n observer is the emission of digital pulses (1s and 0s) as these are used in computers. The channel for this radiation is in two arrangements, radiated emissions and conducted emissions. Radiated emissions are assembled when components in electrical devices form to act as antennas. Conducted emissions are formed when radiation is conducted along cables and wires. Although most of the time these emissions are simply annoyances, they can sometimes be very helpful. Suppose we wanted to see what project a target was working on. We could sit in a van outside her office and use sensitive electronic equipment to attempt to pick up and decipher the radiated emissions from her video monitor. These emissions normally exist at around 55-245 Mhz and can be picked up as far as one kilometer away. A monitoring device can distinguish between different sources emitting radiation because the sources emanating the radiation are made up of dissimilar elements and so this coupled with other factors varies the emitted frequency. For example different electronic components in VDUs, different manufacturing processes involved in reproducing the VDUs, different line syncs, etc... By synchronizing our raster with the targets raster we can passively draw the observed screen in real-time. This technology can be acquired by anyone, not just government agencies. The target could shield the emissions from her equipment or use equipment that does not generate strong emissions. However, Tempest equipment is not legal for civilian use in the United States. Tempest is the US Government program for evaluation and endorsement of electronic equipment that is safe from eavesdropping. Tempest certification refers to the equipment having passed a testing phase and agreeing to emanations rules specified in the government document NACSIM 5100A (Classified). This document sets forth the emanation levels that the US Government believes equipment can give off without compromising the information it is processing. 31. What is an anonymous remailer? This FAQ answer was written by Raph Levien: An anonymous remailer is a system on the Internet that allows you to send e-mail or post messages to Usenet anonymously. There are two sorts of remailers in widespread use. The first is the anon.penet.fi style, the second is the cypherpunk style. The remailer at anon.penet.fi is immensely popular, with over 160,000 users over its lifetime, and probably tens of thousands of messages per day. Its main advantage is that it's so easy to use. The cypherpunks mailers, which provide much better security, are becoming more popular, however, as there is more awareness of them. The user of the anon.penet.fi system first needs to get an anonymous id. This is done either by sending mail to somebody who already has one (for example, by replying to a post on Usenet), or sending mail to ping@anon.penet.fi. In either case, penet will mail back the new anon id, which looks like an123456@anon.penet.fi. If an123456 then sends mail to another user of the system, then this is what happens: 1. The mail is transported to anon.penet.fi, which resides somewhere in the vicinity of Espoo, Finland. 2. These steps are carried out by software running on anon.penet.fi. Penet first looks up the email address of the sender in its database, then replaces it with the numeric code. All other information about the sender is removed. 3. Then, penet looks up the number of the recipient in the same database, and replaces it with the actual email address. 4. Finally, it sends the mail to the actual email address of the recipient. There are variations on this scheme, such as posting to Usenet (in which step 3 is eliminated), but that's the basic idea. Where anon.penet.fi uses a secret database to match anon id's to actual email addresses, the cypherpunks remailers use cryptography to hide the actual identities. Let's say I want to send email to a real email address, or post it to Usenet, but keep my identity completely hidden. To send it through one remailer, this is what happens. 1. I encrypt the message and the recipient's address, using the public key of the remailer of my choice. 2. I send the email to the remailer. 3. When the remailer gets the mail, it decrypts it using its private key, revealing as plaintext the message and the recipient's address. 4. All information about the sender is removed. 5. Finally, it sends it to the recipient's email address. If one trusts the remailer operator, this is good enough. However, the whole point of the cypherpunks remailers is that you don't _have_ to trust any one individual or system. So, people who want real security use a chain of remailers. If any one remailer on the "chain" is honest, then the privacy of the message is assured. To use a chain of remailers, I first have to prepare the message, which is nestled within multiple layers of encryption, like a Russian matryoshka doll. Preparing such a message is tedious and error prone, so many people use an automated tool such as my premail package. Anyway, after preparing the message, it is sent to the first remailer in the chain, which corresponds to the outermost layer of encryption. Each remailer strips off one layer of encryption and sends the message to the next, until it reaches the final remailer. At this point, only the innermost layer of encryption remains. This layer is stripped off, revealing the plaintext message and recipient for the first time. At this point, the message is sent to its actual recipient. Remailers exist in many locations. A typical message might go through Canada, Holland, Berkeley, and Finland before ending up at its final location. Aside from the difficulty of preparing all the encrypted messages, another drawback of the cypherpunk remailers is that they don't easily allow responses to anonymous mail. All information about the sender is stripped away, including any kind of return address. However the new alias servers promise to change that. To use an alias server, one creates a new email address (mine is raph@alpha.c2.org). Mail sent to this new address will be untraceably forwarded to one's real address. To set this up, one first encrypts one's own email address with multiple layers of encryption. Then, using an encrypted channel, one sends the encrypted address to the alias server, along with the nickname that one would like. The alias server registers the encrypted address in the database. The alias server then handles reply mail in much the same way as anon.penet.fi, except that the mail is forwarded to the chain of anonymous remailers. For maximum security, the user can arrange it so that, at each link in the chain, the remailer adds another layer of encryption to the message while removing one layer from the email address. When the user finally gets the email, it is encrypted in multiple layers. The matryoshka has to be opened one doll at a time until the plaintext message hidden inside is revealed. One other point is that the remailers must be reliable in order for all this to work. This is especially true when a chain of remailers is used -- if any one of the remailers is not working, then the message will be dropped. This is why I maintain a list of reliable remailers. By choosing reliable remailers to start with, there is a good chance the message will finally get there. 32. What are the addresses of some anonymous remailers? The most popular and stable anonymous remailer is anon.penet.fi, operated by Johan Helsingus. To obtain an anonymous ID, mail ping@anon.penet.fi. The server at anon.penet.fi does it's best to remove any headers or other information describing its true origin. You should make an effort and try to omit information detailing your identity within such messages as quite often signatures not starting with "--" are including within your e-mail, this of course is not what you want. You can send messages to: anXXX@anon.penet.fi Here you are addressing another anonymous user and your E-Mail message will appear to have originated from anon.penet.fi. alt.security@anon.penet.fi Here you are posting an anonymous message to a whole Usenet group and in this case to alt.security which will be posted at the local site (in this case Finland). ping@anon.penet.fi If you send a message to this address you will be allocated an identity (assuming you don't already have one). You can also confirm your identity here as well. You can also set yourself a password, this password helps to authenticate any messages that you may send. This password is included in your outgoing messages, to set a password send E-Mail to password@anon.penet.fi with your password in the body of your text e.g.: To: password@anon.penet.fi Subject: TN0_rUlEz For more information on this anonymous server send mail to: help@anon.penet.fi Anonymous Usenet posting is frowned upon by other users of Usenet groups claiming their opinions are worthless. This is because they believe anonymity is used to shield ones self from attacks from opponents, while on the other hand it can be used to protect ones self from social prejudice (or people reporting ones opinions to ones superiors). Also if you are thinking this is a useful tool to use to hid against the authorities then think again, as there was a famous case where a Judge ordered the administrator of the server to reveal the identity of a poster. To see a comprehensive list on anonymous remailers finger remailer-list@kiwi.cs.berkeley.edu or point your web browser to http://www.cs.berkeley.edu/~raph/remailer-list.html. 33. How do I defeat Copy Protection? There are two common methods of defeating copy protection. The first is to use a program that removes copy protection. Popular programs that do this are CopyIIPC from Central Point Software and CopyWrite from Quaid Software. The second method involves patching the copy protected program. For popular software, you may be able to locate a ready made patch. You can them apply the patch using any hex editor, such as debug or the Peter Norton's DiskEdit. If you cannot, you must patch the software yourself. Writing a patch requires a debugger, such as Soft-Ice or Sourcer. It also requires some knowledge of assembly language. Load the protected program under the debugger and watch for it to check the protection mechanism. When it does, change that portion of the code. The code can be changed from JE (Jump on Equal) or JNE (Jump On Not Equal) to JMP (Jump Unconditionally). Or the code may simply be replaced with NOP (No Operation) instructions. 34. What is 127.0.0.1? 127.0.0.1 is a loopback network connection. If you telnet, ftp, etc... to it you are connected to your own machine. 35. How do I post to a moderated newsgroup? Usenet messages consist of message headers and message bodies. The message header tells the news software how to process the message. Headers can be divided into two types, required and optional. Required headers are ones like "From" and "Newsgroups." Without the required headers, your message will not be posted properly. One of the optional headers is the "Approved" header. To post to a moderated newsgroup, simply add an Approved header line to your message header. The header line should contain the newsgroup moderators e-mail address. To see the correct format for your target newsgroup, save a message from the newsgroup and then look at it using any text editor. A "Approved" header line should look like this: Approved: will@gnu.ai.mit.edu There cannot not be a blank line in the message header. A blank line will cause any portion of the header after the blank line to be interpreted as part of the message body. For more information, read RFC 1036: Standard for Interchange of USENET messages. 36. How do I post to Usenet via e-mail? Through an e-mail->Usenet gateway. Send an a e-mail messages to <newsgroup>@<servername>. For example, to post to alt.2600 through nic.funet.fi, address your mail to alt.2600@nic.funet.fi. Here are a few e-mail->Usenet gateways: group.name@news.demon.co.uk group.name@charm.magnus.acs.ohio-state.edu group.name@undergrad.math.uwaterloo.ca group.name@nic.funet.fi group.name.usenet@decwrl.dec.com 37. How do I defeat a BIOS password? This depends on what BIOS the machine has. Common BIOS's include AMI, Award, IBM and Phoenix. Numerous other BIOS's do exist, but these are the most common. Some BIOS's allow you to require a password be entered before the system will boot. Some BIOS's allow you to require a password to be entered before the BIOS setup may be accessed. Every BIOS must store this password information somewhere. If you are able to access the machine after it has been booted successfully, you may be able to view the password. You must know the memory address where the password is stored, and the format in which the password is stored. Or, you must have a program that knows these things. The most common BIOS password attack programs are for Ami BIOS. Some password attack programs will return the AMI BIOS password in plain text, some will return it in ASCII codes, some will return it in scan codes. This appears to be dependent not just on the password attacker, but also on the version of Ami BIOS. To obtain Ami BIOS password attackers, ftp to oak.oakland.edu /simtel/msdos/sysutil/. If you cannot access the machine after if has been powered up, it is still possible to get past the password. The password is stored in CMOS memory that is maintained while the PC is powered off by a small battery, which is attached to the motherboard. If you remove this battery, all CMOS information will be lost. You will need to re-enter the correct CMOS setup information to use the machine. The machines owner or user will most likely be alarmed when it is discovered that the BIOS password has been deleted. On some motherboards, the battery is soldered to the motherboard, making it difficult to remove. If this is the case, you have another alternative. Somewhere on the motherboard you should find a jumper that will clear the BIOS password. If you have the motherboard documentation, you will know where that jumper is. If not, the jumper may be labeled on the motherboard. If you are not fortunate enough for either of these to be the case, you may be able to guess which jumper is the correct jumper. This jumper is usually standing alone near the battery. 38. What is the password for <encrypted file>? This FAQ answer was written by crypt <crypt@nyongwa.montreal.qc.ca> Magazine Password ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~ VLAD Magazine Issue #1 vlad VLAD Magazine Issue #2 vx VLAD Magazine Issue #3 virus NuKE InfoJournal Issue #2 514738 NuKE InfoJournal Issue #3 power NuKE InfoJournal Issue #4 party Program ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~ Sphere Hacker 1.40 & 1.41 theozone Virus Creation 2000 high level Virus Construction Lab Chiba City Ejecutor Virus Creator EJECUTOR Biological Warfare v0.90 lo tek Biological Warfare v1.00 freak 39. Is there any hope of a decompiler that would convert an executable program into C/C++ code? This FAQ answer is an excerpt from SNIPPETS by Bob Stout. Don't hold your breath. Think about it... For a decompiler to work properly, either 1) every compiler would have to generate substantially identical code, even with full optimization turned on, or 2) it would have to recognize the individual output of every compiler's code generator. If the first case were to be correct, there would be no more need for compiler benchmarks since every one would work the same. For the second case to be true would require in immensely complex program that had to change with every new compiler release. OK, so what about specific decompilers for specific compilers - say a decompiler designed to only work on code generated by, say, BC++ 4.5? This gets us right back to the optimization issue. Code written for clarity and understandability is often inefficient. Code written for maximum performance (speed or size) is often cryptic (at best!) Add to this the fact that all modern compilers have a multitude of optimization switches to control which optimization techniques to enable and which to avoid. The bottom line is that, for a reasonably large, complex source module, you can get the compiler to produce a number of different object modules simply by changing your optimization switches, so your decompiler will also have to be a deoptimizer which can automagically recognize which optimization strategies were enabled at compile time. OK, let's simplify further and specify that you only want to support one specific compiler and you want to decompile to the most logical source code without trying to interpret the optimization. What then? A good optimizer can and will substantially rewrite the internals of your code, so what you get out of your decompiler will be, not only cryptic, but in many cases, riddled with goto statements and other no-no's of good coding practice. At this point, you have decompiled source, but what good is it? Also note carefully my reference to source modules. One characteristic of C is that it becomes largely unreadable unless broken into easily maintainable source modules (.C files). How will the decompiler deal with that? It could either try to decompile the whole program into some mammoth main() function, losing all modularity, or it could try to place each called function into its own file. The first way would generate unusable chaos and the second would run into problems where the original source hade files with multiple functions using static data and/or one or more functions calling one or more static functions. A decompiler could make static data and/or functions global but only at the expense or readability (which would already be unacceptable). Finally, remember that commercial applications often code the most difficult or time-critical functions in assembler which could prove almost impossible to decompile into a C equivalent. Like I said, don't hold your breath. As technology improves to where decompilers may become more feasible, optimizers and languages (C++, for example, would be a significantly tougher language to decompile than C) also conspire to make them less likely. For years Unix applications have been distributed in shrouded source form (machine but not human readable -- all comments and whitespace removed, variables names all in the form OOIIOIOI, etc.), which has been a quite adequate means of protecting the author's rights. It's very unlikely that decompiler output would even be as readable as shrouded source. 40. How does the MS-Windows password encryption work? This FAQ answer was written by Wayne Hoxsie <hoxsiew@crl.com> The password option in MS Win 3.1 is easily defeated, but there are those of us who really want to know how MS does this. There are many reasons why knowing the actual password can be useful. Suppose a sysamin used the same password in the windows screen saver as his root account on a unix box. Anyway, I will attempt to relay what I have learned about this algorithm. I will describe the process starting after you've entered the password and hit the [OK] button. I will make the assumtion that everyone (at least those interested) know what the XOR operation is. First, the length of the password is saved. We'll call this 'len'. We will be moving characters from the entered string into another string as they are encrypted. We'll call the originally entered password 'plaintext' and the encrypted string(strings--there are two passes) 'hash1' and 'hash2.' The position in the plaintext is important during the process so we'll refer to this as 'pos.' After each step of the hashing process, the character is checked against a set of characters that windows considers 'special.' These characters are '[ ] =' and any character below ASCII 33 or above ASCII 126. I'll refer to this checking operation as 'is_ok.' All indecies are zero-based (i.e. an 8 character password is considered chars 0 to 7). Now, the first character of 'plaintext' is xor'd with 'len' then fed to 'is_ok'. if the character is not valid, it is replaced by the original character of 'plaintext' before going to the next operation. The next operation is to xor with 'pos' (this is useless for the first operation since 'len' is 0 and anything xor'd with zero is itself) then fed to 'is_ok' and replaced with the original if not valid. The final operation (per character) is to xor it with the previous character of 'plaintext'. Since there is no previous character, the fixed value, 42, is used on the first character of 'plaintext'. This is then fed to 'is_ok' and if OK, it is stored into the first position of 'hash1' This process proceeds until all characters of plaintext are exhausted. The second pass is very similar, only now, the starting point is the last character in hash1 and the results are placed into hash2 from the end to the beginning. Also, instead of using the previous character in the final xoring, the character following the current character is used. Since there is no character following the last character in hash1, the value, 42 is again used for the last character. 'hash2' is the final string and this is what windows saves in the file CONTROL.INI. To 'decrypt' the password, the above procedure is just reversed. Now, what you've all been waiting for. Here is some C code that will do the dirty work for you: #include <stdlib.h> #include <stdio.h> #include <string.h> int xor1(int i,int j) { int x; x=i^j; return (x>126||x<33||x==91||x==93||x==61)?i:x; } void main() { FILE *f; int i,l; char s[80],s1[80]; printf("Please enter the path to your Windows directory\n"); gets(s1); sprintf(s,"%s%scontrol.ini",s1,s1[strlen(s1)-1]=='\\'?"":"\\"); if((f=fopen(s,"rt"))==NULL){ printf("File Error : %s\n",sys_errlist[errno]); exit(0); } while(strnicmp(fgets(s1,70,f),"password",8)!=0&&!feof(f)); fclose(f); strtok(s1,"=\n"); strcpy(s,strtok(NULL,"\n")); i=strlen(s)-1; for(l=i;l>-1;l--) s1[l]=xor1(xor1(xor1(s[l],l==i?42:s[l+1]),l==i?0:l),i+1); for(l=0;l<i+1;l++) s[l]=xor1(xor1(xor1(s1[l],l?s1[l-1]:42),l?l:0),i+1); printf("The Password is: %s\n",s); }  * Section B: Telephony *  ~~~~~~~~~~~~~~~~~~~~ 01. What is a Red Box? When a coin is inserted into a payphone, the payphone emits a set of tones to ACTS (Automated Coin Toll System). Red boxes work by fooling ACTS into believing you have actually put money into the phone. The red box simply plays the ACTS tones into the telephone microphone. ACTS hears those tones, and allows you to place your call. The actual tones are: Nickel Signal 1700+2200hz 0.060s on Dime Signal 1700+2200hz 0.060s on, 0.060s off, twice repeating Quarter Signal 1700+2200hz 33ms on, 33ms off, 5 times repeating Canada uses a variant of ACTSD called N-ACTS. N-ACTS uses different tones than ACTS. In Canada, the tones to use are: Nickel Signal 2200hz 0.060s on Dime Signal 2200hz 0.060s on, 0.060s off, twice repeating Quarter Signal 2200hz 33ms on, 33ms off, 5 times repeating 02. How do I build a Red Box? Red boxes are commonly manufactured from modified Radio Shack tone dialers, Hallmark greeting cards, or made from scratch from readily available electronic components. To make a Red Box from a Radio Shack 43-141 or 43-146 tone dialer, open the dialer and replace the crystal with a new one. The purpose of the new crystal is to cause the * button on your tone dialer to create a 1700Mhz and 2200Mhz tone instead of the original 941Mhz and 1209Mhz tones. The exact value of the replacement crystal should be 6.466806 to create a perfect 1700Mhz tone and 6.513698 to create a perfect 2200mhz tone. A crystal close to those values will create a tone that easily falls within the loose tolerances of ACTS. The most popular choice is the 6.5536Mhz crystal, because it is the easiest to procure. The old crystal is the large shiny metal component labeled "3.579545Mhz." When you are finished replacing the crystal, program the P1 button with five *'s. That will simulate a quarter tone each time you press P1. 03. Where can I get a 6.5536Mhz crystal? Your best bet is a local electronics store. Radio Shack sells them, but they are overpriced and the store must order them in. This takes approximately two weeks. In addition, many Radio Shack employees do not know that this can be done. Or, you could order the crystal mail order. This introduces Shipping and Handling charges, which are usually much greater than the price of the crystal. It's best to get several people together to share the S&H cost. Or, buy five or six yourself and sell them later. Some of the places you can order crystals are: Digi-Key 701 Brooks Avenue South P.O. Box 677 Thief River Falls, MN 56701-0677 (800)344-4539 Part Number:X415-ND /* Note: 6.500Mhz and only .197 x .433 x .149! */ Part Number:X018-ND JDR Microdevices: 2233 Branham Lane San Jose, CA 95124 (800)538-5000 Part Number: 6.5536MHZ Tandy Express Order Marketing 401 NE 38th Street Fort Worth, TX 76106 (800)241-8742 Part Number: 10068625 Alltronics 2300 Zanker Road San Jose CA 95131 (408)943-9774 Voice (408)943-9776 Fax (408)943-0622 BBS Part Number: 92A057 Mouser (800)346-6873 Part Number: 332-1066 Blue Saguaro P.O. Box 37061 Tucson, AZ 85740 Part Number: 1458b Unicorn Electronics 10000 Canoga Ave, Unit c-2 Chatsworth, CA 91311 Phone: 1-800-824-3432 Part Number: CR6.5 04. Which payphones will a Red Box work on? Red Boxes will work on telco owned payphones, but not on COCOT's (Customer Owned Coin Operated Telephones). Red boxes work by fooling ACTS (Automated Coin Toll System) into believing you have put money into the pay phone. ACTS is the telephone company software responsible for saying "Please deposit XX cents" and listening for the coins being deposited. COCOT's do not use ACTS. On a COCOT, the pay phone itself is responsible for determining what coins have been inserted. 05. How do I make local calls with a Red Box? Payphones do not use ACTS for local calls. To use your red box for local calls, you have to fool ACTS into getting involved in the call. One way to do this, in some areas, is by dialing 10288-xxx-xxxx. This makes your call a long distance call, and brings ACTS into the picture. In other areas, you can call Directory Assistance and ask for the number of the person you are trying to reach. The operator will give you the number and then you will hear a message similar to "Your call can be completed automatically for an additional 35 cents." When this happens, you can then use ACTS tones. 06. What is a Blue Box? Blue boxes use a 2600hz tone to size control of telephone switches that use in-band signalling. The caller may then access special switch functions, with the usual purpose of making free long distance phone calls, using the tones provided by the Blue Box. 07. Do Blue Boxes still work? This FAQ answer is excerpted from a message posted to Usenet by Marauder of the Legion of Doom: Somewhere along the line I have seen reference to something similar to "Because of ESS Blue boxing is impossible". This is incorrect. When I lived in Connecticut I was able to blue box under Step by Step, #1AESS, and DMS-100. The reason is simple, even though I was initiating my call to an 800 number from a different exchange (Class 5 office, aka Central Office) in each case, when the 800 call was routed to the toll network it would route through the New Haven #5 Crossbar toll Tandem office. It just so happens that the trunks between the class 5 (CO's) and the class 4 (toll office, in this case New Haven #5 Xbar), utilized in-band (MF) signalling, so regardless of what I dialed, as long as it was an Inter-Lata call, my call would route through this particular set of trunks, and I could Blue box until I was blue in the face. The originating Central Offices switch (SXS/ESS/Etc..) had little effect on my ability to box at all. While the advent of ESS (and other electronic switches) has made the blue boxers task a bit more difficult, ESS is not the reason most of you are unable to blue box. The main culprit is the "forward audio mute" feature of CCIS (out of band signalling). Unfortunately for the boxer 99% of the Toll Completion centers communicate using CCIS links, This spells disaster for the blue boxer since most of you must dial out of your local area to find trunks that utilize MF signalling, you inevitably cross a portion of the network that is CCIS equipped, you find an exchange that you blow 2600hz at, you are rewarded with a nice "winkstart", and no matter what MF tones you send at it, you meet with a re-order. This is because as soon as you seized the trunk (your application of 2600hz), your Originating Toll Office sees this as a loss of supervision at the destination, and Mutes any further audio from being passed to the destination (ie: your waiting trunk!). You meet with a reorder because the waiting trunk never "hears" any of the MF tones you are sending, and it times out. So for the clever amongst you, you must somehow get yourself to the 1000's of trunks out there that still utilize MF signalling but bypass/disable the CCIS audio mute problem. (Hint: Take a close look at WATS extenders). 08. What is a Black Box? A Black Box is a resistor (and often capacitor in parallel) placed in series across your phone line to cause the phone company equipment to be unable to detect that you have answered your telephone. People who call you will then not be billed for the telephone call. Black boxes do not work under ESS. 09. What do all the colored boxes do? Acrylic Steal Three-Way-Calling, Call Waiting and programmable Call Forwarding on old 4-wire phone systems Aqua Drain the voltage of the FBI lock-in-trace/trap-trace Beige Lineman's hand set Black Allows the calling party to not be billed for the call placed Blast Phone microphone amplifier Blotto Supposedly shorts every phone out in the immediate area Blue Emulate a true operator by seizing a trunk with a 2600hz tone Brown Create a party line from 2 phone lines Bud Tap into your neighbors phone line Chartreuse Use the electricity from your phone line Cheese Connect two phones to create a diverter Chrome Manipulate Traffic Signals by Remote Control Clear A telephone pickup coil and a small amp used to make free calls on Fortress Phones Color Line activated telephone recorder Copper Cause crosstalk interference on an extender Crimson Hold button Dark Re-route outgoing or incoming calls to another phone Dayglo Connect to your neighbors phone line Diverter Re-route outgoing or incoming calls to another phone DLOC Create a party line from 2 phone lines Gold Dialout router Green Emulate the Coin Collect, Coin Return, and Ringback tones Infinity Remotely activated phone tap Jack Touch-Tone key pad Light In-use light Lunch AM transmitter Magenta Connect a remote phone line to another remote phone line Mauve Phone tap without cutting into a line Neon External microphone Noise Create line noise Olive External ringer Party Create a party line from 2 phone lines Pearl Tone generator Pink Create a party line from 2 phone lines Purple Telephone hold button Rainbow Kill a trace by putting 120v into the phone line (joke) Razz Tap into your neighbors phone Red Make free phone calls from pay phones by generating quarter tones Rock Add music to your phone line Scarlet Cause a neighbors phone line to have poor reception Silver Create the DTMF tones for A, B, C and D Static Keep the voltage on a phone line high Switch Add hold, indicator lights, conferencing, etc.. Tan Line activated telephone recorder Tron Reverse the phase of power to your house, causing your electric meter to run slower TV Cable "See" sound waves on your TV Urine Create a capacitative disturbance between the ring and tip wires in another's telephone headset Violet Keep a payphone from hanging up White Portable DTMF keypad Yellow Add an extension phone Box schematics may be retrieved from these FTP sites: ftp.netcom.com /pub/br/bradleym ftp.netcom.com /pub/va/vandal ftp.winternet.com /users/nitehwk 10. What is an ANAC number? An ANAC (Automatic Number Announcement Circuit) number is a telephone number that plays back the number of the telephone that called it. ANAC numbers are convenient if you want to know the telephone number of a pair of wires. 11. What is the ANAC number for my area? How to find your ANAC number: Look up your NPA (Area Code) and try the number listed for it. If that fails, try 1 plus the number listed for it. If that fails, try the common numbers like 311, 958 and 200-222-2222. If you find the ANAC number for your area, please let us know. Note that many times the ANAC number will vary for different switches in the same city. The geographic naming on the list is NOT intended to be an accurate reference for coverage patterns, it is for convenience only. Many companies operate 800 number services which will read back to you the number from which you are calling. Many of these require navigating a series of menus to get the phone number you are looking for. Please use local ANAC numbers if you can, as overuse or abuse can kill 800 ANAC numbers. N (800)425-6256 VRS Billing Systems/Integretel (800)4BLOCKME (800)568-3197 Info Access Telephone Company's Automated Blocking Line (800)692-6447 (800)MY-ANI-IS (Now protected by a passcode!) N (800)858-9857 AT&T True Rewards A non-800 ANAC that works nationwide is 404-988-9664. The one catch with this number is that it must be dialed with the AT&T Carrier Access Code 10732. Use of this number does not appear to be billed. Note: These geographic areas are for reference purposes only. ANAC numbers may vary from switch to switch within the same city. NPA ANAC number Approximate Geographic area --- --------------- --------------------------------------------- 201 958 Hackensack/Jersey City/Newark/Paterson, NJ 202 811 District of Columbia 203 970 CT 205 300-222-2222 Birmingham, AL 205 300-555-5555 Many small towns in AL 205 300-648-1111 Dora, AL 205 300-765-4321 Bessemer, AL 205 300-798-1111 Forestdale, AL 205 300-833-3333 Birmingham 205 557-2311 Birmingham, AL 205 811 Pell City/Cropwell/Lincoln, AL 205 841-1111 Tarrant, AL 205 908-222-2222 Birmingham, AL 206 411 WA (Not US West) 207 958 ME 209 830-2121 Stockton, CA 209 211-9779 Stockton, CA 210 830 Brownsville/Laredo/San Antonio, TX N 210 951 Brownsville/Laredo/San Antonio, TX (GTE) 212 958 Manhattan, NY 213 114 Los Angeles, CA (GTE) 213 1223 Los Angeles, CA (Some 1AESS switches) 213 211-2345 Los Angeles, CA (English response) 213 211-2346 Los Angeles, CA (DTMF response) 213 760-2??? Los Angeles, CA (DMS switches) 213 61056 Los Angeles, CA 214 570 Dallas, TX 214 790 Dallas, TX (GTE) 214 970-222-2222 Dallas, TX 214 970-611-1111 Dallas, TX (Southwestern Bell) 215 410-xxxx Philadelphia, PA 215 511 Philadelphia, PA 215 958 Philadelphia, PA 216 200-XXXX Akron/Canton/Cleveland/Lorain/Youngstown, OH 216 331 Akron/Canton/Cleveland/Lorain/Youngstown, OH 216 959-9892 Akron/Canton/Cleveland/Lorain/Youngstown, OH 217 200-xxx-xxxx Champaign-Urbana/Springfield, IL 219 550 Gary/Hammond/Michigan City/Southbend, IN 219 559 Gary/Hammond/Michigan City/Southbend, IN N 301 2002006969 Hagerstown/Rockville, MD 301 958-9968 Hagerstown/Rockville, MD 303 958 Aspen/Boulder/Denver/Durango/Grand Junction /Steamboat Springs, CO N 305 200-555-1212 Ft. Lauderdale/Key West/Miami, FL N 305 200200200200200 Ft. Lauderdale/Key West/Miami, FL N 305 780-2411 Ft. Lauderdale/Key West/Miami, FL 310 114 Long Beach, CA (On many GTE switches) 310 1223 Long Beach, CA (Some 1AESS switches) 310 211-2345 Long Beach, CA (English response) 310 211-2346 Long Beach, CA (DTMF response) 312 200 Chicago, IL 312 290 Chicago, IL 312 1-200-8825 Chicago, IL (Last four change rapidly) 312 1-200-555-1212 Chicago, IL 313 200-200-2002 Ann Arbor/Dearborn/Detroit, MI 313 200-222-2222 Ann Arbor/Dearborn/Detroit, MI 313 200-xxx-xxxx Ann Arbor/Dearborn/Detroit, MI 313 200200200200200 Ann Arbor/Dearborn/Detroit, MI 314 410-xxxx# Columbia/Jefferson City/St.Louis, MO 315 953 Syracuse/Utica, NY 315 958 Syracuse/Utica, NY 315 998 Syracuse/Utica, NY 317 310-222-2222 Indianapolis/Kokomo, IN 317 559-222-2222 Indianapolis/Kokomo, IN 317 743-1218 Indianapolis/Kokomo, IN 334 5572411 Montgomery, AL 334 5572311 Montgomery, AL 401 200-200-4444 RI 401 222-2222 RI 402 311 Lincoln, NE 404 311 Atlanta, GA N 770 780-2311 Atlanta, GA 404 940-xxx-xxxx Atlanta, GA 404 990 Atlanta, GA 405 890-7777777 Enid/Oklahoma City, OK 405 897 Enid/Oklahoma City, OK U 407 200-222-2222 Orlando/West Palm Beach, FL (Bell South) N 407 520-3111 Orlando/West Palm Beach, FL (United) 408 300-xxx-xxxx San Jose, CA 408 760 San Jose, CA 408 940 San Jose, CA 409 951 Beaumont/Galveston, TX 409 970-xxxx Beaumont/Galveston, TX 410 200-6969 Annapolis/Baltimore, MD N 410 200-200-6969 Annapolis/Baltimore, MD 410 200-555-1212 Annapolis/Baltimore, MD 410 811 Annapolis/Baltimore, MD 412 711-6633 Pittsburgh, PA 412 711-4411 Pittsburgh, PA 412 999-xxxx Pittsburgh, PA 413 958 Pittsfield/Springfield, MA 413 200-555-5555 Pittsfield/Springfield, MA 414 330-2234 Fond du Lac/Green Bay/Milwaukee/Racine, WI 415 200-555-1212 San Francisco, CA 415 211-2111 San Francisco, CA 415 2222 San Francisco, CA 415 640 San Francisco, CA 415 760-2878 San Francisco, CA 415 7600-2222 San Francisco, CA 419 311 Toledo, OH N 423 200-200-200 Chatanooga, Johnson City, Knoxville , TN N 501 511 AR 502 2002222222 Frankfort/Louisville/Paducah/Shelbyville, KY 502 997-555-1212 Frankfort/Louisville/Paducah/Shelbyville, KY 503 611 Portland, OR 503 999 Portland, OR (GTE) 504 99882233 Baton Rouge/New Orleans, LA 504 201-269-1111 Baton Rouge/New Orleans, LA 504 998 Baton Rouge/New Orleans, LA 504 99851-0000000000 Baton Rouge/New Orleans, LA 508 958 Fall River/New Bedford/Worchester, MA 508 200-222-1234 Fall River/New Bedford/Worchester, MA 508 200-222-2222 Fall River/New Bedford/Worchester, MA 508 26011 Fall River/New Bedford/Worchester, MA 509 560 Spokane/Walla Walla/Yakima, WA 510 760-1111 Oakland, CA 512 830 Austin/Corpus