1. Counterfeiting
Money by The Jolly Roger
Before reading this article, it would
be a very good idea to get a book on photo offset printing, for this is
the method used in counterfeiting US currency. If you are familiar with
this method of printing, counterfeiting should be a simple task for you.
Genuine currency is made by a process called "gravure", which involves
etching a metal block. Since etching a metal block is impossible to do
by hand, photo offset printing comes into the process. Photo offset printing
starts by making negatives of the currency with a camera, and putting the
negatives on a piece of masking material (usually orange in color). The
stripped negatives, commonly called "flats", are then exposed to a lithographic
plate with an arc light plate maker. The burned plates are then developed
with the proper developing chemical. One at a time, these plates are wrapped
around the plate cylinder of the press. The press to use should be an 11
by 14 offset, such as the AB Dick 360. Make 2 negatives of the portrait
side of the bill, and 1 of the back side. After developing them and letting
them dry, take them to a light table. Using opaque on one of the portrait
sides, touch out all the green, which is the seal and the serial numbers.
The back side does not require any retouching, because it is all one color.
Now, make sure all of the negatives are registered (lined up correctly)
on the flats. By the way, every time you need another serial number, shoot
1 negative of the portrait side, cut out the serial number, and remove
the old serial number from the flat replacing it with the new one. Now
you have all 3 flats, and each represents a different color: black, and
2 shades of green (the two shades of green are created by mixing inks).
Now you are ready to burn the plates. Take a lithographic plate and etch
three marks on it. These marks must be 2 and 9/16 inches apart, starting
on one of the short edges. Do the same thing to 2 more plates. Then, take
1 of the flats and place it on the plate, exactly lining the short edge
up with the edge of the plate. Burn it, move it up to the next mark, and
cover up the exposed area you have already burned. Burn that, and do the
same thing 2 more times, moving the flat up one more mark. Do the same
process with the other 2 flats (each on a separate plate). Develop all
three plates. You should now have 4 images on each plate with an equal
space between each bill. The paper you will need will not match exactly,
but it will do for most situations. The paper to use should have a 25%
rag content. By the way, Disaperf computer paper (invisible perforation)
does the job well. Take the paper and load it into the press. Be sure to
set the air, buckle, and paper thickness right. Start with the black plate
(the plate without the serial numbers). Wrap it around the cylinder and
load black ink in. Make sure you run more than you need because there will
be a lot of rejects. Then, while that is printing, mix the inks for the
serial numbers and the back side. You will need to add some white and maybe
yellow to the serial number ink. You also need to add black to the back
side. Experiment until you get it right. Now, clean the press and print
the other side. You will now have a bill with no green seal or serial numbers.
Print a few with one serial number, make another and repeat. Keep doing
this until you have as many different numbers as you want. Then cut the
bills to the exact size with a paper cutter. You should have printed a
large amount of money by now, but there is still one problem; the paper
is pure white. To dye it, mix the following in a pan: 2 cups of hot water,
4 tea bags, and about 16 to 20 drops of green food coloring (experiment
with this). Dip one of the bills in and compare it to a genuine US bill.
Make the necessary adjustments, and dye all the bills. Also, it is a good
idea to make them look used. For example, wrinkle them, rub coffee grinds
on them, etc. As before mentioned, unless you are familiar with photo offset
printing, most of the information in this article will be fairly hard to
understand. Along with getting a book on photo offset printing, try to
see the movie "To Live and Die in LA". It is about a counterfeiter, and
the producer does a pretty good job of showing how to counterfeit. A good
book on the subject is "The Poor Man's James Bond". If all of this seems
too complicated to you, there is one other method available for counterfeiting:
The Canon color laser copier. The Canon can replicate ANYTHING in vibrant
color, including US currency. But, once again, the main problem in counterfeiting
is the paper used. So, experiment, and good luck!
2. Credit Card
Fraud by The Jolly Roger
For most of you out there, money is
hard to come by. Until now: With the recent advent of plastic money (credit
cards), it is easy to use someone else's credit card to order the items
you have always desired in life. The stakes are high, but the payoff is
worth it.
Step One: Getting the credit card information
First off, you must obtain the crucial item: someone's credit card number.
The best way to get credit card numbers is to take the blue carbons used
in a credit card transaction at your local department store. These can
usually be found in the garbage can next to the register, or for the more
daring, in the garbage dumpster behind the store. But, due to the large
amount of credit card fraud, many stores have opted to use a carbonless
transaction sheet, making things much more difficult. This is where your
phone comes in handy. First, look up someone in the phone book, and obtain
as much information as possible about them. Then, during business hours,
call in a very convincing voice - "Hello, this is John Doe from the Visa
Credit Card Fraud Investigations Department. We have been informed that
your credit card may have been used for fraudulent purposes, so will you
please read off the numbers appearing on your Visa card for verification."
Of course, use your imagination! Believe it or not, many people will fall
for this ploy and give out their credit information. Now, assuming that
you have your victim's credit card number, you should be able to decipher
the information given.
Step Two: Recognizing information from
carbon copies Card example: [American Express] XXXX XXXXXX XXXXX MM/Y1
THRU MM/Y2 JOE SHMOE Explanation: MM/Y1 is the date the card was issued,
and MM/Y2 is the expiration date. The American Express Gold Card has numbers
XXXXXX XXXXXXXX XXXXXXXX, and is covered for up to $5000.00, even if the
card holder is broke. [Mastercard] 5XXX XXXX XXXX XXXX XXXX AAA DD-MM-YY
MM/YY JOE SHMOE Explanation: XXXX in the second row may be asked for during
the ordering process. The first date is when the card was new, and the
second is when the card expires. The most frequent number combination used
is 5424 1800 XXXX XXXX. There are many of these cards in circulation, but
many of these are on wanted lists, so check these first. [Visa] 4XXX XXX(X)
XXX(X) XXX(X) MM/YY MM/YY*VISA JOE SHMOE Explanation: Visa is the most
abundant card, and is accepted almost everywhere. The "*VISA" is sometimes
replaced with "BWG", or followed with a special code. These codes are as
follows: [1] MM/YY*VISA V - Preferred Card [2] MM/YY*VISA CV - Classic
Card [3] MM/YY*VISA PV - Premier Card Preferred Cards are backed with money,
and are much safer to use. Classic Cards are newer, harder to reproduce
cards with decent backing. Premier Cards are Classic Cards with Preferred
coverage. Common numbers are 4448 020 XXX XXX, 4254 5123 6000 XXXX, and
4254 5123 8500 XXXX. Any 4712 1250 XXXX XXXX cards are IBM Credit Union
cards, and are risky to use, although they are usually covered for large
purchases.
Step Three: Testing credit You should
now have a Visa, Mastercard, or American Express credit card number, with
the victim's address, zip code, and phone number. By the way, if you have
problems getting the address, most phone companies offer the Address Tracking
Service, which is a special number you call that will give you an address
from a phone number, at a nominal charge. Now you need to check the balance
of credit on the credit card (to make sure you don't run out of money),
and you must also make sure that the card isn't stolen. To do this you
must obtain a phone number that businesses use to check out credit cards
during purchases. If you go to a department store, watch the cashier when
someone makes a credit card purchase. He/she will usually call a phone
number, give the credit information, and then give what is called a "Merchant
Number". These numbers are usually written down on or around the register.
It is easy to either find these numbers and copy them, or to wait until
they call one in. Watch what they dial and wait for the 8 digit (usually)
merchant number. Once you call the number, in a calm voice, read off the
account number, merchant number, amount, and expiration date. The credit
bureau will tell you if it is OK, and will give you an authorization number.
Pretend you are writing this number down, and repeat it back to them to
check it. Ignore this number completely, for it serves no real purpose.
However, once you do this, the bank removes dollars equal to what you told
them, because the card was supposedly used to make a purchase. Sometimes
you can trick the operator by telling her the customer changed his mind
and decided not to charge it. Of course, some will not allow this. Remember
at all times that you are supposed to be a store clerk calling to check
out the card for a purchase. Act like you are talking with a customer when
he/she "cancels".
Step Four: The drop Once the cards
are cleared, you must find a place to have the package sent. NEVER use
a drop more than once. The following are typical drop sites: [1] An empty
house An empty house makes an excellent place to send things. Send the
package UPS, and leave a note on the door saying, "UPS. I work days, 8
to 6. Could you please leave the package on the back door step?" You can
find dozens of houses from a real estate agent by telling them you want
to look around for a house. Ask for a list of twenty houses for sale, and
tell them you will check out the area. Do so, until you find one that suits
your needs. [2] Rent A Spot U-Haul sometimes rents spaces where you can
have packages sent and signed for. End your space when the package arrives.
[3] People's houses Find someone you do not know, and have the package
sent there. Call ahead saying that "I called the store and they sent the
package to the wrong address. It was already sent, but can you keep it
there for me?" This is a very reliable way if you keep calm when talking
to the people. Do NOT try post office boxes. Most of the time, UPS will
not deliver to a post office box, and many people have been caught in the
past attempting to use a post office box. Also, when you have determined
a drop site, keep an eye on it for suspicious characters and cars that
have not been there before.
Step Five: Making the transaction You
should now have a reliable credit card number with all the necessary billing
information, and a good drop site. The best place to order from is catalogues,
and mail order houses. It is in your best interest to place the phone call
from a pay phone, especially if it is a 1-800 number. Now, when you call,
don't try to disguise your voice, thinking you will trick the salesperson
into believing you are an adult. These folks are trained to detect this,
so your best bet is to order in your own voice. They will ask for the following:
name, name as it appears on card, phone number, billing address, expiration
date, method of shipping, and product. Ask if they offer UPS Red shipping
(next day arrival), because it gives them less time to research an order.
If you are using American Express, you might have a bit of a problem shipping
to an address other than the billing address. Also, if the salesperson
starts to ask questions, do NOT hang up. Simply talk your way out of the
situation, so you won't encourage investigation on the order. If everything
goes right, you should have the product, free of charge. Insurance picks
up the tab, and no one is any wiser. Be careful, and try not to order anything
over $500. In some states, UPS requires a signature for anything over $200,
not to mention that anything over $200 is defined as grand theft, as well
as credit fraud. Get caught doing this, and you will bite it for a couple
of years. Good luck!
3. Making Plastic
Explosives from Bleach by The Jolly Roger
Potassium chlorate is an extremely
volatile explosive compound, and has been used in the past as the main
explosive filler in grenades, land mines, and mortar rounds by such countries
as France and Germany. Common household bleach contains a small amount
of potassium chlorate, which can be extracted by the procedure that follows.
First off, you must obtain: A heat source (hot plate, stove, etc.) A hydrometer,
or battery hydrometer A large Pyrex, or enameled steel container (to weigh
chemicals) Potassium chloride(sold as a salt substitute at health and nutrition
stores) Take one gallon of bleach, place it in the container, and begin
heating it. While this solution heats, weigh out 63 grams of potassium
chloride and add this to the bleach being heated. Constantly check the
solution being heated with the hydrometer, and boil until you get a reading
of 1.3. If using a battery hydrometer, boil until you read a FULL charge.
Take the solution and allow it to cool in a refrigerator until it is between
room temperature and 0øC. Filter out the crystals that have formed
and save them. Boil this solution again and cool as before. Filter and
save the crystals. Take the crystals that have been saved, and mix them
with distilled water in the following proportions: 56 grams per 100 milliliters
distilled water. Heat this solution until it boils and allow to cool. Filter
the solution and save the crystals that form upon cooling. This process
of purification is called "fractional crystallization". These crystals
should be relatively pure potassium chlorate. Powder these to the consistency
of face powder, and heat gently to drive off all moisture. Now, melt five
parts Vaseline with five parts wax. Dissolve this in white gasoline (camp
stove gasoline), and pour this liquid on 90 parts potassium chlorate (the
powdered crystals from above) into a plastic bowl. Knead this liquid into
the potassium chlorate until intimately mixed. Allow all gasoline to evaporate.
Finally, place this explosive into a cool, dry place. Avoid friction, sulfur,
sulfides, and phosphorous compounds. This explosive is best molded to the
desired shape and density of 1.3 grams in a cube and dipped in wax until
water proof. These block type charges guarantee the highest detonation
velocity. Also, a blasting cap of at least a 3 grade must be used. The
presence of the afore mentioned compounds (sulfur, sulfides, etc.) results
in mixtures that are or can become highly sensitive and will possibly decompose
explosively while in storage. You should never store homemade explosives,
and you must use EXTREME caution at all times while performing the processes
in this article. You may obtain a catalog of other subject of this nature
by writing: Information Publishing Co. Box 10042 Odessa, Texas 79762
4. Picking Master
Locks by The Jolly Roger
Have you ever tried to impress someone
by picking one of those Master combination locks and failed? The Master
lock company made their older combination locks with a protection scheme.
