I N V A D I N G T H E B E L L S Y S T E M Bridging heads, residential and business multiline distribution boxes, line and trunk splitters, and other Bell system wire terminations. - How to use, and/or abuse them - (including a tutorial on basic telephone eavesdropping techniques.) *************************************** written by : Phucked Agent 07/29/84 04 *************************************** In this article, I will first bescribe the termination, wiring, and terminal hardware most commonly used in the Bell System, and I will include a section on methods of using them. *************************************** ------------- Local Network ------------- The local telephone network between the central office/exchange and the telephone subscribers can be breifly described as follows: From the central office (or(lncal exchange) of a certain prefix(es), underground area trunks go to each area that has that prefix. (usually more than one prefix per area) at every few streets or tract areas, the underground cables surface. they then go to the telephone pole (or back underground, depending on the area) and then to the subsribers house (or in the case of an apartment building or mutliline business, to a splitter or distribution box/panel). **************************************** Now that we have the basics, I'll try and go in-depth on the subject. ------------------ Underground cables ------------------ These are sometimes inter-office trunks, but usually in a resid- ential area they are trunk lines that go oto bridging heads or distribution cases. the cables are about 2-3 inches thick (varies), and are either in a metal or pvc-type pipe (or similar). Rarely (maybe not in some remote rural areas) are the cables just 'alone' in the ground. Instead, they are usually in an underground cement tunnel (resembles a small sewer or stormdrain). The manholes are >heavy< and will say 'bell system' on them. They can be opened with a 1/2 inch wide crowbar (hook side) inserted in the top rectangular hole. If you get it open, go inside!! There are ladder rungs to help you climb down. You will see the cable pipes on the wall, with the blue and white striped one being the inter-office trunk (at least in my area). The others are local lines, and are usually marked or color coded. There is almost always a posted color code chart on the wall, not to mention telco manuals describing the cables and terminals, so I need not get into detail. Again: >if you can get into a bell manhole, do it!, It will pay off <. Also, there is usually some kind of test equipment, and often bell test sets are left in there. So get your crowbars! **************************************** -------------- Bridging Heads -------------- The innocent-looking grayish-green boxes. These can be either trunk bridges or bridging for residences. The major trunk bridging heads are usually larger, and they have the 'western electric' logo at the bottom, whereas the normal bridging heads (which may be different in some areas- depending on the company you are served by. Gte b.h.'s look slightly different. Also, do not be fooled by sprinkler boxes!) can be found in just about every city. To open a bridging head: If it is locked (and you're feeling destructive), put a hammer or crowbar (the same one you used on the manhole) in the slot above the top hinge of the right door. Pull hard, and the dorr will rip off. Very effective! If it isn't locked (as usual), take a 7/16 inch hex socket and with it, turn the bolt about 1/8 of a turn to the right (you should hear a spring release inside). holding the bolt, turn the handle all the way to the left and pull out. Now inside, first check for a test-set (which are often left by bell employees). There should be a panel of terminals and wires. Push the panel back about an inch or so, and rotate the top latch (round with a flat section) downward. Release the panel and it will fall all the way forward. There is usually a large amount of wire and extra terminals. The test-sets are often hidden here, so dont overlook it (manuals, as well, are sometimes placed in the head). On the right door is a metal box of alligator clips. Take a few (compliments of bell...). On each door is a useful little round metal device. (Says 'insert gently' or 'clamp gently - do not overtighten' etc..) On the front of the disc, you should find two terminals. These are for your test set. (If you dont have one, dont depair - I'll show you ways to make basic test sets later in this article). Hooking the ring (-) wire to the 'r' terminal; and the tip (+) wire to the other. (By the way, an easy way to determine the correct polarity is with a 1.5v led. Tap it to the term. pair, if i doesnt light, switch