Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Phreaking General Information :: ukfone~1.txt

UK Phone Phreaking FAQ






                       The UK Phone Phreaking F.A.Q.
                       -----------------------------
                ______   ___   ___   _______   __     ___   _____
               / __  /\ /  /\ /  /\ / ___  /\ /  \   /  /\ /  __/\
              / /_/ / //  /_//  / // /\_/ / //    \ /  / //  /\_\/
             /  ___/ //  ___   / // / // / //  /   /  / //  __/\
            /  /\__\//  / //  / // /_// / //  / \    / //  /\_\/
           /__/ /   /__/ //__/ //______/ //__/ / \__/ //_____/\
           \__\/    \__\/ \__\/ \______\/ \__\/   \_\/ \_____\/
                      ______      _______       _______
                     /  ___/\    / ___  /\     / ___  /\
                    /  /\_ \/   / /__/ / /    / /\_/ / /
                   /  ___/\    /  __  / /    / / // / /
                  /  /\__\/   /  /\/ / /    / /_/  /_/
                 /__/ /   /\ /__/ /_/ / /\ /_______/ \ /\
                 \__\/    \/ \__\/\_\/  \/ \_______\_/ \/

                       Release 1.5 (February 1997)

                      designed, written and typed by
 
                  Pyro Teknik <pyro-teknik@geocities.com>
                      or pteknik@spasm.redcat.org.uk

About this F.A.Q.
~~~~~~~~~~~~~~~~~
  While this F.A.Q. answers many questions, it is NOT supposed to be THE
definitive guide to phreaking. If you are interested in learning more than
is covered here, then I suggest exploring by yourself or asking me if you 
have any questions, and I may be able to help. BTW - At the moment I'm
living in Malta, so I can't really go and check out the new payphone you've
just seen!

  This is the start of a F.A.Q. which I shall be updating every so often as
people start asking similar questions on phreaking! If you have any 
questions that are not covered, then please email me and I'll answer your
question as soon as possible. Some of the details in this FAQ may go out of
date very quickly, so if you find that something doesn't work or seems 
wrong, please email me.

             For ideas, suggestions, comments and corrections -
       Email: pyro-teknik@geocities.com or pteknik@spasm.redcat.org.uk

Please note: I receive a lot of email - around 30 personal a day and over
150 a day on mailing lists. I'm glad to receive mail, but please don't
expect an instant response. If you haven't received a reply within a week,
try re-sending your message. 

NOTE: This F.A.Q. and it's contents are designed for informational purposes
~~~~~ only. Remember that phone phreaking can be classed as a crime. 
      Although owning a blue box or any other phreaker device in Britain is
      not a crime, using them is. I cannot be held responsible, in the same
      way that the guy who made the kung fu movies is not responsible for 
      you killing a guy with a karate kick that you saw on TV :)
      Also the information is relevant for Britain, and not America.
      So don't start complaining about how 141 doesn't block caller ID in
      your state ! :)


Updates:
~~~~~~~
  The latest version of this FAQ is available from my web pages:
    http://www.geocities.com/SunsetStrip/Alley/7705 or faster
    http://redcat.org.uk/~pteknik
Or, you can email me asking for the latest version, and everytime a new FAQ
comes out, I'll email it straight to you. Also I'll be posting it to
alt.ph.uk and alt.2600, so it should be quite easy to get the latest
version.


Introduction:
~~~~~~~~~~~~~
  For many years people have been interested in phones and phone networks.
One of the main reasons of interest was to exploit the phone system and
explore 'out of bound' areas. In these areas are such treats as test
numbers, loops, recordings, out dials and so on. Out of bound areas include
anything from numbers which don't reach people and are not for the general
public to long distance trunks and inward phone operators. These days the
main reason is to achieve free calls, but much more can be accomplished...