If you pull the handle too hard, the knob will not turn. That was their
biggest mistake.
The first number: Get out any of the
Master locks so you know what is going on. While pulling on the clasp (part
that springs open when you get the combination right), turn the knob to
the left until it will not move any more, and add five to the number you
reach. You now have the first number of the combination.
The second number: Spin the dial around
a couple of times, then go to the first number you got. Turn the dial to
the right, bypassing the first number once. When you have bypassed the
first number, start pulling on the clasp and turning the knob. The knob
will eventually fall into the groove and lock. While in the groove, pull
the clasp and turn the knob. If the knob is loose, go to the next groove,
if the knob is stiff, you have the second number of the combination.
The third number: After getting the
second number, spin the dial, then enter the two numbers. Slowly spin the
dial to the right, and at each number, pull on the clasp. The lock will
eventually open if you did the process right. This method of opening Master
locks only works on older models. Someone informed Master of their mistake,
and they employed a new mechanism that is foolproof (for now).
5. The Arts of
Lockpicking I by The Jolly Roger
Lockpicking I: Cars and assorted other
locks While the basic themes of lockpicking and uninvited entry have not
changed much in the last few years, some modern devices and techniques
have appeared on the scene. Automobiles: Many older automobiles can still
be opened with a Slim Jim type of opener (these and other auto locksmithing
techniques are covered fully in the book "In the Still of the Night", by
John Russell III); however, many car manufacturers have built cases over
the lock mechanism, or have moved the lock mechanism so the Slim Jim will
not work. So: American Locksmith Service P.O. Box 26 Culver City, CA 90230
ALS offers a new and improved Slim Jim that is 30 inches long and 3/4 inches
wide, so it will both reach and slip through the new car lock covers (inside
the door). Price is $5.75 plus $2.00 postage and handling. Cars manufactured
by General Motors have always been a bane to people who needed to open
them, because the sidebar locking unit they employ is very difficult to
pick. To further complicate matters, the new GM cars employ metal shields
to make the use of a Slim Jim type instrument very difficult. So: Lock
Technology Corporation 685 Main St. New Rochelle, NY 10801 LTC offers a
cute little tool which will easily remove the lock cylinder without harm
to the vehicle, and will allow you to enter and/or start the vehicle. The
GMC-40 sells for $56.00 plus $2.00 for postage and handling. The best general
automobile opening kit is probably a set of lockout tools offered by: Steck
MFG Corporation 1319 W. Stewart St. Dayton, OH 45408 For $29.95 one can
purchase a complete set of six carbon lockout tools that will open more
than 95% of all the cars around. Kwickset locks have become quite popular
as one step security locks for many types of buildings. They are a bit
harder to pick and offer a higher degree of security than a normal builder
installed door lock. So: A MFG 1151 Wallace St. Massilon, OH 44646 Price
is $11.95. Kwickset locks can handily be disassembled and the door opened
without harm to either the lock or the door by using the above mentioned
Kwick Out tool. If you are too lazy to pick auto locks: Veehof Supply Box
361 Storm Lake, IO 50588 VS sells tryout keys for most cars (tryout keys
are used since there is no one master key for any one make of car, but
there are group type masters (a.k.a. tryout keys). Prices average about
$20.00 a set. Updated Lockpicking: For years, there have been a number
of pick attack procedures for most pin and tumbler lock systems. In reverse
order of ease they are as follows: Normal Picking: Using a pick set to
align the pins, one by one, until the shear line is set and the lock opens.
Racking: This method uses picks that are constructed with a series of bumps,
or diamond shape notches. These picks are "raked" (i.e. run over all the
pins at one time). With luck, the pins will raise in the open position
and stay there. Raking, if successful, can be much less of an effort than
standard picking. Lock Aid Gun: This gun shaped device was invented a number
of years ago and has found application with many locksmiths and security
personnel. Basically, a needle shaped pick is inserted in the snout of
the "gun", and the "trigger" is pulled. This action snaps the pick up and
down strongly. If the tip is slipped under the pins, they will also be
snapped up and down strongly. With a bit of luck they will strike each
other and separate at the shear line for a split second. When this happens
the lock will open. The lock aid gun is not 100% successful, but when it
does work, the results are very dramatic. You can sometimes open the lock
with one snap of the trigger. Vibrator: Some crafty people have mounted
a needle pick into an electric toothbrush power unit. This vibrating effect
will sometimes open pin tumbler locks -- instantly. There is now another
method to open pin and wafer locks in a very short time. Although it resembles
a toothbrush pick in appearance, it is actually an electronic device. I
am speaking of the Cobra pick that is designed and sold by: Fed Corporation
P.O. Box 569 Scottsdale, AR 85252 The Cobra uses two nine volt batteries,
teflon bearings (for less noise), and a cam roller. It comes with three
picks (for different types of locks) and works both in America and overseas,
on pin or wafer locks. The Cobra will open group one locks (common door
locks) in three to seven seconds with no damage, in the hands of an experienced
locksmith. It can take a few seconds more or up to a half a minute for
someone with no experience at all. It will also open group two locks (including
government, high security, and medicos), although this can take a short
time longer. It will not open GM sidebar locks, although a device is about
to be introduced to fill that gap. How much for this toy that will open
most locks in seven seconds? $235.00 plus $4.00 shipping and handling.
For you hard core safe crackers, FC also sells the MI-6 that will open
most safes at a cost of $10,000 for the three wheel attack model, and $10,500
for the four wheel model. It comes in a sturdy aluminum carrying case with
monitor, disk drive and software. If none of these safe and sane ideas
appeal to you, you can always fall back on the magic thermal lance... The
thermal lance is a rather crude instrument constructed from 3/8 inch hollow
magnesium rods. Each tube comes in a 10 foot length, but can be cut down
if desired. Each one is threaded on one end. To use the lance, you screw
the tube together with a matted regulator (like a welding outfit uses)
and hook up an oxygen tank. Then oxygen is turned on and the rod is lit
with a standard welding igniter. The device produces an incredible amount
of heat. It is used for cutting up concrete blocks or even rocks. An active
lance will go through a foot of steel in a few seconds. The lance is also
known as a burning bar, and is available from: C.O.L. MFG 7748 W. Addison
Chicago, IL 60634
6. The Arts of
Lockpicking II by The Jolly Roger
So you want to be a criminal. Well,
if you want to be like James Bond and open a lock in fifteen seconds, then
go to Hollywood, because that is the only place you are ever going to do
it. Even experienced locksmiths can spend five to ten minutes on a lock
if they are unlucky. If you are wanting extremely quick access, look elsewhere.
The following instructions will pertain mostly to the "lock in knob" type
lock, since it is the easiest to pick. First of all, you need a pick set.
If you know a locksmith, get him to make you a set. This will be the best
possible set for you to use. If you find a locksmith unwilling to supply
a set, don't give up hope. It is possible to make your own, if you have
access to a grinder (you can use a file, but it takes forever). The thing
you need is an allen wrench set (very small). These should be small enough
to fit into the keyhole slot. Now, bend the long end of the allen wrench
at a slight angle (not 90ø). Now, take your pick to a grinder or
a file, and smooth the end until it is rounded so it won't hang inside
the lock. Test your tool out on doorknobs at your house to see if it will
slide in and out smoothly. Now, this is where the screwdriver comes in.
It must be small enough for it and your pick to be used in the same lock
at the same time, one above the other. In the coming instructions, please
refer to this chart of the interior of a lock: ______________________________
\ K | | | | | | / E | | | | \ Y [|] Upper tumbler pin ^ ^ / H [^] Lower
tumbler pin ^ ^ ^ ^ ^ ^ \ O [-] Cylinder wall / L (This is a greatly simplified
\ E drawing) ______________________________/ The object is to press the
pin up so that the space between the upper pin and the lower pin is level
with the cylinder wall. Now, if you push a pin up, it's tendency is to
fall back down, right? That is where the screwdriver comes in. Insert the
screwdriver into the slot and turn. This tension will keep the "solved"
pins from falling back down. Now, work from the back of the lock to the
front, and when you are through, there will be a click, the screwdriver
will turn freely, and the door will open. Do not get discouraged on your
first try! It will probably take you about twenty to thirty minutes your
first time. After that, you will quickly improve with practice.
7. Solidox Bombs
by The Jolly Roger
Most people are not aware that a volatile,
extremely explosive chemical can be bought over the counter: Solidox. Solidox
comes in an aluminum can containing 6 grey sticks, and can be bought at
K-Mart, and various hardware supply shops for around $7.00. Solidox is
used in welding applications as an oxidizing agent for the hot flame needed
to melt metal. The most active ingredient in Solidox is potassium chlorate,
a filler used in many military applications in the WWII era. Since Solidox
is literally what the name says: SOLID OXygen, you must have an energy
source for an explosion. The most common and readily available energy source
is common household sugar, or sucrose. In theory, glucose would be the
purest energy source, but it is hard to find a solid supply of glucose.
Making the mixture: Open the can of Solidox, and remove all 6 sticks. One
by one, grind up each of the sticks (preferably with a mortar and pestle)
into the finest powder possible. The ratio for mixing the sugar with the
Solidox is 1:1, so weigh the Solidox powder, and grind up the equivalent
amount of sugar. Mix equivalent amounts of Solidox powder, and sugar in
a 1:1 ratio. It is just that simple! You now have an extremely powerful
substance that can be used in a variety of applications. A word of caution:
be EXTREMELY careful in the entire process. Avoid friction, heat, and flame.
A few years back, a teenager I knew blew 4 fingers off while trying to
make a pipe bomb with Solidox. You have been warned!
8. High Tech Revenge:
The Beigebox - Rev.2 by The Jolly Roger
I. Introduction Have you ever wanted
a lineman's handset? Surely every phreak has at least once considered the
phun that he could have with one. After searching unlocked phone company
trucks for months, we had an idea. We could build one. We did, and named
it the "Beige Box" simply because that is the color of ours. The beigebox
is simply a consumer lineman's handset, which is a phone that can be attached
to the outside of a person's house. To fabricate a beigebox, follow along.
II. Construction and Use The construction is very simple. First you must
understand the concept of the device. In a modular jack, there are four
wires. These are red, green, yellow, and black. For a single line telephone,
however, only two matter: the red (ring) and green (tip). The yellow and
the black are not necessary for this project. A lineman's handset has two
clips on it: the ring and the tip. Take a modular jack and look at the
bottom of it's casing. There should be a grey jack with four wires (red,
green, yellow & black) leading out of it. To the end of the red wire
attach a red alligator clip. To the end of the green wire attach a green
alligator clip. The yellow and black wires can be removed, although I would
only set them aside so that you can use the modular jack in future projects.
Now insert your telephone's modular plug into the modular jack. That's
it. This particular model is nice because it is can be easily made, is
inexpensive, uses common parts that are readily available, is small, is
lightweight, and does not require the destruction of a phone. III. Beige
Box Uses There are many uses for a Beige Box. However, before you can use
it, you must know how to attach it to the output device. This device can
be of any of Bell switching apparatus that include germinal sets (i.e.
remote switching centers, bridgin heads, cans, etc.) To open most Bell
Telephone switching apparatus, you must have a 7/16 inch hex driver (or
a good pair of needle nose pliers work also). This piece of equipment can
be picked up at your local hardware store. With your hex driver (or pliers),
turn the security bolt(s) approximately 1/8 of an inch counter-clockwise
and open. If your output device is locked, then you must have some knowledge
of destroying and/or picking locks. However, we have never encountered
a locked output device. Once you have opened your output device, you should
see a mass of wires connected to terminals. On most output devices, the
terminals should be labeled "T" (Tip -- if not labeled, it is usually on
the left) and "R" (Ring -- if not labeled, usually on the right). Remember:
Ring - red - right. The "Three R's" -- a simple way to remember which is
which. Now you must attach all the red alligator clip (Ring) to the "R"
(Ring) terminal. Attach the green alligator clip (Tip) to the "T" (Tip)
terminal. Note: If instead of a dial tone you hear nothing, adjust the
alligator clips so that they are not touching each other terminals. Also
make sure they are firmly attached. By this time you should hear a dial
tone. Dial ANI to find out the number you are using (you wouldn't want
to use your own). Here are some practical applications: Eavesdropping Long
distance, static free, free fone calls to phriends Dialing direct to Alliance
Teleconferencing (also no static) Phucking people over Bothering the operator
at little risk to yourself Blue Boxing with greatly reduced chance of getting
caught Anything at all you want, since you are on an extension of that
line Eavesdropping To be most effective, first attach the Beige Box then
your phone. This eliminates the static caused by connecting the box, therefore
reducing the potential suspicion of your victim. When eavesdropping, it
is always best to be neither seen nor heard. If you hear someone dialing
out, do not panic; but rather hang up, wait, and pick up the receiver again.