the poles until it does. When it lights, find the longer of the two led poles. This one will be on the tip wire (+)) Behind the disc is a coiled up cord. This should have two alligator clips on it..its very useful, because you don't have to keep connecting and disconnecting the fone (test set) itself, and the clips work nicely. On the terminal board, there should be about 10 screw terminals per side. Follow the wires, and you can see which cable pairs are active. Hook the clips to the terminal pair, and you're set! Dial out if you want, or just listen (if someone's on the line). Later, I'll show you a way to set up a true 'tap' that you can set up, and will let the person dial out on his line and receive calls as normal, and you can listen in the whole time. More about this later... On major prefix-area bridging heads, you can see 'local loops', which are two cable pairs (cable pair = ring+tip, a fone line) that are directly connected to each other on the terminal board. These 'cheap loops' as they are called, do not work nearly as well as the existing ones set up in the switching hardware at the exchange office. (Try scanning your prefixes' 00xx or 99xx #'s. The tone sides will announce themselves with the 1000 hz loop tone, and the hang side will give no response. The first person should dial the 'hang' side, and the other person dial the tone side, and the tone should stop if you have got the right loop) If you want to find the number of the line that you're on, you can either try to decipher the 'bridging log' (or whatever), which is on the left door. if that doesnt work, you can use the follwing: --- ANI # (Automatic Number Indentication) --- This is a telco test number that reports to you the number that youre calling from (it's the same, choppy 'bell bitch' voice that you get when you reach a disconnected #) For the 213 NPA - dial 1223 408 NPA - dial 760 914 NPA - dial 990 These are extremely useful when messing with any kind of line terminals, house boxes, etc. Now that we have bridging heads wired, we can go on... (dont forget to close and latch the box after..wouldnt want to get and telco people mad, now, would we?) *************************************** ------ "CANS" - Telephone pole distribution ------ boxes Basically, two types: 1> Large, rectangular silver box at the end of each street. 2> Black, round or rectangular thing at every telephone pole. Type 1 - This is the case that takes the underground cable from the bridger and runs it to the telephone pole cable (the lowest, largest wire on the telephone pole). The box is always on the pole nearest the briging head, where the line comes up. Look for the 'call before you dig - Underground cable' stickers.. The case box is hinged, so if you want to climb the pole, you can open it with no problems. These usually have 2 rows of terminal sets. These are all the cable pairs for your street. (Its similar to a miniature bridging head). Use/abuse it in the same manner as we did before. (Note: all the active lines carry from 15 to 48 vdc, and even 90vac (when ringing), so be careful - It's not going to hurt you, but it can surprise you (and if you're hanging by one hand from a tel. pole, it >can< be harmful!)) Oh, by the way, if you use ANI on every pair and you find one that isnt in use on your street, you can hook it up for yourself (almost). Also, you have to be able to impersonate a telco technician and report the number as 'new active' (giving a fake name and fake report, etc) I don't recommend this and it probably won't (almost positively won't) work, but this is basically what telco linemen do). Type 2 - This is the splitter box for the group of houses around the pole. (usually 4 or 5 houses). Use it like I mentioned before. The terminals (8 or so) will be in 2 horizontal rows of sets. The extra wires that are just 'hanging there' are provisions for extra lines to residences (1 extra line per house, thats why the insane charge for line #3!) If its the box for your house also, have fun and swap lines with your neighbor! 