Questions:
~~~~~~~~~~
 N   What is the phone phreaker's ring?
 U   What is a Blue Box and how does it work?
     What is a VMB and how can I (ab)use them?
     What is a PBX and how can I (ab)use them?
     What is a loop?
     How does pulse dialling work?
 N   What is blind dialling?
     What are DMTF and CCITT 5?
     What are the tones used in DTMF and CCITT 5?
 N   How do I send the tones?
     What are some 3 digit phone numbers?
     What is a COCOT?
 N   How can I listen to someone's phone call?
 N   What are these noises I hear when I'm on the phone?
 U   Which payphones can I do 'strange' things with?
     What is the likely hood of stealing a payphone?
 N   Do all payphones let you send DTMF tones?
     How can I make free calls using BT's Chargecard service?
 N   How old are BT's exchanges?
     How can I make free calls with a Phonecard?
     What is Scanning/War Dialling?
 N   I'm worried about being traced, what can I do?
 U   What are some notable things about the UK phones?
 N   This new phone has strange buttons, what are they?
 N   What have people done in the past?
     Key: [N] means new within the last few versions.
          [U] means updated within the last few versions.


What is the Phone Phreaker's Ring?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  The Phone Phreaker's Ring is a 'ring' of phreaking related web pages. The
  idea is that if you visit someone's phreaking page, and want to know more,
  you can just click on the ring menu, and jump to another similar page. The
  idea came from WebRing (www.webring.org) and was started on the 1st Jan.
  1997. If you want to know more, or wish to join, check out my info page at
  redcat.org.uk/~pteknik/ring.htm .


What is a Blue Box and how does it work?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  A blue box is a small device which usest the 2600hz tone to access the
  trunks used in long distance and international calls. They were first
  used in the 1960s when Bell published information on how their long
  distance trunks worked.
  Using a blue box is quite simple. First you call a phone number, normally
  an 0800 89* *** one, as these terminate outside of Britain. These phone
  numbers use trunks in different countries. From there you send 2600hz
  which fools the trunk into thinking that you have hung up. Straight after
  you send a mixture of 2600hz and 2400hz, after which you will hear a
  [beep, kerchink] sound from the earpiece (this is known as a wink). After
  this you can then tell the trunk where you want to call. The trunk is
  expecting your local exchange to handle the billing, of which there is
  none as you are calling through an 0800 number. To dial a number, you use
  the   CCITT 5 tones, and send KP + Country Code + Area Code + Number + ST.
  This  translates as Key Pulse, the phone number you wish to call, then
  STart, which tells the trunk that no more digits are to come. 
  When the other end picks up, you and them will both hear the beep you hear
  when you send or receive a normal international phone call. There may
  be some delay as you are calling internationally. When we used to dial
  through China a while back there was a two second delay, which is quite
  spooky when you are talking.
  Unfortunately, many countries don't let you manage to access their trunks
  as they have been trying to stop blue boxers. But, some countries can
  still be boxed through, just scan some 0800 89* *** numbers.
  Blue Boxing was still working Summer '96 in the UK, and as far as I know,
  it still works.  


What is a VMB and how can I (ab)use them?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  A VMB is a Voice Mail Box. These are basically a way for people in a
  company to keep in touch. The one I have used most is Meridian Mail on
  a mail system  for British Telecom Engineers and Linesmen. Basically, 
  you call the number of the system, and a voice will ask you for your
  mail box number. On Meridian Mail these are 6 digits long, and then a
  passcode, anything from 4 to 12 digits. After ten wrong passcode
  guesses in a row the box would be locked out, and only the system 
  manager can re-enable them. When new boxes were created, they, by
  default, have a passcode which is the same as the box number. A way
  to break into the system is find unused boxes, or guess someone's
  predictable passcode. Once into the mail box, you hear messages that
  have been sent to that mailbox, and you can change some options and
  send messages to other  people on the system. Sometimes in some
  mailboxes there is the option to dial out to any phone number you wish.
  On the VMB system I use, the special mail boxes which were allowed to do
  this were called the '06' boxes as that was the beginning of the number
  of the boxes. Unfortunately these boxes were locked out fairly soon as
  the system manager found they were being used by outsiders. 
  If you find a VMB system and you get in, help is normally available, so
  give out-dialling a try.
  The Meridian Mail system I use (when I'm in Britain) is on 0800 318 716,
  so give it a try.


What is a PBX and how can I (ab)use them?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  PBX stands for Private Branch eXchange. This is basically a small private
  exchange used by a large organisation or company to handle their calls in
  a nice easy way. Outwith business hours when you call a PBX, an answering
  service will answer (obviously. I mean an answering service won't invite
  you round for tea and biscuits with granny now will it?) and depending on
  the system you may be able to make calls from there. Sometimes after the
  message, you will here a click then a strange dial tone. From there dial
  9 for an outside line and call wherever you want. On other systems you can
  press a touch-tone during the message and access a tone controlled menu
  system. From here you may be able to dial out to wherever you like.
  Unfortunately, traces are on the lines of some PBXs, so if you feel at
  risk, then call from a payphone. 


What is a loop?
~~~~~~~~~~~~~~~
  A loop is a connection in a phone exchange where two lines are tied
  together so that if two people call the two numbers, they are connected
  for free. This  can be useful if you want to speak to someone, but don't
  to give them your phone number. One side of the loop is silent, while the
  other has a constant loud tone. When both side are called, you can talk to
  each other, sometimes with an intermittent clicking sound. I've mainly
  used these when boxing international phone calls, and speaking to friends
  through a loop in a far off country. These loops are used by the phone
  company to test phone lines and exchanges. As far as I know, there are no
  loops in the BT system. 


