Security Breach #3
Summer 1998
Editor in chief: Maniac
Contributors: Harvester of Souls
Editor's note:
This issue marks the first time I've had any help writing this.
Security Breach has a new writer on board, namely Harvester of Souls.
He came up with some interesting frequency stuff for this issue, which
I hope proves useful to people in some way or another.
I'm also looking for contributions from anybody who has anything to
write about(except lame stuff and redboxing articles)NO GODDAMN REDBOXING
ARTICLES!...okay, I'll stop ranting now..
Anyways, this issue we start a new series of articles on various
types of cans. I hope to cover at least one type of can per issue,
and I'm going to try to go into as much depth and detail as possible.
Shout-outs to the following people:
Mohawk, Mr. Seuss, Slapayoda, Phen0m, Hatredonalog, anybody who
carries SB on their website, The more knowledgeable people in
alt.phreaking, Matty Acid for hooking me up with the DS-1 tutorial,
Plik, StikSickly, #peng crew, esp. squirrel and the other conf
regulars..Hell Atlantic (for providing me with a phone system to
play with), and of course Mailboxes Etc. for making shipping a PBX
a couple thousand miles much less of a pain in the ass...Greets also
to anyone I forgot..
CONTENTS:
1.Motorola Micro Tac -Harvester of Souls
2.The Finer Points of Canning, Vol.1 -Maniac
3.Line Recording Indicator -Harvester of Souls
4.Radio Frequencies -Harvester of Souls
5.Tip of the Month -Maniac
6.Maniac's Guide to Lock-picking and Forced Entry -Maniac
Motorola Micro TacBy (Harvester Of Souls)
This article is about the Motorola Micro Tac flip fones.
This may vary from fone to fone.
Here are the basics you need to know to begin.
To look at the system ID, fone #, & station class marks
and much more, do the following.
1) Turn power ON.
2) Immediately press FCN, 0.
3) Type the Security Code. (Factory standard is 000000).
4) Scroll through the options with the * key.
5) Only make changes that are accurate!
-----------------------------------------------------
To put the phone into test mode do the following:
Disconnect any & all power from the phone.
There will be 3 contact leads on the back of the phone.
Short the middle pin to ground. The ground is usually
the contact lead to the right of it. (Test with a
DMM to be sure). DMM - Digital Multi Meter.
When you apply power, you will find that the screen is
flashing hexadecimal numbers. Press the # key.
The display should show US '
IF it just shows a ' and not us ' don't worry.
From either of those points you may type in commands
to the phone.
To listen in on a conversation:
Type 11xxx, # xxx = Channel number.
NOTE: This is illegal & I don't recommend this since they
have triangulation methods. You have been warned!
The channels that I have listen to are anywhere from
112 to 999. I believe the phone will go up to channel 9999.
You may not be able to do anything, but I personally think
that it has the capabilities to do so.
I found that the most popular channels around
the suburban Boston area and up to Boston also
are these:
112
298
299
300
301
999
This may not be true for all areas. Just scan the channels
& see what you find. :)
The Finer Points of Canning (Volume 1)
***This is the first of a series of articles devoted to the
purposes and contents of various types of cans. There will be
plenty more written about other types of cans, but I've decided
to only do one for this issue, as it's long overdue***
-Maniac
It would probably be safe to assume that any phreak worth
their salt has opened plenty of cans in their career. Cans come
in many different shapes and sizes(and even colors), and contain
all sorts of interesting stuff....and it's not all just wires.
The most basic can is the TNI, which stands for Telephone
Network Interface. Also known as the SNI, as well as several other
names, it serves a the point where the telco wiring ends and the
customer wiring begins. This is technically known as the point of
demarcation. These boxes can be found on any home or business which
has above ground telephone service. The contents of these boxes
varies somewhat, depending on the exact model of TNI. They're all
pretty similar, though, generally speaking.
My TNI is a Nynex model that dates back about 3 years.