The person will either have hung up or tried to complete their call again.
If the latter is true, then listen in, and perhaps you will find information
worthy of blackmail! If you would like to know who you are listening to,
after dialing ANI, pull a CN/A on the number. Dialing Long Distance This
section is self explanatory, but don't forget to dial a "1" before the
NPA. Dialing Direct to Alliance Teleconferencing Simply dial 0-700-456-1000
and you will get instructions from there. I prefer this method over PBX's,
since PBX's often have poor reception and are more difficult to come by.
Phucking People Over This is a very large topic of discussion. Just by
using the other topics described, you can create a large phone bill for
the person (they will not have to pay for it, but it will be a big hassle
for them). In addition, since you are an extension of the person's line,
you can leave your phone off the hook, and they will not be able to make
or receive calls. This can be extremely nasty because no one would expect
the cause of the problem. Bothering the Operator This is also self explanatory
and can provide hours of entertainment. Simply ask her things that are
offensive or you would not like traced to your line. This also corresponds
to the previously described section, Phucking People Over. After all, guess
who's line it gets traced to? Blue Boxing See a file on Blue Boxing for
more details. This is an especially nice feature if you live in an ESS-equipped
prefix, since the calls are, once again, not traced to your line...
IV. POTENTIAL RISKS OF BEIGE BOXING
Overuse of the Beige Box may cause suspicions within the Gestapo, and result
in legal problems. Therefor, I would recommend you: Choose a secluded spot
to do your Beige Boxing, Use more than one output device Keep a low profile
(i.e., do not post under your real name on a public BBS concerning your
accomplishments) In order to make sure the enemy has not been inside your
output device, I recommend you place a piece of transparent tape over the
opening of your output device. Therefor, if it is opened in your absence,
the tape will be displaced and you will be aware of the fact that someone
has intruded on your territory. Now, imagine the possibilities: a $2000
dollar phone bill for that special person, 976 numbers galore, even harassing
the operator at no risk to you! Think of it as walking into an enemies
house, and using their phone to your heart's content.
9. How to make
a COý bomb by the Jolly Roger
You will have to use up the cartridge
first by either shooting it or whatever. With a nail, force a hole bigger
so as to allow the powder and wick to fit in easily. Fill the cartridge
with black powder and pack it in there real good by tapping the bottom
of the cartridge on a hard surface (I said TAP not SLAM!). Insert a fuse.
I recommend a good water-proof cannon fuse, or an m-80 type fuse, but firecracker
fuses work, if you can run like a black man runs from the cops after raping
a white girl.) Now, light it and run like hell! It does wonders for a row
of mailboxes (like the ones in apartment complexes), a car (place under
the gas tank), a picture window (place on window sill), a phone booth (place
right under the phone), or any other devious place. This thing throws shrapnel,
and can make quit a mess!!
10. Thermite II
by Jolly Roger
Thermite is nasty shit. Here is a good
and easy way to make it. The first step is to get some iron-oxide (which
is RUST!). Here is a good way to make large quantities in a short time:
Get a DC converter like the one used on a train set. Cut the connector
off, separate the wires, and strip them both. Now you need a jar of water
with a tablespoon or so of sodium chloride (which is SALT!) added to it.
This makes the water conductive. Now insert both wires into the mixture
(I am assuming you plugged the converter in...) and let them sit for five
minutes. One of them will start bubbling more than the other. This is the
POSITIVE(+) wire. If you do not do this test right, the final product will
be the opposite (chemically) of rust, which is RUST ACID. You have no use
for this here (although it IS useful!). Anyway, put the nail tied to the
positive wire into the jar. Now put the negative wire in the other end.
Now let it sit overnight and in the morning scrape the rust off of the
nail & repeat until you got a bunch of rust on the bottom of the glass.
Be generous with your rust collection. If you are going through the trouble
of making thermite, you might as well make a lot, right? Now remove the
excess water and pour the crusty solution onto a cookie sheet. Dry it in
the sun for a few hours, or inside overnight. It should be an orange-brown
color (although I have seen it in many different colors! Sometimes the
color gets fucked up, what can I say... but it is still iron oxide!) Crush
the rust into a fine powder and heat it in a cast-iron pot until it is
red. Now mix the pure iron oxide with pure aluminum filings which can be
bought or filed down by hand from an aluminum tube or bar. The ratio or
iron oxide to aluminum is 8 grams to 3 grams. Congrats! You have just made
THERMITE! Now, to light it... Thermite requires a LOT of heat (more than
a blow torch!) to ignite. However, magnesium ribbon (which is sort of hard
to find.. call around) will do the trick. It takes the heat from the burning
magnesium to light the thermite. Now when you see your victim's car, pour
a fifty-cent sized pile onto his hood, stick the ribbon in it, and light
the ribbon with the blow torch. Now chuckle as you watch it burn through
the hood, the block, the axle, and the pavement. BE CAREFUL! The ideal
mixtures can vaporize CARBON STEEL! Another idea is to use thermite to
get into pay phone cash boxes.
11. Touch Explosives
by the Jolly Roger
This is sort of a mild explosive, but
it can be quite dangerous in large quantities. To make touch explosive
(such as that found in a snap-n-pop, but more powerful), use this recipe:
Mix iodine crystals into ammonia until the iodine crystals will not dissolve
into the ammonia anymore. Pour off the excess ammonia and dry out the crystals
on a baking sheet the same way as you dried the thermite (in other words,
just let it sit overnight!). Be careful now because these crystals are
now your touch explosive. Carefully wrap a bunch in paper (I mean carefully!
Friction sets 'em off!) and throw them around.. pretty loud, huh? They
are fun to put on someone's chair. Add a small fish sinker to them and
they can be thrown a long distance (good for crowds, football games, concerts,
etc.)
12. Letter Bombs
by The Jolly Roger
You will first have to make a mild
version of thermite. Use my recipe, but substitute iron fillings for rust.
Mix the iron with aluminum fillings in a ratio of 75% aluminum to 25% iron.
This mixture will burn violently in a closed space (such as an envelope).
This bring us to our next ingredient... Go to the post office and buy an
insulated (padded) envelope. You know, the type that is double layered.
Separate the layers and place the mild thermite in the main section, where
the letter would go. Then place magnesium powder in the outer layer. There
is your bomb!! Now to light it... this is the tricky part and hard to explain.
Just keep experimenting until you get something that works. The fuse is
just that touch explosive I have told you about in another one of my anarchy
files. You might want to wrap it like a long cigarette and then place it
at the top of the envelope in the outer layer (on top of the powdered magnesium).
When the touch explosive is torn or even squeezed hard it will ignite the
powdered magnesium (sort of a flash light) and then it will burn the mild
thermite. If the thermite didn't blow up, it would at least burn the fuck
out of your enemy (it does wonders on human flesh!).
13. Paint Bombs
by The Jolly Roger
To make a pain bomb you simply need
a metal pain can with a refastenable lid, a nice bright color paint (green,
pink, purple, or some gross color is perfect!), and a quantity of dry ice.
Place the paint in the can and then drop the dry ice in. Quickly place
the top on and then run like hell! With some testing you can time this
to a science. It depends on the ratio of dry ice to paint to the size of
the can to how full it is. If you are really pissed off at someone, you
could place it on their doorstep, knock on the door, and then run!! Paint
will fly all over the place!!
14. Ways to send
a car to Hell by The Jolly Roger
There are 1001 ways to destroy a car
but I am going to cover only the ones that are the most fun (for you),
the most destructive (for them), and the hardest to trace (for the cops).
Place thermite on the hood, light it, and watch it burn all the way through
the pavement! Tape a CO2 bomb to the hood, axle, gas tank, wheel, muffler,
etc. Put a tampon, dirt, sugar (this one is good!), a ping pong ball, or
just about anything that will dissolve in the gas tank. Put potatoes, rocks,
bananas, or anything that will fit, into the tailpipe. Use a broom handle
to stuff 'em up into the tailpipe. Put a long rag into the gas tank and
light it... Steal a key, copy it, replace it, and then steal the stereo.
Break into the car. Cut a thin metal ruler into a shape like this: Slide
it into the outside window and keep pulling it back up until you catch
the lock cable which should unlock the door. This device is also called
a SLIM JIM. Now get the stereo, equalizer, radar detector, etc. Now destroy
the inside. (A sharp knife does wonders on the seats!)
15. Do you hate
school? by The Jolly Roger
One of my favorites for getting out
of a class or two is to call in a bomb threat. Tell 'em that it is in a
locker. Then they have to check them all, whilst you can slip away for
an hour or two. You can even place a fake bomb (in any locker but YOURS!).
They might cancel school for a week while they investigate (of course,
you will probably have to make it up in the summer). Get some pure potassium
or pure sodium, put it in a capsule, and flush it down the toilet (smells
awful! Stinks up the whole school!). Use a smoke grenade in the hallway.
Steal the computer passwords & keys. Or steal the 80 column cards inside
if they are (gag) IBM. Make friends with student assistants and have them
change your grades when the teachers hand in their bubble sheets for the
report cards. Spit your gum out on the carpet in the library or whatever
and grind it into the carpet. Watch the janitors cry! Draw on lockers or
spraypaint on the building that the principal is a fascist. Stick a potato
in the tailpipe of the principal's car. USE YOUR IMAGINATION!
16. Phone related
vandalism by the Jolly Roger
If you live where there are underground
lines then you will be able to ruin someone's phone life very easily. All
you must do is go to their house and find the green junction box that interfaces
their line (and possibly some others in the neighborhood) with the major
lines. These can be found just about anywhere but they are usually underneath
the nearest phone pole. Take a socket wrench and loosen the nut on the
right. Then just take clippers or a sledge hammer or a bomb and destroy
the insides and pull up their phone cable. Now cut it into segments so
it can't be fixed but must be replaced (There is a week's worth of work
for 'em!!)
17. Highway radar
jamming by The Jolly Roger
Most drivers wanting to make better
time on the open road will invest in one of those expensive radar detectors.
However, this device will not work against a gun type radar unit in which
the radar signal is not present until the cop has your car in his sights
and pulls the trigger. Then it is TOO LATE for you to slow down. A better
method is to continuously jam any signal with a radar signal of your own.
I have tested this idea with the cooperation of a local cop and found that
his unit reads random numbers when my car approached him. It is suprisingly
easy to make a low power radar transmitter. A nifty little semiconductor
called a Gunn Diode will generate microwaves when supplied with the 5 to
10 volt DC and enclosed in the correct size cavity (resonator). An 8 to
3 terminal regulator can be used to get this voltage from a car's 12v system.
However, the correct construction and tuning of the cavity is difficult
without good microwave measurement equipment. Police radars commonly operate
on the K band at 22 GHz. Or more often on the X band at 10«25 GHz.
most microwave intruder alarms and motion detectors (mounted over automatic
doors in supermarkets & banks, etc.) contain a Gunn type transmitter/receiver
combination that transmits about 10 kilowatts at 10«25 GHz. These
units work perfectly as jammers. If you cannot get one locally, write to
Microwave Associates in Burlington, Massachusetts and ask them for info
on 'Gunnplexers' for ham radio use. When you get the unit it may be mounted
in a plastic box on the dash or in a weather-proof enclosure behind the
PLASTIC grille. Switch on the power when on an open highway. The unit will
not jam radar to the side or behind the car so don't go speeding past the
radar trap. An interesting phenomena you will notice is that the drivers
who are in front of you who are using detectors will hit their brakes as
you approach large metal signs and bridges. Your signal is bouncing off
of these objects and triggering their radar detectors! PS If you are interested
in this sort of thing, get a copy of POPULAR COMMUNICATIONS. The ads in
there tell you where you can get all kinds of info on all kinds of neat
equipment for all kinds of neat things!
18. Smoke Bombs
by the Jolly Roger
Here is the recipe for one hell of
a smoke bomb! 4 parts sugar 6 parts potassium nitrate (Salt Peter) Heat
this mixture over a LOW flame until it melts, stirring well. Pour it into
a future container and, before it solidifies, imbed a few matches into
the mixture to use as fuses. One pound of this stuff will fill up a whole
block with thick, white smoke!
19. Mail Box Bombs
by the Jolly Roger
Two liter bottle of chlorine (must
contain sodium hypochlorate) Small amount of sugar Small amount of water
Mix all three of these in equal amounts to fill about 1/10 of the bottle.
Screw on the lid and place in a mailbox. It's hard to believe that such
a small explosion will literally rip the mailbox in half and send it 20
feet into the air! Be careful doing this, though, because if you are caught,
it is not up to the person whose mailbox you blew up to press charges.
It is up to the city.