How does pulse dialling work?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Pulse dialling works by disconnecting and re-connecting the phone for a 
  very short period of time. For the '1' digit, only one disconnection is
  signalled '2' for two and so on, up to '0' which uses ten. These
  disconnections are for less than a second, otherwise the phone is hung
  up! You can pulse dial on a phone which has a locked or damaged key pad,
  by tapping the phone hook very quickly, once for each digit. This way
  you can dial a phone number without having to use the key pad. 

                                     
What is blind dialling?
~~~~~~~~~~~~~~~~~~~~~~~
  As far as I know, blind dialling can mean one of three things.
  1) Using the option on some payphones which speaks the number you have
  pressed. So when you press '5' you hear 'five' through the ear-piece.
  2) Randomly dialling phone numbers, similar to scanning. Used in
  conjunction with 0800 numbers to find something interesting.
  3) With a modem, blind dialling ignores the dial-tone, ring-tone and
  engaged-tone. Useful for calling countries which have strange dialling
  and ringing tones.


What are DTMF and CCITT 5?
~~~~~~~~~~~~~~~~~~~~~~~~~~
  DTMF tones are the tones that your hear on your normal touch-tone phone.
  They are made up of two tones, played at the same time. DTMF tones are
  much easier to use for dialling than pulse. A small program in C can used
  to generate the tones through your sound card, or you can use BlueBeep, by
  Onkel Dittymeyer, a brilliant phone program. Or, in the States, they use
  a radio shack pocket dialler, which also doubles as a silver box and a red
  box, with a few modifications.

  CCITT 5 tones are THE tones you want. They are used for signalling on long
  distance and international trunk lines. Many years back, (1968 I believe)
  Bell released a small leaflet called 'Signalling systems for control of
  telephone switching'. This was planned to go only to Bell employees, but
  they forgot that many colleges and universities were on their mailing 
  list. This leaflet described how the CCITT 5 signalling system worked, and
  routing for long distance calls. So many young students found out how to
  blue box, and within a few hours of the leaflet being read, some students
  had simple blue boxes ready!


