Phone Phreaking

[Michael GilliganParticipant @michaelgilligan61133]

I have a distant memory of reading a good article about this in one of the ‘Sunday Supplements’

Some of the forum’s telephone engineers might like to elaborate

MichaelG.

.

 

[Hugh Stewart-Smith 1Participant @hughstewart-smith1]

Whoa! That takes me back to the mid-60’s when we found a way of getting free calls from ‘phone boxes.

By tapping out the number on the bar on the telephone cradle you could get connected for free. You had to tap the number with a pause between numbers and the numbers ‘0’ and ‘9’ could be dialled.

Does that ring any bells? – although it used to ring a few numbers!

We didn’t think ourselves as ‘phreaks’ though.

Hugh                                                                                                      Amadeal Ltd

[duncan webster 1Participant @duncanwebster1]

On the old dial phones which also had letters against the numbers, if you dialled GULO6 first, you got free calls from a phone box. Not that I ever did you understand

[John HaineParticipant @johnhaine32865]

Old phone boxes used to have a coin mech that generated 10pps “dial pulses” to indicate the coin type.  In order to discriminate between these and normal pulses the line was reversed in “quiescent” mode and series diodes used in the payphone to decide which of the dial or mech was in circuit.  Once a valid coin had been signalled the exchange would reverse the line back to normal to permit dialling and speech.  I knew of at least one payphone in a university hall of residence where enterprising engineers had shorted out the dial diode so the coin value could be “dialed in”.  Ah, those were the days before hacking became a thing.  I recall that Plessey had a “consulting vandal” they used to try to break payphones too.

[Robert Atkinson 2Participant @robertatkinson2]

When making calls from work most extensions would have international and premium numbers blocked. One way around that was to use the handset on the Fax machine…

[Hugh Stewart-Smith 1]

On Hugh Stewart-Smith 1 Said:

Whoa! That takes me back to the mid-60’s when we found a way of getting free calls from ‘phone boxes.

By tapping out the number on the bar on the telephone cradle you could get connected for free. You had to tap the number with a pause between numbers and the numbers ‘0’ and ‘9’ could be dialled.

Does that ring any bells? – although it used to ring a few numbers!

We didn’t think ourselves as ‘phreaks’ though.

Hugh                                                                                                      Amadeal Ltd

Yes, I remember that from my university days in the sixties.  You could also make long distance calls by stringing together dialing codes to get from one exchange to another.  If you went through too many exchanges to reach your destination the call quality became only just intelligible.  The exchanges used electro-mechanical switches called uniselectors which advanced one step for each pulse you sent.

Russell

[Michael GilliganParticipant @michaelgilligan61133]

Can’t find the original article that I thought I remembered, but with a little help from ChatGPT, I located this:

https://hacker-archive.org/assets/chaoscd/www_ccc_de/Library/HPA/MagsStoriesFAQs/pkmanual.html?utm_source=chatgpt.com

MichaelG.

[David AmbroseParticipant @davidambrose86182]

The other game was to string together a load of dialling codes to ring the phone at the neighbouring desk in the same office.  “We made our own entertainment in those days…”

[Nigel Graham 2Participant @nigelgraham2]

Post Office Telephones, as it was then, realised this switch-hook tapping was going on so set the dial speed to a more awkward value – 11 pulses / second if I recall rightly – and made the exchange switches more sensitive.

…

The uniselectors were only part of a quite a long chain of switches. The ones that handled the number itself were part-rotary / part linear in which the first of each pair of digits was the contact row counting upwards, the second was given by the position round the semicircular row.

These selectors were all controlled by fiendishly complicated relay circuits; the “final selector” picking the last two digits the most complicated because it also handled the ringing and other functions. The circuit-diagrams reflected that, comprehensible only with a table of the relays and the on/off status of their many contacts; and considerable experience.

If you were in an Automatic Telephone Exchange serving a fair-sized town in that “Strowger” era the noise built up from a lot of apparently-random buzzes to a continual roar as traffic increased through the morning. A small rural version was a different matter, and there you could sometimes hear the progress of a call from the initial line-finder uniselector to the final digit-selector; followed later by a series of satisfied “bzzz-clonks” as each switch re-homed itself in turn at the close of the call.

You could not of course hear the conversation! In any case all calls, even the most mundane little private chats, were and presumably still are, protected by the Official Secrets Act.

[Clive SteerParticipant @clivesteer55943]

Phone freaking was a little more advanced than just cradle tapping which was used to make free local calls from phone boxes connected to strowger exchanges. So for instance the whole of London was on one network of linked exchanges so a call could be made from say a phone box in south London and phone in say north London. However before trunk dialling was introduced long distance calls had to be made using an operator. However there was a way from a phone box to unhook from the local exchange and link across onto the trunk links between exchanges. If you knew the code numbers of the exchange you wanted to route through you could act like “the operator” and route you call yourself. When automated trunk dialing was introduced routing to and through exchanges was done using inband tones and again if you knew the tone sequences that identified the exchanges one could route ones call anywhere on the network. I believe Steve Wozniak was an early master of phone freaking in the State and look where that got him.

Clive S

[Chris CrewParticipant @chriscrew66644]

I actually never did figure out how to cheat the old Strowger phone system but I did work on the C&FC (coin and fee check) equipment which was a complicated box of relays and miniature uniselectors. It’s over 50years ago now but from memory there were four uniselectors designated CU (coin unit), MU (meter unit), DU (delay unit) and TU (time unit). I can’t recall the exact sequence of events but the CU was pulsed round by a series of line reversals generated by the insertion of a coin, you pressed it in against a bar that returned slowly generating the pulses. As long as the CU was kept in advance of the MU the call was held open. As soon as they coincided DU introduced a delay, starting with a pay tone being sent to the caller, defined by the TU uniselector before the call was abandoned, to allow time for the caller to insert more coins and advance the CU once again. I remember that the same mechanism was used in TXE/4 exchanges mounted on a slide-in unit rather than in a tin box.