20. The easiest
way to hot-wire cars by the Jolly Roger
Get in the car. Look under the dash.
If it's enclosed, forget it unless you want to cut through it. If you do,
do it near the ignition. Once you get behind or near the ignition look
for two red wires. In older cars red was the standard color, if not, look
for two matched pairs. When you find them, cross them and take off!
21. How to make
Napalm by the Jolly Roger
Pour some gas into an old bowl, or
some kind of container. Get some styrofoam and put it in the gas, until
the gas won't eat anymore. You should have a sticky syrup. Put it on the
end of something (don't touch it!!). The unused stuff lasts a long time!
22. How to make
a fertilizer bomb by The Jolly Roger
Ingredients: Newspaper Fertilizer (the
chemical kind, GREEN THUMB or ORCHO) Cotton Diesel fuel Make a pouch out
of the newspaper and put some fertilizer in it. Then put cotton on top.
Soak the cotton with fuel. Then light and run like you have never ran before!
This blows up 500 square feet so don't do it in an alley!!
23. Tennis Ball
Bombs by The Jolly Roger
Ingredients: Strike anywhere matches
A tennis ball A nice sharp knife Duct tape Break a ton of matchheads off.
Then cut a SMALL hole in the tennis ball. Stuff all of the matchheads into
the ball, until you can't fit any more in. Then tape over it with duct
tape. Make sure it is real nice and tight! Then, when you see a geek walking
down the street, give it a good throw. He will have a blast!!
24. Diskette Bombs
by The Jolly Roger
You need: A disk Scissors White or
blue kitchen matches (they MUST be these colors!) Clear nail polish Carefully
open up the diskette (3«" disks are best for this!) Remove the cotton
covering from the inside. Scrape a lot of match powder into a bowl (use
a wooden scraper, metal might spark the matchpowder!) After you have a
lot, spread it evenly on the disk. Using the nail polish, spread it over
the match mixture Let it dry Carefully put the diskette back together and
use the nail polish to seal it shut on the inside (where it came apart).
When that disk is in a drive, the drive head attempts to read the disk,
which causes a small fire (ENOUGH HEAT TO MELT THE DISK DRIVE AND FUCK
THE HEAD UP!!). Let the fuckhead try and fix THAT!!!
25. Unlisted Phone
Numbers by The Jolly Roger
There are a couple of different ways
of doing this. Let's see if this one will help: Every city has one or more
offices dedicated to assigning numbers to the telephone wire pairs. These
offices are called DPAC offices and are available to service reps who are
installing or repairing phones. To get the DPAC number, a service rep would
call the customer service number for billing information in the town that
the number is located in that he is trying to get the unlisted number of.
(Got that?) The conversation would go something like this: "Hi, Amarillo,
this is Joe from Anytown business office, I need the DPAC number for the
south side of town." This info is usually passed out with no problems,
so... if the first person you call doesn't have it, try another. REMEMBER,
no one has ANY IDEA who the hell you are when you are talking on the phone,
so you can be anyone you damn well please! When you call the DPAC number,
just tell them that you need a listing for either the address that you
have, or the name. DPAC DOES NOT SHOW WHETHER THE NUMBER IS LISTED OR UNLISTED!!
Also, if you're going to make a habit of chasing numbers down, you might
want to check into getting a criss-cross directory, which lists phone numbers
by their addresses. It costs a couple hundred bucks, but it is well worth
it if you have to chase more than one or two numbers down!
26. Fuses by The
Jolly Roger
You would be surprised how many files
are out there that use what falls under the category of a "fuse." They
assume that you just have a few lying around, or know where to get them.
Well, in some parts of the country, fuses are extremely hard to come by...
so this file tells you how to make your own. Both fuses presented here
are fairly simple to make, and are fairly reliable. SLOW BURNING FUSE -
2 inches per minute Materials needed: Cotton string or 3 shoelaces Potassium
Nitrate or Potassium Chlorate Granulated sugar Procedure: Wash the cotton
string or shoelaces in HOT soapy water, then rinse with fresh water Mix
the following together in a glass bowl: 1 part potassium nitrate or potassium
chlorate 1 part granulated sugar 2 parts hot water Soak strings or shoelaces
in this solution Twist/braid 3 strands together and allow them to dry Check
the burn rate to see how long it actually takes!! FAST BURNING FUSE - 40
inches per minute Materials needed: Soft cotton string Fine black powder
(empty a few shotgun shells!) Shallow dish or pan Procedure: Moisten powder
to form a paste. Twist/braid 3 strands of cotton together. Rub paste into
string and allow to dry. Check the burn rate!!!
27. How to make
Potassium Nitrate by The Jolly Roger
Potassium Nitrate is an ingredient
in making fuses, among other things. Here is how you make it: Materials
needed: 3« gallons of nitrate bearing earth or other material «
cup of wood ashes Bucket or other similar container about 4-5 gallons in
volume 2 pieces of finely woven cloth, each a bit bigger than the bottom
of the bucket Shallow dish or pan at least as large in diameter as the
bucket Shallow, heat resistant container 2 gallons of water Something to
punch holes in the bottom of the bucket 1 gallon of any type of alcohol
A heat source Paper & tape Procedure: Punch holes on the inside bottom
of the bucket, so that the metal is "puckered" outward from the bottom.
Spread cloth over the holes from the bottom. Place wood ashes on the cloth.
Spread it out so that it covers the entire cloth and has about the same
thickness. Place 2nd cloth on top ofain the liquid in the dish away, and
discard the sludge in the bottom. Boil this liquid over a fire for at least
two hours. Small grains of salt will form - scoop these out with the paper
as they form. When the liquid has boiled down to « its original volume
let it sit. After « hour, add equal volume of the alcohol; when this
mixture is poured through paper, small white crystals appear. This is the
potassium nitrate. Purification: Redissolve crystals in small amount of
boiling water. Remove any crystals that appear. Pour through improvised
filter then heat concentrated solution to dryness. Spread out crystals
and allow to dry.
28. Exploding
Lightbulbs by The Jolly Roger
Materials needed: Lightbulb (100w)
Socket (duh...) ¬ cup soap chips Blackpowder! (open some shotgun shells!)
¬ cup kerosene or gasoline Adhesive tape Lighter or small blowtorch
Glue Procedure for a simple exploding lightbulb: Drill a small hole in
the top of the bulb near the threads! Carefully pour the blackpowder into
the hole. Use enough so that it touches the filament! Insert into socket
as normal (make sure the light is off or else YOU will be the victim!!)
Get the hell out!! Procedure for a Napalm Bulb: Heat kerosene/gasoline
in a double boiler. Melt soap chips, stirring slowly. Put somewhere and
allow to cool. Heat the threads of the bulb VERY carefully to melt the
glue. Remove threads, slowly drawing out the filament. Do NOT break the
cheap electrical igniters and/or the filament or this won't work!! Pour
the liquid into the bulb, and slowly lower the filament back down into
the bulb. Make sure the filament is dipped into the fluid. Re-glue the
threads back on. Insert it into a socket frequently used by the victim
and get the hell out!! When the victim flips the switch, he will be in
for a BIG surprise!
29. Under water
igniters by The Jolly Roger
Materials needed: Pack of 10 silicon
diodes. (Available at Radio Shack. You will know you got the right ones
if they are very, very small glass objects!) Pack of matches 1 candle Procedure:
Light the candle and allow a pool of molten wax to form in the top. Take
a single match and hold the glass part of a single diode against the head.
Bend the diode pins around the matchhead so that one wraps in an upward
direction and then sticks out to the side. Do the same with the other wire,
but in a downward direction. The diodes should now be hugging the matchhead,
but its wires MUST NOT TOUCH EACH OTHER! Dip the matchhead in wax to give
it a water-proof coat. These work underwater Repeat to make as many as
you want. How to use them: When these little dudes are hooked across a
6v battery, the diode reaches what is called breakdown voltage. When most
electrical components reach this voltage, they usually produce great amounts
of heat and light, while quickly melting into a little blob. This heat
is enough to ignite a matchhead. These are recommended for use underwater,
where most other igniters refuse to work.
30. Home-brew
blast cannon by The Jolly Roger
Materials needed: 1 plastic drain pipe,
3 feet long, at least 3 « inches in diameter. 1 smaller plastic pipe,
about 6 inches long, 2 inches in diameter. 1 large lighter, with fluid
refills (this gobbles it up!) 1 pipe cap to fit the large pipe, 1 pipe
cap to fit the small pipe. 5 feet of bellwire. 1 SPST rocker switch. 16v
polaroid pot-a-pulse battery. 15v relay (get this at Radio Shack). Electrical
Tape. One free afternoon. Procedure: Cut the bell wire into three equal
pieces, and strip the ends. Cut a hole in the side of the large pipe, the
same diameter as the small pipe. Thread the hole and one end of the small
pipe. They should screw together easily. Take a piece of scrap metal, and
bend it into an "L" shape, then attach it to the level on the lighter:
/------------------------gas switch is here V /------ !lighter!!<---metal
lever!! Now, every time you pull the 'trigger' gas should flow freely from
the lighter. You may need to enlarge the 'gas port' on your lighter, if
you wish to be able to fire more rapidly. Connect two wires to the two
posts on the switch. Cut two holes in the side of the smaller tube, one
for the switch on the bottom, and one for the metal piece on the top. Then,
mount the switch in the bottom, running the wires up and out of the top.
Mount the lighter/trigger in the top. Now the switch should rock easily,
and the trigger should cause the lighter to pour out gas. Re-screw the
smaller tube into the larger one, hold down the trigger a bit, let it go,
and throw a match in there. If all goes well, you should hear a nice big
'THUD!' Get a hold of the relay, and take off the top. 1---------------
v/ 2--------------/<--the center object is the metal finger inside the
relay 3 cc-------------/ oo----------------4 ii ll----------------5 Connect
(1) to one of the wires coming from the switch. Connect (2) to (4), and
connect (5) to one side of the battery. Connect the remaining wire from
the switch to the other side of the battery. Now you should be able to
get the relay to make a little 'buzzing' sound when you flip the switch
and you should see some tiny little sparks. Now, carefully mount the relay
on the inside of the large pipe, towards the back. Screw on the smaller
pipe, tape the battery to the side of the cannon barrel (yes, but looks
aren't everything!) You should now be able to let a little gas into the
barrel and set it off by flipping the switch. Put the cap on the back end
of the large pipe VERY SECURELY. You are now ready for the first trial-run!
To Test: Put something very, very large into the barrel, just so that it
fits 'just right'. Now, find a strong guy (the recoil will probably knock
you on your ass if you aren't careful!). Put on a shoulderpad, earmuffs,
and possibly some other protective clothing (trust the Jolly Roger! You
are going to need it!). Hold the trigger down for 30 seconds, hold on tight,
and hit the switch. With luck and the proper adjustments, you should be
able to put a frozen orange through ¬ or plywood at 25 feet.
31. Chemical Equivalency
list by The Jolly Roger
Acacia................................................................Gum
Arabic
Acetic Acid..............................................................Vinegar
Aluminum Oxide............................................................Alumia
Aluminum Potassium Sulphate.................................................Alum
Aluminum Sulfate............................................................Alum
Ammonium Carbonate.....................................................Hartshorn
Ammonium Hydroxide.......................................................Ammonia
Ammonium Nitrate......................................................Salt
Peter
Ammonium Oleate.....................................................Ammonia
Soap Amylacetate...........................................................Banana
Oil
Barium Sulfide.........................................................Black
Ash
Carbon Carbinate...........................................................Chalk
Carbontetrachloride...............................................Cleaning
Fluid
Calcium Hypochloride............................................Bleaching
Powder
Calcium Oxide...............................................................Lime
Calcium Sulfate.................................................Plaster
of Paris
Carbonic Acid............................................................Seltzer
Cetyltrimethylammoniumbromide......................................Ammonium
Salt Ethylinedichloride...................................................Dutch
Fluid
Ferric Oxide...........................................................Iron
Rust Furfuraldehyde..........................................................Bran
Oil Glucose...............................................................Corn
Syrup
Graphite.............................................................Pencil
Lead
Hydrochloric Acid..................................................Muriatic
Acid
Hydrogen Peroxide.......................................................Peroxide
Lead Acetate.......................................................Sugar
of Lead
Lead Tero-oxide.........................................................Red
Lead
Magnesium Silicate..........................................................Talc
Magnesium Sulfate.....................................................Epsom
Salt Methylsalicylate................................................Winter
Green Oil Naphthalene............................................................Mothballs
Phenol.............................................................Carbolic
Acid
Potassium Bicarbonate............................................Cream
of Tarter
Potassium Chromium Sulfate............................................Chromealum
Potassium Nitrate.....................................................Salt
Peter
Sodium Oxide................................................................Sand
Sodium Bicarbonate...................................................Baking
Soda
Sodium Borate..............................................................Borax
Sodium Carbonate....................................................Washing
Soda
Sodium Chloride.............................................................Salt
Sodium Hydroxide.............................................................Lye
Sodium Silicate............................................................Glass
Sodium Sulfate....................................................Glauber's
Salt
Sodium Thiosulfate...........................................Photographer's
Hypo
Sulfuric Acid.......................................................Battery
Acid Sucrose...............................................................Cane
Sugar
Zinc Chloride.....................................................Tinner's
Fluid
Zinc Sulfate.......................................................White
Vitriol
32. Phone Taps
by The Jolly Roger
Here is some info on phone taps. In
this file is a schematic for a simple wiretap & instructions for hooking
up a small tape recorder control relay to the phone line. First, I will
discuss taps a little. There are many different types of taps. There are
transmitters, wired taps, and induction taps to name a few. Wired and wireless
transmitters must be physically connected to the line before they will
do any good. Once a wireless tap is connected to the line, it can transmit
all conversations over a limited reception range. The phones in the house
can even be modifies to pick up conversations in the room and transmit
them too! These taps are usually powered off of the phone line, but can
have an external power source. You can get more information on these taps
by getting an issue of Popular Communications and reading through the ads.