What are the tones used in DTMF and CCITT 5?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           +========================================================+
           | Key  |  CCITT 5   | For | Gap |    DTMF    | For | Gap |
           +======+============+=====+=====+============+=====+=====+
           |  1   | 700 +  900 |  50 |  50 | 1209 + 697 |  50 |  50 |
           |  2   | 700 + 1100 |  50 |  50 | 1336 + 697 |  50 |  50 |
           |  3   | 900 + 1100 |  50 |  50 | 1477 + 697 |  50 |  50 |
           |  4   | 700 + 1300 |  50 |  50 | 1209 + 770 |  50 |  50 |
           |  5   | 900 + 1300 |  50 |  50 | 1336 + 770 |  50 |  50 |
           |  6   |1100 + 1300 |  50 |  50 | 1477 + 770 |  50 |  50 |
           |  7   | 700 + 1500 |  50 |  50 | 1209 + 852 |  50 |  50 |
           |  8   | 900 + 1500 |  50 |  50 | 1336 + 852 |  50 |  50 |
           |  9   |1100 + 1500 |  50 |  50 | 1477 + 852 |  50 |  50 |
           |  0   |1300 + 1500 |  50 |  50 | 1336 + 941 |  50 |  50 |
           |  11  | 700 + 1700 |  50 |  50 |    0 +   0 |   0 |   0 |
           | C12  | 900 + 1700 |  50 |  50 |    0 +   0 |   0 |   0 |
           |  *   |   0 +    0 |   0 |   0 | 1209 + 941 |  50 |  50 |
           |  #   |   0 +    0 |   0 |   0 | 1477 + 941 |  50 |  50 |
           | KP1  |1100 + 1700 | 100 |  50 | 1633 + 697 |  50 |  50 |
           | KP2  |1300 + 1700 | 100 |  50 | 1633 + 770 |  50 |  50 |
           | ST   |1500 + 1700 | 100 | 100 | 1633 + 852 |  50 |  50 |
           | KP2E |   0 +    0 |   0 |   0 | 1633 + 941 |  50 |  50 |
           | EO   |2100 +    0 |1000 | 100 |    0 +   0 |   0 |   0 |
           +========================================================+
                        KP = Key Pulse, ST = Start

  Send the tone for the number of milliseconds as specified in the 'for'
               column, then a pause for 'gap' milliseconds.


How do I send the tones?
~~~~~~~~~~~~~~~~~~~~~~~~
  Normally, you can use the soundcard of your PC - this is the normal way.
  Or, build a blue-box if you have any electrical knowledge. Or, record the
  tones onto tape and play them down a (pay)phone. Or learn to whistle well.
  Personally, I use my soundcard (anything from an adlib upwards) to produce
  the tones. If you have a CD-Walkman you could make your own CD and record
  the tones. This would be quite successful (think about it). I might do 
  this sometimes in the near future.


What are some 3 digit phone numbers?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Ok, you've probably NEVER heard this term before. That's because I called
  them '3 digit phone numbers' or 3Ds for short. These are phone numbers in
  Britain to access BT special services - Caller ID and such like. Strictly
  speaking, they aren't all 3 digit, some are 4. Anyway, here are some ones
  which you might want to know:

    100  - BT Operator help in making a UK Call.
    141  - Block Caller ID.
    1471 - Tells phone number of last person who called.
    1474 - Call last person who called.
    150  - BT Customer Enquiries.
    151  - BT Fault Report.
    153  - Find a international phone number/country code.
    155  - BT Operator help in making international call.
    174  - Calls you back.
    175  - Identifies your telephone number.
    192  - Find a UK phone number.
    999  - Emergency Services.

  You probably know a few of these already, but they do come in handy.


What is a COCOT?
~~~~~~~~~~~~~~~~
  COCOTs are phones which to a normal layman look and taste like a normal
  payphone. Actually they aren't, if you look at them, you will notice that
  in America they don't have any telco logos, while in Britain they have a 
  BT logo and in Malta they have a Southern Bell logo! You can find these 
  phones in shops, restaurants and hotels. 

  These phones normally charge more than a normal payphone, so you'll get
  less time for your dime/pence/Maltese cents. This is because the owner 
  of the phone is making a profit. A COCOT is connected to a standard phone
  line, and the owner of the phone has to pay the bill. If he charges more
  than the normal TelCo charges then he makes a profit.

  I know of two ways to make free calls from these phones. The first is to
  look around the phone, and see if you can find where it is plugged into
  the wall. If it is visible, then just unplug the COCOT and plug in your 
  own hand set. The socket is not always visible, but I know of two cocots
  this works on in Malta and a couple in Britain.