It's about 6 or 8 inches square with a two-section door to provide
different levels of access. The outer section of the door is marked
"customer access" and opens with a flathead screwdriver. It provides
access to the RJ-11 jack that connects the telco wiring to the
customer wiring. This is a convenient place to beige box from,
since any normal phone can connect to an RJ-11 jack. However, to
do this, you must unplug the customer wiring from the jack, which
renders the phones in the building useless. People might notice
this, but this is an easy problem to fix. Simply buy (or steal) a
dual male to single male RJ-11 adapter. This has two female RJ-11
connectors on one side and a single male RJ-11 on the other side.
You can buy/steal this at Radio Shit..er..Shack. To use it requires
little intelligence and absolutely no instructions, however, for
those who are REALLY new to the field, plug it into the jack in
the TNI(after unplugging the customer wiring) and plug both your
phone and the customer wiring into it. Now you can connect with
out disabling the phones in the building.
Under the customer access door, there's another door
marked "telco access". It gives access to the entire contents of
the TNI. This door opens with a 3/8 inch nutdriver/socket wrench/etc...
The customer access door is just a part of the telco access door. It's
screwed down onto the telco access door, not the box itself, so
when the telco access door is opened, the customer access door goes
with it.
The best tool for opening this and many other cans is the
can wrench sold by Harris-Dracon. It is double ended, with 3/8 on
one end and 7/16 on the other. They also manufacture security bit
inserts in 5/32 and 5/16 sizes. The use for these will be discussed
much later.
Underneath the telco access door, things get a bit
more interesting. There are 5 large bolt terminals, each with
a number of wires and washers on them, which are tightened down
with a 3/8 nut. The terminals are arranged as a square, with a
bolt at each corner, with the fifth bolt in the center. These
terminals are where the drop line from the pole interfaces with
the wires leading the RJ-11 jack the customer wiring plugs into.
The drop line is a 2 pair cable that could easily be mistaken for
a power line of some sort. The pairs are laid out as follows:
Pair one: Orange/Orange-White. Pair two: Blue/Blue-White.
(I have two lines)..Pair one connects to the upper post,
and pair two connects to the lower pair of posts.
The last piece of the TNI is a small rectangular
circuit board, about 1 3/4 inches by 3/4 of an inch. It has
color coded leads with spade lugs for tip and ring, with 4
components in series between tip and ring. The board is wired
across the bolt terminals for tip and ring, so it is in parallel
with the customer wiring. The components are arranged as follows.
(yes, I know ASCII art sucks, but try to bear with me)
TIP----cathode|<|anode(1N5229)---47pf---anode|>|cathode
(1N5229)---10k 1/2 watt resistor---RING
Here's what's going on: The 10k 1/2 watt resistor is for
current limiting, so the diodes don't get fried during ringing
pulses. The diodes are arranged so that the anodes are pointing
towards each other. The important thing about the diodes is that
1N5229 is a 4.3 volt zener diodes. The way they are wired, one of
them will be reverse biased at all times, no matter which way the
polarity of the voltage is oriented. A zener diode, when reverse
biased, will block current from passing through it just like any
other rectifier diode, UNTIL the voltage reaches the breakdown
voltage of the zener diode, which in this case is 4.3 volts. Once
that voltage is reached, the diode will limit the voltage going
through it to 4.3 volts, even if the reverse biased voltage goes
higher than that.
The capacitor in the middle is to isolate the two zener
diodes from each other. The capacitor will not allow voltage to
pass through it under any circumstances, except for a small
leakage voltage(no dielectric is perfect)
As far as I can tell, this circuit board serves as overvoltage
protection for the phones attached to the customer wiring. Since
the circuit is in parallel with the customer wiring, the whole
thing acts as a voltage divider, and the zener diodes help to
regulate the voltage.
Note: I may be wrong about the purpose of the board, but
this seems to be what it's doing , to the best of my knowledge.
Line Recording Indicator
By (Harvester OF Souls)
This is for a telephone-to-recorder.