[Clive SteerParticipant @clivesteer55943]

I had a friend who back in the 50/60’s had a business in Farnham Surrey and a flat in London. All his business calls from Farnham were long distance and mainly to London which was both expensive and you often had to book a call or the operator would call you back. I don’t think the bottleneck was the number of circuits between Farnham and London but the number of operators. Anyway being technically minded about telephones and the network he rented from PO telephones a long distance DC line from Farnham to his flat which you could do in those days. He then designed and installed, in his flat, a relay based unit to link from the DC line to the London telephone network so he could dial directly from Farnham to anywhere in the London telephone area. He continued to study the workings of the UK telephone network from information freely available at the time and could see where various improvements could be made so approached PO telephones with an offer to act as a consultant. They declined his offer saying they didn’t need such a service as their guys knew better. Anyway he went on to use this knowledge to enable him to not just link to the London area phone network but also to link into the Tandem network that linked exchanges countrywide. Eventually PO telephones cottoned on to what he was doing and decided to prosecute him. He recorded all the calls he made and his defence was that he never intended to defraud PO. Unfortunately his business partner wasn’t as diligent and didn’t record his call and this was his undoing. I think the case was heard in the High Court and PO went to great lengths and expense to show the jury how he did it. He was found guilty of “stealing PO electricity” and fine £1000 but PO want their costs which was much more. However the judge ruled that he didn’t deny the “crime” so their explanation was unnecessary so no costs were awarded. Even so a £1000 then could buy a very nice house but his flat was in Pimlico so he was exactly short of money. He thought he was the first Phone Phreaker.

Clive S

[Marcus BowmanParticipant @marcusbowman28936]

My Dad had an early book on Phone Phreaking. It came from the USA and was a large format soft-covered book. I read it avidly, but unfortunately it seems the USA and Ma Bell used a different tone-based system to the pulse dialling of the UK. Disappointing for young teenager in the UK, especially after reading (what seemed like) the exciting exploits of the Phreakers in the US.

[John HaineParticipant @johnhaine32865]

The UK did move to tone signalling IIRC as pulse was far too slow as traffic volumes increased. It would surely have been different to the rest of world to “protect our home manufacturers”. That went well didn’t it? All became obsolete when digital transmission and switching took over.

[Chris CrewParticipant @chriscrew66644]

Not sure that it was different to the rest of the world, I thought MF4 (multi-frequency) was one of the standards defined by the ITU (International Telecommunications Union) and was introduced to handsets when electronically controlled analogue exchanges started to be installed, TXE/2, TXE/4 and especially TXE/4A as these had both loop-dis, sent in P1247 code, and MF registers to handle the digits. The digits were not stored as such but were used to steer the control program which was held on a ROM which consisted of miniature threaded magnetic cores. TXE/4, for example, had a maximum program store of 5K. You could run the program until it reached a set address, the read-out of which appeared on small incandescent lamps, and then step it on until you found the ‘bug’ which would be a copper wire threaded through an incorrect core. There were no bits and bytes in those days!

I didn’t work so much on trunk and junction signalling equipment but I seem to recall signalling systems in Strowger exchanges were designated AC9, AC11 (alternating current) MF2 and DC2 (direct current) etc. The frequency 2280Hz seems to ring a bell, no pun intended, because you could whistle into a mouthpiece and get a remote routiner answering circuit to respond. I am fairly certain 2280Hz was the frequency used in AC9 signalling but I could be wrong because I am going back over 50 years now.

I loved working in the the days when everything functioned at the speed of my brain, i.e. very slowly!

[simondavies3Participant @simondavies3]

Mildly off from the original topic (but, hey, it’s the forum….), I worked for a company selling indoor payphones in the 1990s.

These used a series of ramps that the coins ran down at a known velocity taking them past 2 or 3 coils, thus generating a repeatable signature depending on the metallurgical make up of the coin. Once a sample of a few hundred coins had been tested, the thresholds for each coin value were defined and the payphones shipped where they ended up in bars and hotels primarily.

However we shipped some 20,000 units to Spain and suddenly started to get feedback that a rather smaller coin was being mis read for the high value 2 Peseta – to the extent that some machines were stuffed full of the low value coins and the ultimate telephone bill ran into the thousands….
Turned out that some “ladies of the night” were passing the time between clients by getting a biiiig bag of the low value coins from the bank and putting them through the payphones which instantly displayed the coin value on the screen and then the coin reject button was pressed. Every coin that showed a 2 Peseta value was placed in a different pile…and were subsequently sold on as “international calling tokens”….

We had no small effort involved to update the payphones in the field to eliminate the issue.

[Roger HartParticipant @rogerhart88496]

There still exists a magazine 2600: The Hacker Quarterly. Started just as 2600 then back in the ’80s added Hacker. All sorts of fun and games with phones and the old bulletin boards and dial up modems. Then folk started to get niggly about it.

Touched on computer security back then and decided it was too dangerous a game, a house built on sand surrounded by wolves. For those with a taste for that world try Bruce Schneier’s blog Schneier on Security. The latest tells us that Tetra encryption was back doored long long ago. No surprise.

Who says engineers have no sense of humour, the old STD box C&FC relay set had a lot of relays etc. One marked CRIG for CRxP In The Gap – noise in the coin signalling to mask switch pulse and TBF for Too Bloxdy Fast in case the coin pulses were speeded up. Fairly easily defeated using a 2Bob bit and a length of plastic wire. Another system in another industry had a very long very fat cable known for some reason as the HC, can’t think why…

[Author]

Posts