  The second method is by entering a code on the handset. This is the first
  method I discovered. One day, some friends and I were playing with a COCOT
  and suddenly the dialtone re-appeared. We had punched in the code which
  the phone owner uses to use the phone without having to put in money. The
  phone was a 'BT Payphone 200 MK II' although we believe it was actually a
  COCOT. The code we had typed in was *#2580. After the dialtone reappears,
  we could call anywhere for free.

  There is a third method, which only works in America. But seeing as this
  FAQ is destined for Britain, it ain't much use!


How can I listen in to someone's phone call?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  I know of two methods of doing this:
  1) On many new payphones, there is a facility for deaf/impaired hearing
  people to pick up the phone call with their hearing aid. The switch on the
  hearing aid is placed into the 'T' position, and then the hearing aid
  picks up what the other party is saying by radio waves. This eliminates
  all background noise for the person, which is a great help. You can spot
  these phone, as they have the deaf symbol on them (An ear with a line
  though it). These means that all phone conversations are transmitted from
  these phones into the air. All you have to do is wear a hearing aid and
  stand next to the phone, or use a radio receiver. The distance the speech
  is broadcast is not amazing, but you can normally stand on the phone next
  to the one in question with your receiver and listen in.
  2) You can buy small telephone bugs which can broadcast upto 1500m in FM.
  These are available from Bull Electrical and cost only about 15 UKP - they
  are very handy and work very well.
  Check out www.pavilion.co.uk/bull-electrical for these bugs.


What are these strange noises I hear when I'm on the phone?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  People often hear weird noises when they are on the phone. The most 
  common are listed and explained below.

  Music/Voices: This is either a crossed line (Telcos fault) or you're using
                a portable phone and you're picking up a radio station.
  Cracks:       A click or cracking noise. Can sometimes interfere with
                speech, or can just be irratating. Telcos fault.
  Whistles:     Whistling, buzzes or anything like that. Doesn't normally
                interfere with speech. Telcos fault.
  Echoing:      When you hear your own or the other parties voice a short
                time after you originally said/heard it. Very annoying and
                off putting. Telcos fault.
  Clipping:     When you're call is routed through a satellite, and you are
                not speaking, the line is used for someone else's voice. 
                This saves money for the Telco. When you start speaking 
                again, the exchange finds any empty line and your voice is
                sent. This takes a short amount of time, and so the start 
                of each sentence is lost (normally the first syllable). 
                This also happens when someone answers their cellular
                phone, and they say 'Hello' twice. Telcos fault, and
                there's not much anyone can do.
  Hissing:      Hissing is what you hear when someone is not speaking. When
                no sound is being transmitted, you hear the sound of the
                line. In most cases, when the person speaks again, the
                hissing disappears.
  Delays:       When calling internationally, delays are likely. This means
                that takes a noticeable amount of time for your voice to
                reach the other person, and vice versa. Noticeable if you
                are blue-boxing. Can be off-putting. Delays of more than 2
                seconds can cause you to interrupt each other, which was
                a common problem when we used to blue-box through China.

  Most other sounds are just the exchange working. If you hear anything else
  that you wouldn't expect to, email me the details, and I'll see what I can
  find out.


Which payphones can I do 'strange' things with?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Payphones can always be good fun, especially the older ones. My current
  favourite is the BT Payphone 200 MK II (I have a feeling it is a COCOT:
  See earlier in this FAQ for details on COCOTs). This phone can be easily
  persuaded to give you free calls.

  Description: A creme coloured box with brown cord and handset. Small 
               little LCD screen and nothing fancy.
  Location:    Normally in shops and hotels, swimming pools (No, you fool,
               not under the water, next to the office!) and so on. May be
               in a bubble.

  Anyway, walk up to this phone, pick up the handset and dial *#2580 then
  the number you wish to call. International calls can be made... he he he.
  I recommend dropping a coin in, the pressing the receiver switch so the
  coin drops out but it sounds and looks legit to anyone who is watching.