NOTE: Listening in is illegal unless authorized by at least one
party on the phone line.
Equipment: Soldering iron, solder, electrical tape or heat shrink.
Needs: Double Female RJ-11 Plug adapter, 1 LED, 1 SPDT switch,
1 Stereo plug.
Instructions:
Open up the RJ-11 plug & cut the YELLOW & BLACK wires in the CENTER.
If there isn't a yellow wire, cut the white. Twist the two wires
together on each end & solder them together. now tape up the exposed
wires with electrical tape, or use heat shrink.
Cut the RED & GREEN wires directly in the center. Solder 1 red
lead of the wire to 1 lead on the switch. on the lead furthest away
from the red, solder one lead of the LED on it. Take the stereo plug
& solder 1 lead to the lead on the LED that is left. Now solder the
second pole of the stereo plug to the green wire.
USAGE:
When the switch is flipped, & the plug is attached, the LED will light
up. That means that it is in use. (Recording or listening). When the
plug is in and the LED is OFF, then the device is off. Plug it into a
recorder & next time someone is on the phone, hit record & flip the
switch.
Happy listening! :)
Harvester Of Souls
_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
Radio Frequencies
By Harvester Of Souls
Major 2 Way Radio Bands
-----------------------
Medium Frequency (mf) 1.6 - 25 MHz
High Frequency (hf) 25- 30 MHz
Very High Frequency (vhf1) 108 - 136 MHz
Very High Frequency (vhf2) 150 - 174 MHz
Ultrahigh Frequency (uhf1) 450 - 512 MHz
Ultrahigh Frequency (uhf2) 806 - 821 MHz
Ultrahigh Frequency (uhf3) 851 - 866 MHz
----------------------
HF Inter-ship Frequencies
Frequency (kHz) Geographic Area
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ ¯¯¯¯¯¯¯¯¯¯¯¯¯
2003 Great Lakes only.
2082.5 All areas.
2142 Pacific coast area south of latitude 42°
(degrees) north, on a day only basis.
2203 Gulf of Mexico.
2638 All areas.
2670 All areas.
2738 All areas except Great Lakes and the Gulf
of Mexico.
2830 Gulf of Mexico only.
-----------------------------------------------------------------------
VHF - FM Channel Designation
Channel Type
------- ----
16 (Mandatory) Distress, Safety, calling.
06 (Mandatory) Inter-ship Safety.
65, 66, 12, 73, 14, 74, 20 Port Operations
13 Navigational
22 Liaison Communications only.
07, -9, 10, 11, 18, 19, 79, 80 Commercial
67, 08, 77 , 88 Commercial - Inter-ship
70, 72 Non - Commercial
24, 84, 25, 85, 26, 86, 27, 87, 28, 88 Public Correspondence.
162.4MHz & 162.55MHz NOAA Weather Service.
----------------------------------------------
Citizen's Band Radio (CB)
Note: all frequencies are in AM (Amplitude Modulation).
Channels marked with an 'a' are illegal channels that
can be used with a simple CB modification to the
RF tuner.
Channel # Freq.
--------- -----
1 26.965
2 26.975
3 26.985
3A 26.995
4 27.005
5 27.015
6 27.025
7 27.035
7A 27.045
8 27.055
9 27.065 (Emergency & road assistance)
10 27.075
11 27.085
11A 27.095
12 27.105
13 27.115
14 27.125
15 27.135
15A 27.145
16 27.155
17 27.165
18 27.175
19 27.185
19A 27.195
20 27.205
21 27.215
22 27.225
23 27.235
24 27.245
25 27.255
26 27.265
27 27.275
28 27.285
29 27.295
30 27.305
31 27.315
32 27.325
33 27.335
34 27.345
35 27.355
36 27.365
37 27.375
38 27.385
39 27.395
40 27.405
------------------------------
Other Frequencies
VLF (very low frequency) below 30 kHz
LF (low Frequency) 30 to 300 kHz
MF (medium Frequency) 300 to 3000 kHz
HF (high frequency) 3000 to 30,000 kHz
VHF (very high frequency) 30,000 kHz to 300 MHz
SHF (super high frequency) 3000 to 30,000 MHz
EHF (extremely high frequency) 30,000 to 300,000 MHz
------------------------------
***Tip of the month(or whatever the fuck)***
When running two lines over 4 conductor cable that isn't
twisted pair, watch out for crosstalk. I did this a while back, and
it works just fine electrically of course, but the crosstalk is a pain.
Note: this could also be used to listen in on conversations,
and is almost undetectable, since inductive coupling will not
produce an appreciable voltage drop in a phone line...You'd
probably do well to get a ferrite rod from an radio tuning circuit
and wind both pairs around it for better coupling.
Maniac's Guide to Lockpicking and Forced Entry
By: Maniac (who else?)
Preface
Much of the stuff in here is knowledge I absorbed from
documents like The MIT Guide to Lockpicking and Jolly Roger's
lockpicking file. Of course, a lot of it is random stuff I've
figured out of learned from various people over the years. I'm not
trying to rip off anybody's work here. Thanx to people who had a
hand in writing all the files I've learned stuff from. Thanx to
Rat for the dent puller idea.
First, I'll address lockpicking. Picking a conventional lock
usually involves applying torque to the lock cylinder while
manipulating the pins with a pick. The goal is to push up each
pin so that the split between each pin and the driver pin above
it is lined up with the edge of the cylinder, and make it stick
in that position. This is known as setting the pins. You must
apply torque to the cylinder in order to set the pins and keep
them set. Once all the pins are set, the cylinder will rotate and
the lock will open.
Some locks have pins on both sides of the keyway
(keyhole). There are a couple of varieties of this type of
lock. The high-security version has a larger number of pins
(like 5 or 6) on each side of the keyway. It is frequently used
on auto ignitions. The lower-security version is used in less
critical applications. It has fewer pins (typically 3 or 4 pins)
than the high security version. This type of lock is often
used for turning vending machines on and off, securing glass
cases in retail stores, and on most garden-variety display cases.
Now that we've covered the basics of picking and some
common types of locks, let's concentrate on opening the suckers,
since that's what everyone wants to do..
Locks can be picked using a torque wrench and a thin
steel pick with a triangular or rounded end...however, picking a
decent lock takes time, even when done by someone who knows
what they're doing. Sure, you've seen locks opened in seconds
in the movies, but in real life it doesn't tend to work that
way. That's why we have forced entry, which works on the
principle of "screw picking it, just break the fu#*ing thing"
To break into things, you need some tools. A good
swift kick and some bodyweight can often be a useful tool.
I also recommend the following stuff. You don't need it all
at once, but it's good to have around.
Bolt cutters
18" are very portable and good for getting through fences
30" are good for bigger stuff, especially cutting
locks on dumpsters when dumpster diving
Crowbars
Great for Jimmying doors and cabinets
Short ones for little stuff
Long ones for heavy duty stuff
Hacksaw
Lots of uses
Screwdrivers
Pliers
Slide Hammer(dent puller)
Screw it into lock cylinders, then bam! Rips em out when you
throw the slide(supposedly) I've never tried it before, so I
don't know for sure, but it might work.
Hammers
Chisels
Wrenches
Tamper-Torx bits for removing security screws
Tamper hex (a must for stealing payphones without making a mess)
Allen Wrenches
Whatever other hand tools you might need to take something apart
Parting Words
I'm sure I a lot of you though Security Breach was no longer
around, since it's been so long since the last issue. I hope
this issue dispels that notion...We're still here. I've just
been busy, that's all. Hopefully issue 4 will come out in a more
timely fashion.
Well, anyways....until next time , keep exploring and
exploiting...And remember, say YES to software reverse
engineering. The legislators can shove that bill where it
fucking belongs...
~~Maniac