Wired taps, on the other hand, need no power source, but a wire must be
run from the line to the listener or to a transmitter. There are obvious
advantages of wireless taps over wired ones. There is one type of wireless
tap that looks like a normal telephone mike. All you have to do is replace
the original mike with this and it will transmit all conversations! There
is also an exotic type of wired tap known as the 'Infinity Transmitter'
or 'Harmonica Bug'. In order to hook one of these, it must be installed
inside the phone. When someone calls the tapped phone & *before* it
rings and blows a whistle over the line, the transmitter picks up the phone
via a relay. The mike on the phone is activated so that the caller can
hear all of the conversations in the room. There is a sweep tone test at
415/BUG-1111 which can be used to detect one of these taps. If one of these
is on your line & the test # sends the correct tone, you will hear
a click. Induction taps have one big advantage over taps that must be physically
wired to the phone. They do not have to be touching the phone in order
to pick up the conversation. They work on the same principle as the little
suction-cup tape recorder mikes that you can get at Radio Shack. Induction
mikes can be hooked up to a transmitter or be wired. Here is an example
of industrial espionage using the phone: A salesman walks into an office
& makes a phone call. He fakes the conversation, but when he hangs
up he slips some foam rubber cubes into the cradle. The called party can
still hear all conversations in the room. When someone picks up the phone,
the cubes fall away unnoticed. A tap can also be used on a phone to overhear
what your modem is doing when you are war-dialing, hacking, or just plain
calling a bbs. Here is the schematic: -------)!----)!(-------------> )!(
Cap ^ )!( )!( )!( )!( ^^^^^---)!(-------------> ^ 100K ! !
38. Aqua Box Plans
by The Jolly Roger
Every true phreaker lives in fear of
the dreaded FBI 'Lock In Trace'. For a long time, it was impossible to
escape from the Lock In Trace. This box does offer an escape route with
simple directions to it. This box is quite a simple concept, and almost
any phreaker with basic electronics knowledge can construct and use it.
The Lock In Trace A lock in trace is a device used by the FBI to lock into
the phone users location so that he can not hang up while a trace is in
progress. For those of you who are not familiar with the concept of 'locking
in', then here's a brief description. The FBI can tap into a conversation,
sort of like a three-way call connection. Then, when they get there, they
can plug electricity into the phone line. All phone connections are held
open by a certain voltage of electricity. That is why you sometimes get
static and faint connections when you are calling far away, because the
electricity has trouble keeping the line up. What the lock in trace does
is cut into the line and generate that same voltage straight into the lines.
That way, when you try and hang up, voltage is retained. Your phone will
ring just like someone was calling you even after you hang up. (If you
have call waiting, you should understand better about that, for call waiting
intercepts the electricity and makes a tone that means someone is going
through your line. Then, it is a matter of which voltage is higher. When
you push down the receiver, then it see-saws the electricity to the other
side. When you have a person on each line it is impossible to hang up unless
one or both of them will hang up. If you try to hang up, voltage is retained,
and your phone will ring. That should give you an understanding of how
calling works. Also, when electricity passes through a certain point on
your phone, the electricity causes a bell to ring, or on some newer phones
an electronic ring to sound.) So, in order to eliminate the trace, you
somehow must lower the voltage level on your phone line. You should know
that every time someone else picks up the phone line, then the voltage
does decrease a little. In the first steps of planning this out, Xerox
suggested getting about a hundred phones all hooked into the same line
that could all be taken off the hook at the same time. That would greatly
decrease the voltage level. That is also why most three-way connections
that are using the bell service three way calling (which is only $3 a month)
become quite faint after a while. By now, you should understand the basic
idea. You have to drain all of the power out of the line so the voltage
can not be kept up. Rather sudden draining of power could quickly short
out the FBI voltage machine, because it was only built to sustain the exact
voltage necessary to keep the voltage out. For now, imagine this. One of
the normal Radio Shack generators that you can go pick up that one end
of the cord that hooks into the central box has a phone jack on it and
the other has an electrical plug. This way, you can "flash" voltage through
the line, but cannot drain it. So, some modifications have to be done.
Materials A BEOC (Basic Electrical Output Socket), like a small lamp-type
connection, where you just have a simple plug and wire that would plug
into a light bulb. One of cords mentioned above, if you can't find one
then construct your own... Same voltage connection, but the restrainer
must be built in (I.E. The central box) Two phone jacks (one for the modem,
one for if you are being traced to plug the aqua box into) Some creativity
and easy work. Notice: No phones have to be destroyed/modified to make
this box, so don't go out and buy a new phone for it! Procedure All right,
this is a very simple procedure. If you have the BEOC, it could drain into
anything: a radio, or whatever. The purpose of having that is you are going
to suck the voltage out from the phone line into the electrical appliance
so there would be no voltage left to lock you in with. Take the connection
cord. Examine the plug at the end. It should have only two prongs. If it
has three, still, do not fear. Make sure the electrical appliance is turned
off unless you want to become a crispy critter while making this thing.
Most plugs will have a hard plastic design on the top of them to prevent
you from getting in at the electrical wires inside. Well, remove it. If
you want to keep the plug (I don't see why...) then just cut the top off.
When you look inside, Low and Behold, you will see that at the base of
the prongs there are a few wires connecting in. Those wires conduct the
power into the appliance. So, you carefully unwrap those from the sides
and pull them out until they are about an inch ahead of the prongs. If
you don't want to keep the jack, then just rip the prongs out. If you are,
cover the prongs with insulation tape so they will not connect with the
wires when the power is being drained from the line. Do the same thing
with the prongs on the other plug, so you have the wires evenly connected.
Now, wrap the end of the wires around each other. If you happen to have
the other end of the voltage cord hooked into the phone, stop reading now,
you're too fucking stupid to continue. After you've wrapped the wires around
each other, then cover the whole thing with the plugs with insulating tape.
Then, if you built your own control box or if you bought one, then cram
all the wires into it and reclose it. That box is your ticket out of this.
Re-check everything to make sure it's all in place. This is a pretty flimsy
connection, but on later models when you get more experienced at it then
you can solder away at it and form the whole device into one big box, with
some kind of cheap Mattel hand-held game inside to be the power connector.
In order to use it, just keep this box handy. Plug it into the jack if
you want, but it will slightly lower the voltage so it isn't connected.
When you plug it in, if you see sparks, unplug it and restart the whole
thing. But if it just seems fine then leave it. Use ---- Now, so you have
the whole thing plugged in and all... Do not use this unless the situation
is desperate! When the trace has gone on, don't panic, unplug your phone,
and turn on the appliance that it was hooked to. It will need energy to
turn itself on, and here's a great source... The voltage to keep a phone
line open is pretty small and a simple light bulb should drain it all in
and probably short the FBI computer at the same time.
39. Hindenberg
Bomb by The Jolly Roger
Needed: 1 Balloon 1 Bottle 1 Liquid
Plumber 1 Piece Aluminum foil 1 Length Fuse Fill the bottle 3/4 full with
Liquid Plumber and add a little piece of aluminum foil to it. Put the balloon
over the neck of the bottle until the balloon is full of the resulting
gas. This is highly flammable hydrogen. Now tie the balloon. Now light
the fuse, and let it rise. When the fuse contacts the balloon, watch out!!!
40. How to Kill
Someone with your Bare Hands by The Jolly Roger
This file will explain the basics of
hand-to-hand combat, and will tell of the best places to strike and kill
an enemy. When engaged in hand-to-hand combat, your life is always at stake.
There is only one purpose in combat, and that is to kill your enemy. Never
face an enemy with the idea of knocking him out. The chances are extremely
good that he will kill YOU instead. When a weapon is not available, one
must resort to the full use of his natural weapons. The natural weapons
are: The knife edge of your hands. Fingers folded at the second joint or
knuckle. The protruding knuckle of your second finger. The heel of your
hand. Your boot Elbows Knees Your Teeth. Attacking is a primary factor.
A fight was never won by defensive action. Attack with all of your strength.
At any point or any situation, some vulnerable point on your enemies body
will be open for attack. Do this while screaming as screaming has two purposes.
To frighten and confuse your enemy. To allow you to take a deep breath
which, in turn, will put more oxygen in your blood stream. Your balance
and balance of your enemy are two important factors; since, if you succeed
in making your enemy lose his balance, the chances are nine to one that
you can kill him in your next move. The best over-all stance is where your
feet are spread about shoulders width apart, with your right foot about
a foot ahead of the left. Both arms should be bent at the elbows parallel
to each other. Stand on the balls of your feet and bend your waist slightly.
Kind of like a boxer's crouch. Employing a sudden movement or a scream
or yell can throw your enemy off-balance. There are many vulnerable points
of the body. We will cover them now: Eyes: Use your fingers in a V-shape
and attack in gouging motion. Nose:(Extremely vulnerable) Strike with the
knife edge of the hand along the bridge, which will cause breakage, sharp
pain, temporary blindness, and if the blow is hard enough, death. Also,
deliver a blow with the heel of your hand in an upward motion, this will
shove the bone up into the brain causing death. Adam's Apple: This spot
is usually pretty well protected, but if you get the chance, strike hard
with the knife edge of your hand. This should sever the wind-pipe, and
then it's all over in a matter of minutes. Temple: There is a large artery
up here, and if you hit it hard enough, it will cause death. If you manage
to knock your enemy down, kick him in the temple, and he'll never get up
again. Back of the Neck: A rabbit punch, or blow delivered to the base
of the neck can easily break it, but to be safe, it is better to use the
butt of a gun or some other heavy blunt object. Upper lip: A large network
of nerves are located. These nerves are extremely close to the skin. A
sharp upward blow will cause extreme pain, and unconsciousness. Ears: Coming
up from behind an enemy and cupping the hands in a clapping motion over
the victims ears can kill him immediately. The vibrations caused from the
clapping motion will burst his eardrums, and cause internal bleeding in
the brain. Groin: A VERY vulnerable spot. If left open, get it with knee
hard, and he'll buckle over very fast. Kidneys: A large nerve that branches
off to the spinal cord comes very close to the skin at the kidneys. A direct
blow with the knife edge of your hand can cause death. There are many more
ways to kill and injure an enemy, but these should work best for the average
person. This is meant only as information and I would not recommend that
you use this for a simple High School Brawl. Use these methods only, in
your opinion, if your life is in danger. Any one of these methods could
very easily kill or cause permanent damage to someone. One more word of
caution, you should practice these moves before using them on a dummy,
or a mock battle with a friend. (You don't have to actually hit him to
practice, just work on accuracy.)
41. Phone Systems
Tutorial III by The Jolly Roger
Preface: This article will focus primarily
on the standard western electric single- Slot coin telephone (aka fortress
fone) which can be divided into 3 types: dial-tone first (dtf) coin-first
(cf): (i.e., it wants your $ before you receive a dial tone) dial post-pay
service (pp): you payafter the party answers Depositing coins (slugs):
Once you have deposited your slug into a fortress, it is subjected to a
Gamut of tests. The first obstacle for a slug is the magnetic trap. This
will stop any light-weight magnetic slugs and coins. If it passes this,
the slug is then classified as a nickel, dime, or Quarter. Each slug is
then checked for appropriate size and weight. If These tests are passed,
it will then travel through a nickel, dime, or quarter Magnet as appropriate.
These magnets set up an eddy current effect which Causes coins of the appropriate
characteristics to slow down so they Will follow the correct trajectory.