  The details from the next one came from a friend called Neil.
  For Phone with a volume control, try the following:
    1) Put in a pound coin, don't worry you'll get it back..
    2) Dial 141141 and then keep pressing 0 many times..
    3) If it works, the phone will says 'no coin call' and will spit your 
       coin back out.
    4) If it doesn't work, you've lost a pound.
    5) If it does work, make a phone call and BEFORE the money reaches 10 p,
       press 'follow-on-call'. The dial 14114100000 etc. and you coin will
       be refunded, hence a free call!


What is the likelihood of stealing a payphone?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Some guy asked me if it would be worth stealing a payphone. The obvious
  advantages are that you can get the money out of it, and also some handy
  phone parts. I had a look at the standard payphone now (Scotland anyway),
  and came to the conclusion that it's a fair bit of work to remove one of
  these large and well armoured looking devils. Even a crowbar across the
  front of the phone does little damage (except to my fingers!). There is
  usually a slight gap where the phone is attached to the back of the phone
  box, so perhaps a crowbar or a little bit of explosive in there might
  liberate it. But, stand back when it comes off, the phone is heavy and 
  will probably break your toes.
  If you can gain access to a weaker build of phone, and can easily get 
  away with it, then I say try it. But don't try stealing one in broad
  daylight in your City Centre!


Do all payphones let you send DTMF tones?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  A friend of mine in the UK seems to be having problems sending DTMF tones
  by pressing the keys on the keypad of the phone. Most phones I've seen let
  you send DTMF tones no problems. Try pressing # once you are connected,
  then the numbers you want. Some/most payphones seem to play the DTMF sound
  when you press the keys, but actually dial pulse - strange, eh? It seems 
  that the older types of phones can send DTMF from the keypad, but some 
  newer ones can't/won't. If all else fails, use a pocket dialler or one 
  of those hand-held phone number stores/diallers that send tones for you. 


How can I make free calls using BT's Chargecard service?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  BT's Chargecard is a little service where you dial 144 then a code, and 
  then the call is billed to your home phone. I decided to get a Chargecard
  for a little while. The idea is quite good, although BT makes more profit
  than if you called from home normally! My card started '486' and had 
  another 5 digits then a 4 digit passcode. The only way I know of to make
  calls for free (although some poor customer has to foot your bill!) is
  guess the card number at random. This has worked VERY occasionally for me,
  and is something to do at a payphone for obvious reasons. Just dial 144
  then 12 random digits, and the message that follows will tell your if you
  were successful or not. 


