Initial commit

phreak/verify.asc

@@ -0,0 +1,97 @@
+␍
+                                 Verification␍
+                               By Fred Steinbeck␍
+␍
+From TAP issue # 88  10-83␍
+␍
+   There has been a great deal of controversy in the realm of phreakdom over a␍
+mysterious subject known under a number of different names, including␍
+"Verification", "Autoverification", "Verify", "Autoverify", "Verify Busy", and␍
+even "VFY BY".  All of these names basically mean the same thing: the ability␍
+to listen to another person's telephone line from any telephone in the␍
+direct-dialable world.␍
+   Needless to say, Bell System is very tight lipped about knowledge regarding␍
+verification.  Indeed, the infamous book 'Notes on long distance dialing' ('68␍
+edition) says, "Care must be taken to insure that the customer never gains␍
+verification capabilities."  With a printed policy like that, you can imagine␍
+what their real-world policy is like!  Even their own rate and route operators␍
+will not give verification on routing codes (at least in my experience), one␍
+even responding, "What?! You must be crazy! We don't give those out!" Before␍
+you get too far into this article, I will state simply: I don't know how to␍
+verify. However, I have been fooling with various things related to it, and␍
+collecting information on it for some time now. Therefore, while I can't do it␍
+(yet), I may be able to point some other bright TAPer on the right track, and␍
+perhaps he or she will show us all how.  If you have knowledge not covered in␍
+this article, but don't want to write an article on your own, please send your␍
+ideas, comments, or information to Project Verify, C/O TAP   Verify has also␍
+been called "Autoverify", and I have no idea why.  This is not, to my␍
+knowledge, a Bell System term (at least I've never seen it in any manuals)  As␍
+far as I know, there is verify, which means being able to listen to speech␍
+(kind of; see below) on a line, and there is the "Emergency Interrupt which␍
+allows you to take part in the conversation taking place on the line in␍
+question.  It has been suggested that "Autoverify" is the same as an emergency␍
+interrupt , but I tend to disagree with this idea.  It should be noted that the␍
+verification circuitry does not actually let an operator listen to a␍
+conversation without making a beep on the line every so often.  Instead, she␍
+will hear encrypted speech.  However, I believe with the proper methods, verify␍
+can be converted to an emergency interrupt.␍
+   Verification is normally done either by your normal "0" (TSPS) operator, if␍
+the call is in your home NPA (HNPA), or by an inward operator (IO).  If the␍
+call is outside your HNPA, your normal operator will call the IO for the␍
+NPA,and say, "Verify Busy" or "Emergency Interrupt" please, 555 1212."  The IO␍
+will perform whatever magic he or she must, and then report back.  If the call␍
+is in your HNPA, though, the "0" operator can do the verification herself by␍
+using the "VFY BY" key on her keyshelf.  However, in some areas, the operator␍
+uses a routing code to accomplish verification, and this the is loop hole we␍
+shall attack.␍
+  It follows that if a IO or "0" operator can do it, so can we, with a blue box␍
+Now, courtesy of Robert Allen (who brought it to my attention) and Susan␍
+Thunder (who apparently discovered it), here is what used to work for getting␍
+operators to hook you into conversations with other people (i.e.,let you listen␍
+to them till you hung up): You'd call the operator and say "Operator, TSPS␍
+Maintenance Engineer Calling.  Ring forward to 001 + NPA + 7d, ring back to my␍
+number, hit ring forward, no AMA, and then position release.␍
+   This creates some problems, and you must be familiar with the TSPS␍
+console(by dialing "0"), you are on the "back", or incoming part of a loop.␍
+When she places a call for you, the call goes out on the "forward", or outgoing␍
+part of the loop.  If an operator wants to make a call, she punches KP FWD␍
+(keypulse forward), the number, and ST. Ring FWD puts a 90 volt ringing signal␍
+across the forward part of the line (and may dial the number as well).  The␍
+problem arises from the fact that I don't know if Ring FWD will actually dial a␍
+call, and if there is some other subtle difference between it an KP FWD.␍
+   Let us assume ringing forward makes a call from the TSPS console to whatever␍
+number is given.  Ring back causes your phone to ring (it is assumed you hung␍
+up after giving her your instructions; if you didn't you'd hear an annoying 90␍
+volts across the earpiece...) "No AMA" means "no automatic message accounting",␍
+so nobody gets billed for the call, although it will show up on a tape␍
+somewhere.  "Position Release" removes the operator from the circuit, and␍
+allows her to receive other calls.  This leaves an unaccounted-for ring␍
+forward.␍
+   The verification circuit, as you know, likes to encrypt conversation, which␍
+is something we don't want.  Well, the second Ring FWD sends another  90 volts␍
+crashing against the verify circuitry, which Juda Gerad thinks removes the␍
+voice encryption from the line, puts the operator (and you) in circuit, and␍
+puts a beep tone on the line every five seconds.  This seems to make sense, and␍
+I am inclined to agree with him.␍
+   The bit about "....001 + NPA + 7D" causes the thought "MF routing code" to␍
+spring immediately to mind.  Now, the above trick was supposed to work in the␍
+213 NPA.  I have tried both "KP+001+213+7D+ST", and some other area codes.  I␍
+generally get nothing, a reorder signal, or a tandem recording.␍
+   Here's some food for thought: On an official Telco sheet I have, labeled "␍
+213 NPA MF Routing Codes", 001 is listed as "VFY BY", or verify busy for the␍
+213 NPA.  002 is listed for the 805 NPA.  Ma Bell likes to have standardized␍
+routing codes, such logical, then, that 001 would be a sort of "standard"␍
+verify code, and other prefixes would be tacked on at 002,003, etc. However, I␍
+have heard from a retired operator that verification codes are different from␍
+area to area, and are not always nice numbers like 001, 002.  Ah, well, a guy␍
+can hope, can't he?␍
+   Some suggestions for future attacks on this dilemma: Everyone call your␍
+operators and subtly ask questions.  I have found the tend to give information␍
+out easier if you ask for something that you would ordinarily have to be a␍
+company employee to know about, such as rate steps, operator routings, etc.␍
+    Casually let slip that you used to be (or still are) an operator, or that␍
+you work for company security.  Also, you might want to blue box some codes␍
+like 001 followed by your NPA and the last 7D of a busy number.  If you get a␍
+sort of "whispery noise", try blasting the line with a ringing signal (you␍
+might piggyback another line onto yours and call the piggyback to generate the␍
+90 volts) and see if that does anything.␍