If all goes well, the coin will follow the Correct path (such as bouncing
off of the nickel anvil) where it will Hopefully fall into the narrow accepted
coin channel. The rather elaborate tests that are performed as the coin
travels down the Coin chute will stop most slugs and other undesirable
coins, such as Pennies, which must then be retrieved using the coin release
lever. If the slug miraculously survives the gamut, it will then strike
the Appropriate totalizer arm causing a ratchet wheel to rotate once for
every 5-cent increment (e.g., a quarter will cause it to rotate 5 times).
The totalizer then causes the coin signal oscillator to readout a dual-frequency
signal indicating the value deposited to acts (a computer) or the Tsps
operator. These are the same tones used by phreaks in the infamous red
boxes. For a quarter, 5 beep tones are outpulsed at 12-17 pulses per second
(pps). A dime causes 2 beep tones at 5 - 8« pps while a nickel causes
one beep tone at 5 - 8« pps. A beep consists of 2 tones: 2200 + 1700
hz. A relay in the fortress called the "B Relay" (yes, there is also an
'a relay') places a capacitor across the speech circuit during totalizer
readout to prevent the "customer" from hearing the red box tones. In older
3 slot phones: one bell (1050-1100 hz) for a nickel, two bells for a dime,
and one gong (800 hz) for a quarter are used instead of the modern dual-frequency
tones. TSPS & ACTS While fortresses are connected to the co of the
area, all transactions are handled via the traffic service position system
(tsps). In areas that do not have acts, all calls that require operator
assistance, such as calling card and collect, are automatically routed
to a tsps operator position. In an effort to automate fortress service,
a computer system known as automated coin toll service (acts) has been
implemented in many areas. Acts listens to the red box signals from the
fones and takes appropriate action. It is acts which says, "two dollars
please (pause) please deposit two dollars for the next ten seconds" (and
other variations). Also, if you talk for more than three minutes and then
hang-up, acts will call back and demand your money. Acts is also responsible
for automated calling card service. Acts also provide trouble diagnosis
for craftspeople (repairmen specializing in fortresses). For example, there
is a coin test which is great for tuning up red boxes. In many areas this
test can be activated by dialing 09591230 at a fortress (thanks to karl
marx for this information). Once activated it will request that you deposit
various coins. It will then identify the coin and outpulse the appropriate
red box signal. The coins are usually returned when you hang up. To make
sure that there is actually money in the fone, the co initiates a "ground
test" at various times to determine if a coin is actually in the fone.
This is why you must deposit at least a nickel in order to use a red box!
Green Boxes: Paying the initial rate in order to use a red box (on certain
fortresses) left a sour taste in many red boxer's mouths thus the green
box was invented. The green box generates useful tones such as coin collect,
coin return, and ringback. These are the tones that acts or the tsps operator
would send to The co when appropriate. Unfortunately, the green box cannot
be used at a fortress station but it must be used by the called party.
Here are the tones: Coin Collect 700 + 1100 Hz Coin Return 1100 + 1700
Hz Ringback 700 + 1700 Hz Before the called party sends any of these tones,
an operator released signal should be sent to alert the MF detectors at
the co. This can be accomplished by sending 900 + 1500 hz or a single
2600 hz wink (90 ms) followed by a 60 ms gap and then the appropriate signal
for at least 900 Ms. Also, do not forget that the initial rate is collected
shortly before the 3 minute period is up. Incidentally, once the above
MF tones for collecting and returning coins reach the co, they are converted
into an appropriate dc pulse (-130 volts for return & +130 volts for
collect). This pulse is then sent down the tip to the fortress. This causes
the coin relay to either return or collect the coins. The alleged "t-network"
takes advantage of this information. When a pulse for coin collect (+130
vdc) is sent down the line, it must be grounded somewhere. This is usually
either the yellow or black wire. Thus, if the wires are exposed, these
wires can be cut to prevent the pulse from being grounded. When the three
minute initial period is almost up, make sure that the black & yellow
wires are severed; then hang up, wait about 15 seconds in case of a second
pulse, reconnect the wires, pick up the fone, hang up again, and if all
goes well it should be "jackpot" time. Physical Attack: A typical fortress
weighs roughly 50 lbs. With an empty coin box. Most of this is accounted
for in the armor plating. Why all the security? Well, Bell contributes
it to the following: "social changes during the 1960's made the multislot
coin station a prime target for: vandalism, strong arm robbery, fraud,
and theft of service. This brought about the introduction of the more rugged
single slot coin station and a new environment for coin service." As for
picking the lock, I will quote Mr. Phelps: "We often fantasize about 'picking
the lock' or 'getting a master key.' Well, you can forget about it. I don't
like to discourage people, but it will save you from wasting a lot of our
time--time which can be put to better use (heh, heh)." As for physical
attack, the coin plate is secured on all four side by hardened steel bolts
which pass through two slots each. These bolts are in turn interlocked
by the main lock. One phreak I know did manage to take one of the 'mothers'
home (which was attached to a piece of plywood at a construction site;
otherwise, the permanent ones are a bitch to detach from the wall!). It
took him almost ten hours to open the coin box using a power drill, sledge
hammers, and crowbars (which was empty -- perhaps next time, he will deposit
a coin first to hear if it slushes down nicely or hits the empty bottom
with a clunk.) Taking the fone offers a higher margin of success. Although
this may be difficult often requiring brute force and there has been several
cases of back axles being lost trying to take down a fone! A quick and
dirty way to open the coin box is by using a shotgun. In Detroit, after
ecologists cleaned out a municipal pond, they found 168 coin phones rifled.
In colder areas, such as Canada, some shrewd people tape up the fones using
duct tape, pour in water, and come back the next day when the water will
have froze thus expanding and cracking the fone open. In one case, "unauthorized
coin collectors" where caught when they brought $6,000 in change to a bank
and the bank became suspicious... At any rate, the main lock is an eight
level tumbler located on the right side of the coin box. This lock has
390,625 possible positions (5 ^ 8, since there are 8 tumblers each with
5 possible positions) thus it is highly pick resistant! The lock is held
in place by 4 screws. If there is sufficient clearance to the right of
the fone, it is conceivable to punch out the screws using the drilling
pattern below (provided by Alexander Muddy in tap #32): !! ^ !! ! ! 1-
3/16 " !! ! !<--- --->!! 1-«" -------------------- ! ! ! !! !
! ! (+) (+)-! ----------- ---! !! ! ^ ! ! !! ! ! ! ! (Z) !! ! ! ! ! !!
! 2-3/16" ---! !! ! ! ! (+) (+) ! ! ! !! ! ! -------------------- -----------
!! !! (Z) KEYHOLE (+) SCREWS !! After this is accomplished, the lock can
be pushed backwards disengaging the lock from the cover plate. The four
bolts of the cover plate can then be retracted by turning the bolt works
with a simple key in the shape of the hole on the coin plate (see diagram
below). Of course, there are other methods and drilling patterns. _ ! !
( ) !_! [ROUGHLY] DIAGRAM OF COVER PLATE KEYHOLE The top cover uses a similar,
but not as strong locking method with the keyhole depicted above on the
top left hide and a regular lock (probably tumbler also) on the top right-hand
side. It is interesting to experiment with the coin chute and the fortresses
own "red box" which bell didn't have the balls to color red. Miscellaneous:
In a few areas (rural & Canada), post-pay service exists. With this
type of service, the mouthpiece is cut off until the caller deposits money
when the called party answers. This also allows for free calls to weather
and other dial-it services! Recently, 2600 magazine announced the clear
box which consists of a telephone pickup coil and a small amp. It is based
on the principal that the receiver is also a weak transmitter and that
by amplifying your signal you can talk via the transmitter thus avoiding
costly telephone charges! Most fortresses are found in the 9xxx area. Under
former bell areas, they usually start at 98xx (right below the 99xx official
series) and move downward. Since the line, not the fone, determines whether
or not a deposit must be made, dtf & charge-a-call fones make great
extensions! Finally, fortress fones allow for a new hobby--instruction
plate collecting. All that is required is a flat-head screwdriver and a
pair of needle-nose pliers. Simply use the screwdriver to lift underneath
the plate so that you can grab it with the pliers and yank downwards. I
would suggest covering the tips of the pliers with electrical tape to prevent
scratching. Ten cent plates are definitely becoming a "rarity!" Fortress
security: While a lonely fortress may seem the perfect target, beware!
The gestapo has been known to stake out fortresses for as long as 6 years
according to the grass roots quarterly. To avoid any problems, do not use
the same fones repeatedly for boxing, calling cards, & other experiments.
The Telco knows how much money should be in the coin box and when its not
there they tend to get perturbed (Read: Pissed Off).
42. Black Box
Plans by The Jolly Roger
Introduction: At any given time, the
voltage running through your phone is about 20 Volts. When someone calls
you, this voltage goes up to 48 Volts and rings the bell. When you answer,
the voltage goes down to about 10 Volts. The phone company pays attention
to this. When the voltage drops to 10, they start billing the person who
called you. Function: The Black Box keeps the voltage going through your
phone at 36 Volts, so that it never reaches 10 Volts. The phone company
is thus fooled into thinking you never answered the phone and does not
bill the caller. However, after about a half hour the phone company will
get suspicious and disconnect your line for about 10 seconds. Materials:
1 1.8K « Watt Resistor 1 1«V LED 1 SPST Switch Procedure: Open
your phone by loosening the two screws on the bottom and lifting the case
off. There should be three wires: Red, Green, and Yellow. We'll be working
with the Red Wire. Connect the following in parallel: The Resistor and
LED. The SPST Switch. In other words, you should end up with this: (Red
Wire) !---/\/\/\--O--! (Line)-----! !-----(Phone) !-----_/_------! /\/\/\
= Resistor O = LED _/_ = SPST Use: The SPST Switch is the On/Off Switch
of the Black Box. When the box is off, your phone behaves normally. When
the box is on and your phone rings, the LED flashes. When you answer, the
LED stays on and the voltage is kept at 36V, so the calling party doesn't
get charged. When the box is on, you will not get a dial tone and thus
cannot make calls. Also remember that calls are limited to half an hour.
PS Due to new Fone Company switching systems & the like, this may or
may not work in your area. If you live in Bumfuck Kentucky, then try this
out. I make no guarantees! (I never do...)
43. The Infamous
Blotto Box!! by The Jolly Roger
(I bet that no one has the balls to
build this one!) Finally, it is here! What was first conceived as a joke
to fool the innocent phreakers around America has finally been conceived!
Well, for you people who are unenlightened about the Blotto Box, here is
a brief summery of a legend. The Blotto Box For years now every pirate
has dreamed of the Blotto Box. It was at first made as a joke to mock more
ignorant people into thinking that the function of it actually was possible.
Well, if you are The Voltage Master, it is possible. Originally conceived
by King Blotto of much fame, the Blotto Box is finally available to the
public. NOTE: Jolly Roger can not be responsible for the information disclosed
in the file! This file is strictly for informational purposes and should
not be actually built and used! Usage of this electronical impulse machine
could have the severe results listed below and could result in high federal
prosecution! Again, I TAKE NO RESPONSIBILITY! All right, now that that
is cleared up, here is the basis of the box and it's function. The Blotto
Box is every phreaks dream... you could hold AT&T down on its knee's
with this device. Because, quite simply, it can turn off the phone lines
everywhere. Nothing. Blotto. No calls will be allowed out of an area code,
and no calls will be allowed in. No calls can be made inside it for that
matter. As long as the switching system stays the same, this box will not
stop at a mere area code. It will stop at nothing. The electrical impulses
that emit from this box will open every line. Every line will ring and
ring and ring... the voltage will never be cut off until the box/generator
is stopped. This is no 200 volt job, here. We are talking GENERATOR. Every
phone line will continue to ring, and people close to the box may be electrocuted
if they pick up the phone. But, the Blotto Box can be stopped by merely
cutting of the line or generator. If they are cut off then nothing will
emit any longer. It will take a while for the box to calm back down again,
but that is merely a superficial aftereffect. Once again: Construction
and use of this box is not advised! The Blotto Box will continue as long
as there is electricity to continue with. OK, that is what it does, now,
here are some interesting things for you to do with it... Blotto Functions/Installing
Once you have installed your Blotto, there is no turning back. The following
are the instructions for construction and use of this box. Please read
and heed all warnings in the above section before you attempt to construct
this box. Materials: A Honda portable generator or a main power outlet
like in a stadium or some such place. 400 volt rated coupler that splices
a female plug into a phone line jack. A meter of voltage to attach to the
box itself. A green base (i.e. one of the nice boxes about 3' by 4' that
you see around in your neighborhood. They are the main switch boards and
would be a more effective line to start with or a regular phone jack (not
your own, and not in your area code!) A soldering iron and much solder.