How old are BT's exchanges?
~~~~~~~~~~~~~~~~~~~~~~~~~~~
  I was wondering how old the exchanges are, because in some places the
  caller id doesn't work. When you try to use it, you receive a recorded
  message stating that the exchange is old, and BT will be building a new
  one soon. So, it seems that some exchanges are lovely, new, high-quality
  (huh!) digital beasts and some still have valves :). BTW, the world's 
  first unmanned phone exchange is in Glenkindie, Scotland, and is very
  small. 


How can I make free calls with a Phonecard?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  I got the details for this question a few years back from Violator who
  released a text file about this. Although I can't find the original file,
  I can remember what he said. So thanx to Violator for this one...

  Get a hold of your phonecard and some video tape, a pencil, sellotape and
  some sand paper. (and six thousand tons of sticky back plastic!!!). Now,
  place a strip of video tape over the back of the card, at the top - this
  is where the credit details are stored. Sand paper some pencil lead onto
  the video tape, and then sellotape the whole lot onto the phone card.
  _________________________
  |                       |         Put the videotape over the ###s 
  |#######################|
  |                       |
  |                       |
  |                0888672|   <- This is the little number that is printed
  |_______________________|              on the back of the card.

  Now place the card into the card payphone, and hopefully the pencil
  graphite and video tape's magnetic field should confuse the phone and
  you should be able to call for free. 
  BT has now released a new type of phonecard which uses a small chip. They
  use exactly the same design in Malta and many other countries. It may be
  worth trying a different countries card in a BT phone, and seeing what
  happens. I also have the technical plans for the chip on these new cards,
  and as far as I can tell, they can't be 'recharged' - perhaps someone
  could make new chips which don't lose credits.



What is Scanning/War dialling?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Scanning and War Dialling are two very similar past times. Both involve
  dialling many numbers to find something interesting. Scanning is searching
  for anything like VMBs, PBXs and loops. War dialling is searching for a
  modem carrier: another computer you can connect to, and see what's there.
  The term war dialling comes from the film 'War Games' in which the guy 
  sets his computer to dial every number in his home town. Anyway, most
  searching is done on free call numbers, 0500 and 0800 numbers. There are
  many good little programs out there which you can set to scan through
  numbers for you. Over night scanning to 0800 89* *** numbers are always
  a winner, especially to find places to blue box through. In some states
  of America, a law has been passed stating that you must not call someone
  without the intent to communicate with someone. This means that scanning
  is not allowed there. If your worried about scanning in Britain, use a 
  payphone with a Psion 3a or a laptop with a soundcard. (These are
  indispensable tools for a phreaker so get your hands on one)


I'm worried about being traced, what can I do?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  For a start, 141 doesn't stop traces, it just withholds caller-id. Many
  0800 numbers (I've heard) automatically record your number, although I
  don't know if this is true. You could:
  1) Call from a payphone.
  2) Call from a cloned cell-phone.
  I wouldn't worry too much, but don't be over ambitious. Although, I've 
  made over 500 blue box calls around the world from my home phone in the
  UK and they never did anything.


What are some notable things about the UKs phones?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Here are just a few facts you might find useful.

  After you have finished a call to someone, and they hang up, but you
  don't, you stay connected. If you don't hang up and they pick up the
  phone later, you can talk to each other, but of course you are still
  being billed all the  while. This can be useful when you are changing
  phones in your house, as you can put one down and switch to another.
  Also, if you want to annoy someone, you could make a free call to them
  and not hang up, so they'd have to call BT from somewhere to get the 
  call disconnected. I was pondering the idea of  making a reverse 
  charges call to someone, getting them to accept the charges and then
  never hanging up (from a payphone of course) and I wonder if they
  would charged a lot of money. Remember that reverse charging incurs a
  sur- charge and costs more per second than a normal call.
  
  If you are trying to get through to someone and you think they have taken
  the phone off the hook, you can actually get through. If you phone the
  operator and say I need to speak to Jim Smith at Manchester 123456, and
  that you think the phone may be off the hook, the operator can check. Then
  she will say that she can send a tone down, so that Jim will hear it and
  hopefully pick up the phone. When this happened to me (I had knocked the
  phone off the hook) the operator came on after I heard the tone, and told
  me that a call was waiting. I then hung up, and a few seconds my friend
  rang. I hope you find this useful, as I have sometimes. Also, it 
  highlights the possibility of BT having phone tapping capabilities.


This new phone has strange buttons, what are they?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  On some phones, non-BT ones, you get strange and unfamiliar buttons. Here
  are some standard buttons you will see. If you find some more, please 
  email me and I'll try and find out.

  LR    - Last number Redial, calls the last number dialled.
  S     - Silence, temporarily cuts off the mouthpiece completely.
  R     - For use with 3-way conferencing and call waiting.

  A slider bar on the phone normally changes the speaker volume for people
  with impaired hearing. A small light could mean in use, or could flash
  when the phone rings, again for those with impaired hearing. 


What have people done in the past?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  Some friends and myself thought of a good way to make money about 2 years
  ago - setup an 0891 number and then make heaps of fraudulent calls to it,
  and rake in the cash. In fact this idea works - I read a few weeks ago 
  about some people in London a while back had done this, and had a room 
  with 20 clones cellphones connected to their number - they got away with
  a large amount of cash. I see no reason why this still can't be done.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  That's the end - if you have any questions, please do email me with them.
          pyro-teknik@geocities.com or pteknik@spasm.redcat.org.uk
-- 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH