up witha box that produces such good quality so repro~duction that you can't tell you are using a boxat all. So here goes with the schematic..,r == £-A w,@-20x |hdolAg an added bonus here is how you can ringaxtra phones without them knowing you have oneor more on the line. All you have to do is find@ 55 to 90 volt transient protector (Bell makesone that fits this catagory...) and connect itin series with the ringer of the offendi phone.Make sure that it has a very small capacitancebelow its rated voltage. 10 to 50 pr fs ok,now when Bell sends a pulse of DC down your lineto see how many ringers you have the protectorwill stay inactive and nide all your llegalringers. However when the 90 volt ringing currentcomes al the protector activates and letsthe current through and your phones ring !Soon to cume A special report on the new allelectronic payphone.Yours with @ anmile,The Stainless Steal Rat The Old Gray Faire,Ghe Ain't What She Used To Be.oy Crnesnrnire CatalystThe West Coast Comouter Faire carries on afine old tradition in computer noobyist circles.Tne tradition was started tn Trenton NJ in 1376when the Trenten State Collece held the FiratTrenton Comouter Festival. The Atlantic CityComputer Show coeneo a few months later, and theHomebrew Computer Club in Sunnyvale was stirringvo a hornets nest that would eventually Bring usApole Computers. Software trading. and the WestCoast Computer Faire. Trenton still carries on thetradition started by then Electrical EngirngeringProfeasor Sol Libes thease many years a0. TheAtlantic City show moved to Philadelphia, and slidinto oblivion. But tne oremer hobbyist atiw isthe one that orew out cf the Semiconductor Valleythet we lovingly call Silicon Guitcn.I’ve been to every West Coast Computer Fairethey've held in the Sen Francisco arwa. It is nowheld in March of wach year, and the flavor of ithas changed so much, that I'm not Sure I'm goingback next year. The show has been getting more andmore commercial with each oassing year, to theooint where Jim Warren, who out on these shindigs,is getting out of the game in favor of gettingback into computers.There are still bargains to be found, and themob of pecole still contains a few phreaks or twoawong the hackers. Each yesr we seem to run into@ach other. It used to be that we would gather atthe refreshment area in Brooks Hall at 4PM e@achday of the show, and sit and discuss what was nawat the show, and in phreaking/hecking.The show has gotten so big, that all theavailable soace is given so to money generatingbooths, and oclaces to enjoy refraeshwents are leftto the various snack bars, but mostiy to therestaurants nearby the San Francisco Civic Center.It wound up that we yot together in the balcony ofthe main Civic Canter hall. If I get there againnext year, look for me in Section z2i2 (I'm fromNew York, after all, and the section numbers don'tget as high as 415, to honor ay hosts). Thegathering will be at 49M, as usual, but don'texpect anything forme). TAP patherings, both atthe Faire, and at our Friday nite watering hole,are informa) rap sessions, usually with a8 Many asS conversations going on at once. Informationsharing is more than swapping data on the ARPAnet, you know.O11. many crocrammers does it take to change &qight blub? As None - That's a hardware oroblem.t take toQO: How many Comouter reoairmen does ichange a light bulb? Ar Their diagnostic ran fine,a software oroblem.HOW TO WRITE FOR TAPby Cheshire CatalystQe %% try to caste up anctner issue of thisvag, I! find that I have very little worth pastingup. NOw some of it is that I can't find some ofthe things that have been submitted, but mostly, Ican’t find those little filler items tnat use updthose extra couole of inches that are needed tofill out the botom.If yoy want to write something for TAP, thenset the margins on your tyoewriter to 45 (in caseyou need to hit “margin release") or set your wordprocessor to 5@® characters per line, and starttyping. There are about 95 lines per column, So as4% comes off your printer, you'll be able tofigure out how I'm going to paste it uo, Onerecent article would have been preat, if theauthor hadn't out a blank line between gach oara-—graph. We want to fill space, but I want to try tokeen it ta even columns, too. Right now, i'wwriting this article just to fill & inches ofspace. Ham, that's 6 lines/inch tiewes © inches, sOthia needs to be 36 lines long (mith heetti ines).The thing you must remember is, by corresoort—ding with us, you become a “correspondent”. Theterm derives from the days when writers for &newsoacers were vecpnle on trios abroad who wrotelong, deecrintive letters to their friends backhome, Their friend's had the letters published inlocal newspacers (those old guys had space to tryB 113, ‘$tc00). This newsletter is an amateurpublication (you may have noticed). This m@ans weaccept manuscripts (articles) from fallowamateurs, Keen ‘em coming pang! Dealing with the Rate & Route Operatorby Fred SteinbeckIt seems that fewer and fewer people have blueboxes these days, and that is really too bad. Blueboxes, while not all that great for making freecalls (since TPC can tell when the call was made,es well as where it was to and from), are really alot of fun to play with. Short of becoming a reallive TSPS operator, they are about the only way youcan really play with the network.For the few of you with blue boxes, here aresome phrases which may make life easier whendealing with rate & route (R&R) operators. To getthe RER op, you send KP + 141 4+ ST. In some areasyou way need to put another NPA before the 141(i.@., KP + 213 ¢ 24) + ST), 1f you Rave no localR&R ops,The R@R operator has a myriad of information,and all it takes to get this data is mumblingcryptic phrases at her. There are Basically fourspecial phrases to give to R&R ops. They areRumbers route, Girectory route, eperator route, andplace name.To get an area code for a city, one can call theRER operator and ask for the numbers ysoute, Forexample, to find the area code for Carson City,Nevada, we'd amk the RER op for "Carson City,Wevada, numbers route, please. and get the answer,"Right... 702 plus." meaning that 702 plus 7 digitagets us there.Sometimes directory assistance isn’t just NPA +i31l. The way to get these routings is to call Ranand ask for, “Anaheim, California, directory route,Please.“ Of course, she'd tell us it was 714 plus,which weans 714 + 131 gets us the D.A. op there.This is sort of a pointlesa example, but I couldn'tcome up with a better one on Shart notice.Let's say you wanted to Find out how to get tothe inward operator for Sacramento, California. Thefirat six digits of a number in that city will berequired (the NPA and an WNX). Por example, let uause 916 756. We would call R&R, and when theopecator answered, say, "916 756, cperator route,please." The operator would say, "916 plus 001plus." This means that 916 + 001 + 122 will get youthe inward operator for Sacramento.Do you know the city which corresponds to 5036407 The R&R operator does, and will tell you thatit {# Hillsboro, Oregon, if you sweetly ask for"Place name, 503 640, please.”Wone of this is really spectacular. However, R&Rcan also give information on international calla inmuch the same manner. And [t fa in these cases thatthe various routings becomes useful.For example, let's say you need the directoryroute for Bveg, Sweden. Simply ca}l RaR, and askfor, “International, Maden, Switzerland. TSPS di-rectory route, please.” In respons® to this, you'dget, “Right... Directory to Sveg, Sweden. Countrycode 46 plus 1170.*° So you'd route yourself to aninternational sender, and send 46 + 1170 to get the..A. operetor in Sweden.If you need to know how to complete a call to anoverseas number (that is, you need the country andcity code), you can ask for, "International,Cortona, Italy, TSPS numbers foute, please.” andget the answer, “Right... Country code 39 plus 475plus. This means, of course, that the city code is575, and the plus on the end means you'd tack onthe phone number there.Inwacé operator routings to various countriesare obtained the same way - "International, London,England, TSPS inward route, please.” and get“Country cede 44 plus 121." Therefore, 44 plus 121)gets you inward for London.Inwards can get you language assistance if youdon't speak the Language - Tell the foreign inward,"United States calling. Language assistance incompleting a call to (called party) at (callednumber).°RER operators are people too, y'Know. So alwaysbe polite, make good use of ‘em, and dial withcare. Verificationby Fred SteinbeckThere has been a great deal of controversy inthe realm of phreakdom over a mysterious subjectknown under a number of different names, including"verification", “autoverif£ication", “verify”,"autoverify"’, “verify busy”, and even “VFY BY”. Allof these names basically mean the same thing: theability to listen to another person's telephoneline from any telephone in the direct-dlalableworld.Needless to say, the Bell System is very tightlipped about knowledge regarding verification.Indeed, the infamous book Notes On Distance Dialing('68 edition) says, "Care must be taken to insurethat the customer never gains verificationcapsbllities." with a printed policy like that, youcan imagine what thelr real-world policy is like!Even thelr own rate and route operators will notgive verification routing codes (at least in myexperience), one even responding, "What?! You mustbe crazy! We don’t give those outl"Before you get too far into this article, I willgtate simply: I don't know how to verify. However,YT have been fooling with various things related toit, and collecting information on it for some timenow. Therefore, while I can't do {t (yet), I may beable to point some other bright TAPper on the righttrack, and perhaps he or she will show us all how.If you have knowledge mot covered in this article,but don't want to write an article on your own,please send your ideas, comments, or information toPraject Verify, c/o TAP.Verify has also been called "autoverifyTM, and Ihave no ldea why. This is not, to my Knowledge, @Bell System term (at least I've never seen it inany manuals). As far as I know, there is verify,which means being able to listen to speech (kindof; see below) on a line, and there is thePemergency interrupt’ which allows you to take partin the conversation taking place on the line inquestion. It has been suggested that "autoverify”is the same asb an emergency interrupt, but ft tendto disagree with this idea.It should be noted thatthe verification circuitry does not actually let anoperator listen to a conversation without making abeep on the iine every so often. Inatead, she willhear encrypted speech. However, I believe with theproper methods, verify can be converted to anemergency interrupt.Verification ils normally done either by yournormal "0" (TSPS) operator, if the call is in yourhome NPA (HNPA), or by an inward operator (10). Ifthe call ts outside your HNPA, your normal operatorwill call the 10 for the NPA, and say, "Verify busy(or "Emergency interrupt") please, §55-1212." TheIO will then perform whatever magic he or she must,and then report back. If the call im {in your HNPA,though, the "O“ operator can do the verificationhimself by using the “VFY BY" key on her keyshelf.However, in Some areas, the operator uses a routingcode to accomplish verification, and this is theloop Role we shali attack.It follows that if a 10 or "0" operator can doit, Bo can we, with a blue box. Now, courtesy ofRobert Allen {who brought it to my attention) andSusan Thunder (who spparently discovered it), hereis what used to work for getting operators to hookyou into a conversation with other people ({.e.,let you listen to them until you hung up): You'dcall the operator and say, "Operator, TSPSMaintenance Engineer calling. Ring forward to 001 +WPA + 7D, ring back to my number, hit ring forward,no AMA, and then position celease.”*This creates some problems, and you must befamiliar with TSPS to understand them. When youcall tnto a TBEPS console (by dialing 70"), you areon the "back", or incoming part of a loop. When shePlaces acall for you, the call goes out on the"forward", or outgoing part of the loop. If anoperator wants to make a call, she punches KP FWD{keypulse forward), the number, and ST. RIWG FWDputs a $0 wolt ringing signal across the forwardpart of the line (and may dial the number as well).The problem arises from the fact that I don't knaw{f RING FWD will actually dial a call, and If therefs some other subtle difference between it an KPywD. Let us asagume ringing forward makes a call fromthe TSPS console to whatever number {6 given. Ringback causes your phone to ring (it is assumed youhung up after giving her your Instructions; if youdidn't, you'd hear an annoying 90 volts across theearpiece...) "Noa AMA” means "no Butomatic messageaccounting", so nobody gets billed for the call,although {t will show up on a tape somewhere."Position release" removes the operator from thecircuit, and allows her to receive other calls.This leaves an unaccounted-for ring forward,The verification circuit, as you know, Likes toencrypt conversation, which Is something we don'twant. Well, the second RING FWD sends another 90volts crashing against the verify circuitry, whichJudas Gerard thinks removes the voice encryptionfrom the line, puts the operator (and you) tncircuit, and puts a beep tone on the line everyEive seconds. This seems to make senze, and I aminclined to agree with him.The bit about "...001 + NPA + JD" causes thethought “MF routing code” to spring immediately tomind. Now, the above trick was supposed to work inthe 213 NPA. I have tried both "KP + OO1 + 213 + 7D+ 8T", and some other area Codes. I generally getnothing, a reorder signal, or a tandesws recording.Here's some food for thought: On an officialTelco sheet I have, labeled "213 NPA MP RoutingCodes”, 001 is listed as "VFY By“, or verify busyfor the 213 NPA. 002 is listed for the 805 NPA. MaBell likes to have standardized routing codes, suches 121 for inward, 131 for DA, etc. It would seenlogical, then, that 001 would be a Sort of"standard" verify code, and other prefixes would betacked on at 002, 003, etc. However, I have heardfrom a retired operator that verification codes areQifferent from area to area, and are not alwaysnice numbers like 001 or 002. Ah, well, a guy canhope, can't he?Some suggestions for future attacks on thisdilemma: Everyone call your operators and subtleyask questions. f have found they tend to giveinformation out easier if you ask for somethingthat you would ordinarily have to be 4@ companyemployee to know about, such as rate steps,operator routings, etc, Casually let slip that youused to be tor still are) an operator, or that youwork for company security. Also, you might want toblue box some codes like 001 followed by your NPAand the last 7D of a busy number. If you get a sortof “whispery noise", try blasting the line with aringing signal (you might piggyback another lineonto yours and call the piggyback to generate the90 volts) and see if that does anything. Don'tforget to send in any scraps of info, no matter howmundane, to Project Verify, c/o TAP. YAPTECHNOLOGICAL ABSISTANCE PROGRAMRoom 603, 147 wast 42 St, New York City, 10036Back Isguves are $.735 each. Issue 038 is 81.56,Gubscriotions - 10 issues per year - 616.For@igon Air Mail - $13 in Money Order drawn on aUB Bank. Samole - 3 International Raoly Couoons.PUBLISHED FOR INFORMATIONALPURPOSES ONLY SINCE 1971ANNES MONDIALE BESCOMMMINCATIONSWORLS COMMUNICATIONSTRAAalo MUNMLALBELASCOMMNCACIONES1983Iseuve &