'piggyback' them and wreak havoc on the neighborhood (it's eavesdropping time...) again, I dont recommend this, and it's difficult to do it correctly. Moving right along.. *************************************** ------------------------------ Apartment / Business Multiline Distribution Boxes ------------------------------ Found outside the buliding (most often on the right side, but not always.. just follow the wire from the telephone pole) or in the basement. It has the terminals for all the lines in the building. Use it just like any other termination box as before. Usually says 'bell system' or similar. Has up to 20 terminals on it (usually) the middle ones are grounds (forget these). The wires come from the cable to one row (usually the left one) , with the other row of terminals for the building fone wire pairs. The ring (-) wire is usually the top terminal if the set in the row (1 of 10 or more), and the tip is in the clamp/screw below it. This can be reversed, but the cable pair is always terminated one-on-top-of-each-other, not on the one next to it. (Im not sure why the other one is there, probably as a provision for extra lines) dont use it though, it is usually to close to the other terminals, and in my experiences you get a noisy connection. Final note: Almost every apartment, business, hotel, or anywhere there is more than 2 lines this termination method is used. If you can master this type, you can be in control of many things... Look around in your area for a building that uses this type, and practice hooking up to the line, etc. As an added help, here is the basic 'standard' color-code for multiline terminals/wiring/etc... Single line: red = ring green = tip yellow = ground (connected to l1 ringer coil in individual and bridged ringer phones (bell only)) usually connected to the green (tip) Ring (-) = red white/red stripe brown white/orange stripe black/yellow stripe Tip (+) = green (sometimes yellow, see above ^) white/green stripe white/blue stripe blue black/white stripe Ground = black yellow *************************************** ---------------------- Residence terminal box ---------------------- Small, gray (can be either a rubber (Pacific Telephone) or hard plastic (AT & T) housing) deal that connects the cable pair from the splitter box (see type 2, above) on the pole to your house wiring. Only 2 (or 4, the 2 top terminals are hooked in parallel with the same line) terminals, and is very easy to use. This can be used to add more lines to your house or add an external line outside the house. *************************************** Well, now you can consider yourself a minor expert on the terminals and wiring of the local telephone network. Now you can apply it to whatever you want to do.. heres another helpful item- How to make a basic test-set and how to use it to dial out, eavsdrop, or seriously tap and record line activity. --------- TEST-SETS --------- These are the (usually) orange hand set fones used by telco technicians to test lines. To make a very simple one, take any bell (or other, but i recom- mend a good bell fone like a princess or a trimline. GTE flip fones work excellently, though..) Fone and cut off all the wires (including the modular jack , if any) except the red (ring - ) and the green (tip +). If they arent color-coded, they are usually the inner most two in the 4 con ductor cable (the fone cord). Put alligator clips on it and use it as described earlier. This will enable you to dial out and listen, but no extra abilities.( You are in effect just an extension of their line). If you want to get more technical, or you just want to listen without being heard (or detected in any normal way) you can use one of the following test-set/tap fone designs, or make your own.. Test Set Version # 1 ---------------- - - A 'black box' type fone mod will let you tap into their line, and with the box on, it's as if you werent there. They can recieve calls and dial out, and you can be listening the whole time! very useful. With the box off, you have a normal fone test set. Instructions: Basic black box. Works well with good results. Take the cover off the fone to expose the network box (Bell type fones only). The terminal should have a green wire going to it (orange or different if touch tone - doesnt matter, its the same thing). Disconnect the wire and connect it to one pole of an SPST switch. Connect a piece of wire to the other pole of the switch and connect it to the terminal. Now take a 10k ohm 1/2 watt 10% resistor and put it between the terminal and the terminal, which should have a blue and a white wire going to it (different for touch tone). It should look like this: -----BLUE WIRE----- ---WHITE WIRE-----/ ! ! 10K RESISTOR ! --GREEN WIRE- - ! ! ! ! SPST What this does in effect is keep the hookswitch / dial pulse switch ( f to rr loop) open while holding the line high with the resistor. This gives the same voltage effect as if the fone was 'on-hook', while the 10k ohms holds the voltage right above the 'off hook' threshold (around 22 volts or so, as compared to 15-17 for normal off hook, 48 volts for normal 'on-hook'), giving the best line volume and signal strength attainable without an external amplifier. Test-set version # 2 ---------------- - - Another design (which I use on a GTE flip phone II with good res- ults), is similar to the 'type 1' test set (above), but has some added features: FROM >-----------------TIP--------- ----------RING-- ! ! > ! ! ! ! ! X--------- ! ! X ! !----X ! X----0-----! X= SPST SWITCH O= RED LED 0=GREEN LED \/\/\=1.8K 1/2 watt resistor XXXX= DPST switch When the spst switch in on, the led will light, and the fone will become active. The green light should be on. If it isn't, switch the dpst. If it still isnt, check the polarity of the line and the leds. With both lights on, hang up the fone. They should all be off now. Now flip the dpst and pick up the fone. The red should be on, but the green shouldnt. If it is, something is wrong with the circuit. You wont get a dial tone if all is correct. When you hook up to the line with the alligator clips (assuming you have put this circuit inside your fone and have put alligator clips on the ring and tip wires (as we did before)) you should have the spst #1 in the off posistion. This will greaty reduce the static noise involved in hooking up to a line. the red led can also be used to check if you have the correct polarity. With this fone you will have the ability to listen in on >all< audible line activity, and the people (the 'eavesdropees') can use their fone as normal. Note that test sets #1 and #2 have true 'black boxes', and can be used for free calls (see an article about black boxes). Test Set version # 3 ---------------- - - (Courtesy of Lex Luthor ,Sysop of Plover Net) Using a trimline (or similar) phone, remove the base and cut all of the wire leads off except for the red (ring -) and the green (tip +). Solder alligator clips to the lugs. The wire itself is 'tinsel' wrapped on rayon, and doesnt solder well. Inside the fone handset, remove the night light socket (if it has one) and install a small slide or toggle switch (radio shack's microminiature spst works well). Locate the connect- ion of the ring and the tip wires on the pc board near where the jack is located at the bottom of the handset. (The wires are sometimes black or brown Instead of red and green, respectively). Cut the foil and run 2 pieces of wire to your switch. In parallel with the switch add a .25 mf 200 vdc capacitor (mylar, silvered mica, ceramic, not an electrolytic). When the switch is closed, the handset functions normally. With the switch in the other position, you can listen with out being heard. (I would, once again, like to give credit to Lex Luthor for this simple and effective design). NOTE: To reduce the noise involved in connecting the clips to a line, add a switch selectable 1000 ohm 1/2 watt resistor in series with the tip wire. Flip it in circuit when connecting, and once on the line, flip it off again. (Or just use the 'line disconnect' type switch as in the type2 test set (above)). Also avoid touching the alligator clips to any metal parts or other terminals, for It causes static on the line and raises poeple's suspicions. Recording --------- If you would like to record any activity, use test set 1 or 2 above (for unattended recording of >all< line activity), or just any test set if you are going to be there to monitor when they are dialing, talking, etc. Place a telephone pickup coil (I recommend the recoton t-5 tp coil or equivalent) onto the test set, and put the tp plug into the mic. Jack of any standard tape recorder. Hit play, rec, and pause. Alternate pause when you want to record (I dont think anyone should have any difficulty with this at all...) ************************************** Well, if you still can't make a test set or you don't have the parts, there's still hope. Alternate methods: 1> Find a bell test set in a manhole or a bridging head and 'borrow it indefinately'... 2> According to Sir Francis Drake, Test sets can be purchased from: Techni-Tool 5 APOLLO ROAD BOX 368 Plymouth Meeting PA., 19462 ASK FOR CATALOG #28 They are usually $300 - $600, and are supposed to have mf dialing capability as well as tt dialing. They are also of much higher quality than the standard bell test sets. *************************************** If you would like to learn more about the subjects covered here, I suggest: 1> Follow bell trucks and linemen or technicians and ask subtle questions. Also try 611 (repair service) and ask questions.. 2> Explore your area for any Bell hardware, and expirament with it. Don't try something if you are not sure what youre doing, because you wouldnt want to cause problems, Would you? I hope the article was informative. Be looking for 'Invading the Bell System - Part II' *************************************** WRITTEN BY: PHUCKED *** AGENT *** 04 A.K.A. PHREAK ADVISOR > THE C.O.R.E. DELTA > SPINOFF MASTER PVPC INNER CORE *************************************** Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open