A remote control or long wooden pole. Now. You must have guessed the construction
from that. If not, here goes, I will explain in detail. Take the Honda
Portable Generator and all of the other listed equipment and go out and
hunt for a green base. Make sure it is one on the ground or hanging at
head level from a pole, not the huge ones at the top of telephone poles.
Open it up with anything convenient, if you are two feeble then fuck, don't
try this. Take a look inside... you are hunting for color-coordinating
lines of green and red. Now, take out your radio shack cord and rip the
meter thing off. Replace it with the voltage meter about. A good level
to set the voltage to is about 1000 volts. Now, attach the voltage meter
to the cord and set the limit for one thousand. Plug the other end of the
cord into the generator. Take the phone jack and splice the jack part off.
Open it up and match the red and green wires with the other red and green
wires. NOTE: If you just had the generator on and have done this in the
correct order, you will be a crispy critter. Keep the generator off until
you plan to start it up. Now, solder those lines together carefully. Wrap
duck tape or insulation tape around all of the wires. Now, place the remote
control right on to the startup of the generator. If you have the long
pole, make sure it is very long and stand back as far away as you can get
and reach the pole over. NOTICE: If you are going right along with this
without reading the file first, you still realize now that your area code
is about to become null! Then, getting back, twitch the pole/remote control
and run for your damn life. Anywhere, just get away from it. It will be
generating so much electricity that if you stand to close you will kill
yourself. The generator will smoke, etc. but will not stop. You are now
killing your area code, because all of that energy is spreading through
all of the phone lines around you in every direction. Have a nice day!
The Blotto Box: Aftermath Well, that is the plans for the most devastating
and ultimately deadly box ever created. My hat goes off to: King Blotto
(for the original idea).
44. Blowgun by
The Jolly Roger
In this article I shall attempt to
explain the use and manufacture of a powerful blow-gun and making darts
for the gun. The possession of the blow gun described in this article IS
a felony. So be careful where you use it. I don't want to get you all busted.
Needed: Several strands of yarn (About 2 inches a-piece). A regular pencil.
A 2 ¬ inch long needle (hopefully with a beaded head. If not obtainable,
wrap tape around end of needle. ¬ foot pipe. (PVC or Aluminum) Half
a inch in diameter. Constructing the dart: Carefully twist and pull the
metal part (Along with eraser) of the pencil till it comes off. Take Pin
and start putting about 5-7 Strands of yarn on the pin. Then push them
up to the top of the pin. But not over the head of the pin (or the tape).
Push pin through the hollow part of the head where the pencil was before.
That should for a nice looking dart. (see illustration) ##### >>>>>-----/
# is the yarn > is the head of the pencil - is the pin it-self / is the
head of the pin Using the Darts: Now take the finished dart and insert
it in the tube (if it is too small put on more yarn.) Aim the tube at a
door, wall, sister, ect. Blow on the end of the pipe. Sometimes the end
of the pipe may be sharp. When this happens I suggest you wrap it with
some black electrician tape. It should feel a lot better.
45. Brown Box
Plans by The Jolly Roger
This is a fairly simple mod that can
be made to any phone. All it does is allow you to take any two lines in
your house and create a party line. So far I have not heard of anyone who
has any problems with it. There is one thing that you will notice when
you are one of the two people who is called by a person with a brown box.
The other person will sound a little bit faint. I could overcome this with
some amplifiers but then there wouldn't be very many of these made [Why
not?]. I think the convenience of having two people on the line at once
will make up for any minor volume loss. Here is the diagram: KEY:___________________________________
| PART | SYMBOL | |---------------------------------| | BLACK WIRE | *
| | YELLOW WIRE | = | | RED WIRE | + | | GREEN WIRE | - | | SPDT SWITCH
| _/_ | | _/_ | | VERTICAL WIRE | | | | HORIZONTAL WIRE | _ | -----------------------------------
* = - + * = - + * = - + * = - + * = - + * ==_/_- + *******_/_++++++ | |
| | | | | | | | | | |_____PHONE____|
46. Calcium Carbide
Bomb by The Jolly Roger
This is EXTREMELY DANGEROUS. Exercise
extreme caution.... Obtain some calcium carbide. This is the stuff that
is used in carbide lamps and can be found at nearly any hardware store.
Take a few pieces of this stuff (it looks like gravel) and put it in a
glass jar with some water. Put a lid on tightly. The carbide will react
with the water to produce acetylene carbonate which is similar to the gas
used in cutting torches. Eventually the glass with explode from internal
pressure. If you leave a burning rag nearby, you will get a nice fireball!
47. More Ways
to Send a Car to Hell by The Jolly Roger
Due to a lot of compliments, I have
written an update to file #14. I have left the original intact. This expands
upon the original idea, and could be well called a sequel. How to have
phun with someone else's car. If you really detest someone, and I mean
detest, here's a few tips on what to do in your spare time. Move the windshield
wiper blades, and insert and glue tacks. The tacks make lovely designs.
If your "friend" goes to school with you, Just before he comes out of school.
Light a lighter and then put it directly underneath his car door handle.
Wait...Leave...Listen. When you hear a loud "shit!", you know he made it
to his car in time. Remove his muffler and pour approximately 1 Cup of
gas in it. Put the muffler back, then wait till their car starts. Then
you have a cigarette lighter. A 30 foot long cigarette lighter. This one
is effective, and any fool can do it. Remove the top air filter. That's
it! Or a oldie but goodie: sugar in the gas tank. Stuff rags soaked in
gas up the exhaust pipe. Then you wonder why your "friend" has trouble
with his/her lungs. Here's one that takes time and many friends. Take his/her
car then break into their house and reassemble it, in their living or bedroom.
Phun eh? If you're into engines, say eeni mine moe and point to something
and remove it. They wonder why something doesn't work. There are so many
others, but the real good juicy ones come by thinking hard.
48. Ripping off
Change Machines by The Jolly Roger
Have you ever seen one of those really
big changer machines in airports Laundromats or arcades that dispense change
when you put in your 1 or 5 dollar bill? Well then, here is an article
for you. Find the type of change machine that you slide in your bill length
wise, not the type where you put the bill in a tray and then slide the
tray in!!! After finding the right machine, get a $1 or $5 bill. Start
crumpling up into a ball. Then smooth out the bill, now it should have
a very wrinkly surface. Now the hard part. You must tear a notch in the
bill on the left side about « inch below the little 1 dollar symbol
(See Figure). If you have done all of this right then take the bill and
go out the machine. Put the bill in the machine and wait. What should happen
is: when you put your bill in the machine it thinks everything is fine.
When it gets to the part of the bill with the notch cut out, the machine
will reject the bill and (if you have done it right) give you the change
at the same time!!! So, you end up getting your bill back, plus the change!!
It might take a little practice, but once you get the hang of it, you can
get a lot of money! \-----Make notch here. About «" down from the
1.
49. Clear Box
Plans by The Jolly Roger
The clear box is a new device which
has just been invented that can be used throughout Canada and rural United
States. The clear box works on "PostPay" payphones (fortress fones). Those
are the payphones that don't require payment until after the connection
is established. You pick up the fone, get a dial tone, dial your number,
and then insert your money after the person answers. If you don't deposit
the money then you can not speak to the person on the other end because
your mouth piece is cut off but not the ear-piece. (obviously these phones
are nice for free calls to weather or time or other such recordings). All
you must do is to go to your nearby Radio Shack, or electronics store,
and get a four-transistor amplifier and a telephone suction cup induction
pick-up. The induction pick-up would be hooked up as it normally would
to record a conversation, except that it would be plugged into the output
of the amplifier and a microphone would be hooked to the input. So when
the party that is being called answers, the caller could speak through
the little microphone instead. His voice then goes through the amplifier
and out the induction coil, and into the back of the receiver where it
would then be broadcast through the phone lines and the other party would
be able to hear the caller. The Clear Box thus 'clears up' the problem
of not being heard. Luckily, the line will not be cut-off after a certain
amount of time because it will wait forever for the coins to be put in.
The biggest advantage for all of us about this new clear box is the fact
that this type of payphone will most likely become very common. Due to
a few things: 1st, it is a cheap way of getting the DTF, dial-tone-first
service, 2nd, it doesn't require any special equipment, (for the phone
company) This payphone will work on any phone line. Usually a payphone
line is different, but this is a regular phone line and it is set up so
the phone does all the charging, not the company.
50. CNA List by
The Jolly Roger
NPATEL NUMBERNPATEL NUMBERNPATEL
NUMBER201201-676-7070415415-543-6374709*** NONE ***202304-343-7016416416-443-0542712402-580-2255203203-789-6815417314-721-6626713713-861-7194204204-949-0900418514-725-2491714818-501-7251205205-988-7000419614-464-0123715608-252-6932206206-382-5124501405-236-6121716518-471-8111207617-787-5300502502-583-2861717412-633-5600208303-293-8777503206-382-5124718518-471-8111209415-543-2861504504-245-5330801303-293-8777212518-471-8111505303-293-8777802617-787-5300213415-781-5271506506-648-3041803912-784-0440214214-464-7400507402-580-2255804304-344-7935215412-633-5600509206-382-5124805415-543-2861216614-464-0123512512-828-2501806512-828-2501217217-525-5800513614-464-0123807416-443-0542218402-580-2255514514-725-2491808212-334-4336219317-265-4834515402-580-2255809212-334-4336301304-343-1401516518-471-8111812317-265-4834302412-633-5600517313-223-8690813813-228-7871303303-293-8777518518-471-8111814412-633-5600304304-344-8041519416-443-0542815217-525-5800305912-784-0440601601-961-8139816816-275-2782306306-347-2878602303-293-8777817214-464-7400307303-293-8777603617-787-5300818415-781-5271308402-580-2255604604-432-2996819514-725-2491309217-525-5800605402-580-2255901615-373-5791312312-796-9600606502-583-2861902902-421-4110313313-223-8690607518-471-8111904912-784-0440314314-721-6626608608-252-6932906313-223-8690315518-471-8111609201-676-7070907***
NONE ***316816-275-2782612402-580-2255912912-784-0440317317-265-4834613416-443-0542913816-275-2782318504-245-5330614614-464-0123914518-471-8111319402-580-2255615615-373-5791915512-828-2501401617-787-5300616313-223-8690916415-543-2861402402-580-2255617617-787-5300918405-236-6121403403-425-2652618217-525-5800919912-784-0440404912-784-0440619818-501-7251900201-676-7070405405-236-6121701402-580-2255406303-293-8777702415-543-2861408415-543-6374703304-344-7935409713-861-7194704912-784-0440412413-633-5600705416-979-3469413617-787-5300706***
NONE ***414608-252-6932707415-543-6374
51. Electronic
Terrorism by The Jolly Roger
It starts when a big, dumb lummox rudely
insults you. Being of a rational, intelligent disposition, you wisely choose
to avoid a (direct) confrontation. But as he laughs in your face, you smile
inwardly---your revenge is already planned. Follow your victim to his locker,
car, or house. Once you have chosen your target site, lay low for a week
or more, letting your anger boil. In the mean time, assemble your versatile
terrorist kit(details below.) Plant your kit at the designated target site
on a Monday morning between the hours of 4:00 am and 6:00 am. Include a
calm, suggestive note that quietly hints at the possibility of another
attack. Do not write it by hand! An example of an effective note: "don't
be such a jerk, or the next one will take off your hand. Have a nice day."
Notice how the calm tone instills fear. As if written by a homicidal psychopath.
Choose a strategic location overlooking the target site. Try to position
yourself in such a way that you can see his facial contortions. Sit back
and enjoy the fireworks! Assembly of the versatile, economic, and effective
terrorist kit #1: the parts you'll need are: 4 AA batteries 1 9-volt battery
1 SPDT mini relay (radio shack) 1 rocket engine(smoke bomb or m-80) 1 solar
igniter (any hobby store) 1 9-volt battery connector Take the 9-volt battery
and wire it through the relay's coil. This circuit should also include
a pair of contacts that when separated cut off this circuit. These contacts
should be held together by trapping them between the locker, mailbox, or
car door. Once the door is opened, the contacts fall apart and the 9-volt
circuit is broken, allowing the relay to fall to the closed position thus
closing the ignition circuit. (If all this is confusing take a look at
the schematic below.) Take the 4 AA batteries and wire them in succession.
Wire the positive terminal of one to the negative terminal of another,
until all four are connected except one positive terminal and one negative
terminal. Even though the four AA batteries only combine to create 6 volts,
the increase in amperage is necessary to activate the solar igniter quickly
and effectively. Take the battery pack (made in step 2) and wire one end
of it to the relay's single pole and the other end to one prong of the
solar igniter. Then wire the other prong of the solar igniter back to the
open position on the relay. Using double sided carpet tape mount the kit
in his locker, mailbox, or car door. And last, insert the solar igniter
into the rocket engine (smoke bomb or m-80). Your kit is now complete!
---------><--------- I (CONTACTS) I I I I - (BATTERY) I --- I I I (COIL)
I ------///////------- /----------- / I / I / I (SWITCH) I I I I I ---
(BATTERY) I - ( PACK ) I --- I I I I ---- ----- I I * (SOLAR IGNITER)
52. How to Start
A Conference w/o 2600hz or M-F by The Jolly Roger
This method of starting the conf. Depends
on your ability to bullshit the operator into dialing a number which can
only be reached with an operator's M-F tones. When bullshitting the operator
remember operator's are not hired to think but to do. Here is a step-by-step
way to the conf.: Call the operator through a pbx or extender, you could
just call one Through your line but I wouldn't recommend it. Say to the
operator: TSPS maintenance engineer, ring-forward to 213+080+1100, position
release, thank you.(she will probably ask you for the number again) Definitions:
Ring-forward instructs her to dial the number. Position release instructs
her to release the trunk after she has dialed the number. + - remember
to say 213plus080 plus1100. 3. When you are connected with the conf. You
will here a whistle blow twice and a recording asking you for your operator
number. Dial in any five digits and hit the pounds sign a couple of times.
Simply dial in the number of the billing line ect. When the recording ask
for it. When in the control mode of the conf. Hit '6' to transfer control.
Hit '001' to reenter the number of conferee's and time amount which you
gave when you stared the conf. Remember the size can be from 2-59 conferee's.
I have not found out the 'lengths' limits.
53. How to Make
Dynamite by The Jolly Roger
Dynamite is nothing more than just
nitroglycerin and a stabilizing agent to make it much safer to use. The
numbers are percentages, be sure to mix these carefully and be sure to
use the exact amounts. These percentages are in weight ratio, not volume.
NumberIngredientsAmount1stNitroglycerin32% Sodium Nitrate28%
Woodmeal10% Ammonium Oxalate29% Guncotton1%2ndNitroglycerin24%
Potassium Nitrate9% Sodium Nitrate56% Woodmeal9% Ammonium
Oxalate2%3rdNitroglycerin35«% Potassium Nitrate44«%
Woodmeal6% Guncotton2«% Vaseline5«% Powdered Charcoal6%4thNitroglycerin25%
Potassium Nitrate26% Woodmeal34% Barium Nitrate5% Starch10%5thNitroglycerin57%
Potassium Nitrate19% Woodmeal9% Ammonium Oxalate12% Guncotton3%6thNitroglycerin18%
Sodium Nitrate70% Woodmeal5«% Potassium Chloride4«%
Chalk2%7thNitroglycerin26% Woodmeal40% Barium Nitrate32%
Sodium Carbonate2%8thNitroglycerin44% Woodmeal12% Anhydrous
Sodium Sulfate44%9thNitroglycerin24% Potassium Nitrate32«%
Woodmeal33«% Ammonium Oxalate10%10thNitroglycerin26%
Potassium Nitrate33% Woodmeal41%11thNitroglycerin15% Sodium
Nitrate62.9% Woodmeal21.2% Sodium Carbonate.9%12thNitroglycerin35%
Sodium Nitrate27% Woodmeal10% Ammonium Oxalate1%13thNitroglycerin32%
Potassium Nitrate27% Woodmeal10% Ammonium Oxalate30% Guncotton1%14thNitroglycerin33%
Woodmeal10.3% Ammonium Oxalate29% Guncotton.7% Potassium Perchloride27%15thNitroglycerin40%
Sodium Nitrate45% Woodmeal15%16thNitroglycerin47% Starch50%
Guncotton3%17thNitroglycerin30% Sodium Nitrate22.3% Woodmeal40«%
Potassium Chloride7.2%18thNitroglycerin50% Sodium Nitrate32.6%
Woodmeal17% Ammonium Oxalate.4%19thNitroglycerin23% Potassium
Nitrate27«%Woodmeal37% Ammonium Oxalate8% Barium Nitrate4%
Calcium Carbonate«% If you can't seem to get one or more of the
ingredients try another one. If you still can't, you can always buy small
amounts from your school, or maybe from various chemical companies. When
you do that, be sure to say as little as possible, if during the school
year, and they ask, say it's for a experiment for school.
54. Auto Exhaust
Flame Thrower by The Jolly Roger
For this one, all you need is a car,
a spark plug, ignition wire and a switch. Install the spark plug into the
last four or five inches of the tail pipe by drilling a hole that the plug
can screw into easily. Attach the wire (this is regular insulated wire)
to one side of the switch and to the spark plug. The other side of the
switch is attached to the positive terminal on the battery. With the car
running, simply hit the switch and watch the flames fly!!! Again be careful
that no one is behind you! I have seen some of these flames go 20 feet!!!
55. Breaking into
BBS Express by The Jolly Roger
If you have high enough access on any
BBS Express BBS you can get the Sysop's password without any problems and
be able to log on as him and do whatever you like. Download the Pass file,
delete the whole BBS, anything. Its all a matter of uploading a text file
and downloading it from the BBS. You must have high enough access to see
new uploads to do this. If you can see a file you just uploaded you have
the ability to break into the BBS in a few easy steps. Why am I telling
everyone this when I run BBS Express myself? Well there is one way to stop
this from happening and I want other Sysops to be aware of it and not have
it happen to them. Breaking in is all based on the MENU function of BBS
Express. Express will let you create a menu to display different text files
by putting the word MENU at the top of any text file and stating what files
are to be displayed. But due to a major screw up by Mr. Ledbetter you can
use this MENU option to display the USERLOG and the Sysop's Passwords or
anything else you like. I will show you how to get the Sysop's pass and
therefore log on as the Sysop. BBs Express Sysop's have 2 passwords. One
like everyone else gets in the form of X1XXX, and a Secondary password
to make it harder to hack out the Sysops pass. The Secondary pass is found
in a file called SYSDATA.DAT. This file must be on drive 1 and is therefore
easy to get. All you have to do is upload this simple Text file: MENU 1
D1:SYSDATA.DAT Rip-off time! After you upload this file you download it
non-Xmodem. Stupid Express thinks it is displaying a menu and you will
see this: Rip-off time! Selection [0]: Just hit 1 and Express will display
the SYSDATA.DAT file. OPPASS is where the Sysop's Secondary pass will be.
D1:USERLOG.DAT is where you will find the name and Drive number of the
USERLOG.DAT file. The Sysop might have renamed this file or put it in a
Subdirectory or even on a different drive. I Will Assume he left it as
D1:USERLOG.DAT. The other parts of this file tell you where the .HLP screens
are and where the LOG is saved and all the Download path names. Now to
get the Sysop's primary pass you upload a text file like this: MENU 1 D1:USERLOG.DAT
Breaking into Bedwetter's BBS Again you then download this file non-Xmodem
and you will see: Breaking into Bedwetter's BBS Selection [0]: You then
hit 1 and the long USERLOG.DAT file comes flying at you. The Sysop is the
first entry in this very long file so it is easy. You will see: SYSOP'S
NAME X1XXX You should now have his 2 passwords. There is only one easy
way out of this that I can think of, and that is to make all new uploads
go to SYSOP level (Level 9) access only. This way nobody can pull off what
I just explained. I feel this is a major Bug on Mr. Ledbetter's part. I
just don't know why no one had thought of it before. I would like to give
credit to Redline for the message he left on Modem Hell telling about this
problem, and also to Unka for his ideas and input about correcting it.
56. Firebombs
by The Jolly Roger
Most fire bombs are simply gasoline
filled bottles with a fuel soaked rag in the mouth (the bottle's mouth,
not yours). The original Molotov cocktail, and still about the best, was
a mixture of one part gasoline and one part motor oil. The oil helps it
to cling to what it splatters on. Some use one part roofing tar and one
part gasoline. Fire bombs have been found which were made by pouring melted
wax into gasoline.
57. Fuse Ignition
Bomb by The Jolly Roger
A four strand homemade fuse is used
for this. It burns like fury. It is held down and concealed by a strip
of bent tin cut from a can. The exposed end of the fuse is dipped into
the flare igniter. To use this one, you light the fuse and hold the fire
bomb until the fuse has burned out of sight under the tin. Then throw it
and when it breaks, the burning fuse will ignite the contents.
58. Generic Bomb
by The Jolly Roger
Acquire a glass container. Put in a
few drops of gasoline. Cap the top. Now turn the container around to coat
the inner surfaces and then evaporates. Add a few drops of potassium permanganate
(Get this stuff from a snake bite kit) The bomb is detonated by throwing
against a solid object. After throwing this thing, run like hell. This
thing packs about « stick of dynamite.
59. Green Box
Plans by the Jolly Roger
Paying the initial rate in order to
use a red box (on certain fortresses) left a sour taste in many red boxers
mouths, thus the green box was invented. The green box generates useful
tones such as COIN COLLECT, COIN RETURN, AND RINGBACK. These are the tones
that ACTS or the TSPS operator would send to the CO when appropriate. Unfortunately,
the green box cannot be used at the fortress station but must be used by
the CALLED party. Here are the tones: COIN COLLECT 700+1100hz COIN RETURN
1100+1700hz RINGBACK 700+1700hz Before the called party sends any of these
tones, an operator release signal should be sent to alert the MF detectors
at the CO. This can be done by sending 900hz + 1500hz or a single 2600
wink (90 ms.) Also do not forget that the initial rate is collected shortly
before the 3 minute period is up. Incidentally, once the above MF tones
for collecting and returning coins reach the CO, they are converted into
an appropriate DC pulse (-130 volts for return and +130 for collect). This
pulse is then sent down the tip to the fortress. This causes the coin relay
to either return or collect the coins. The alleged "T-network" takes advantage
of this information. When a pulse for coin collect (+130 VDC) is sent down
the line, it must be grounded somewhere. This is usually the yellow or
black wire. Thus, if the wires are exposed, these wires can be cut to prevent
the pulse from being grounded. When the three minute initial period is
almost up, make sure that the black and yellow wires are severed, then
hang up, wait about 15 seconds in case of a second pulse, reconnect the
wires, pick up the phone, and if all goes well, it should be "JACKPOT"
time.
60. Portable Grenade
Launcher by The Jolly Roger
If you have a bow, this one is for
you. Remove the ferrule from an aluminum arrow, and fill the arrow with
black powder (I use grade FFFF, it burns easy)and then glue a shotshell
primer into the hole left where the ferrule went. Next, glue a BB on the
primer, and you are ready to go! Make sure no one is nearby.... Little
shreds of aluminum go all over the place!!
61. Hacking Tutorial
by The Jolly Roger
What is hacking? According to popular
belief the term hacker and hacking was founded at MIT it comes from the
root of a hack writer, someone who keeps "hacking" at the typewriter until
he finishes the story. A computer hacker would be hacking at the keyboard
or password works. What you need: To hack you need a computer equipped
with a modem (a device that lets you transmit data over phone lines) which
should cost you from $100 to $1200. How do you hack? Hacking requires two
things: The phone number. Answer to identity elements. How do you find
the phone number? There are three basic ways to find a computers phone
number: Scanning Directory Inside info What is scanning? Scanning is the
process of having a computer search for a carrier tone. For example, the
computer would start at (800) 111-1111 and wait for carrier if there is
none it will go on to 111-1112 etc. If there is a carrier it will record
it for future use and continue looking for more. What is directory assistance?
This way can only be used if you know where your target computer is. For
this example say it is in menlo park, CA and the company name is Sri. Dial
411 (or 415-555-1212) Say "Menlo park" Say "Sri" Write down number Ask
if there are any more numbers If so write them down. Hang up on operator
Dial all numbers you were given Listen for carrier tone If you hear carrier
tone write down number, call it on your modem and your set to hack!
62. The Basics
of Hacking II by The Jolly Roger
Basics to know before doing anything,
essential to your continuing career as one of the elite in the country...
This article, "The introduction to the world of hacking." is meant to help
you by telling you how not to get caught, what not to do on a computer
system, what type of equipment should I know about now, and just a little
on the history, past present future, of the hacker. Welcome to the world
of hacking! We, the people who live outside of the normal rules, and have
been scorned and even arrested by those from the 'civilized world', are
becoming scarcer every day. This is due to the greater fear of what a good
hacker (skill wise, no moral judgments here) can do nowadays, thus causing
anti- hacker sentiment in the masses. Also, few hackers seem to actually
know about the computer systems they hack, or what equipment they will
run into on the front end, or what they could do wrong on a system to alert
the 'higher' authorities who monitor the system. This article is intended
to tell you about some things not to do, even before you get on the system.
I will tell you about the new wave of front end security devices that are
beginning to be used on computers. I will attempt to instill in you a second
identity, to be brought up at time of great need, to pull you out of trouble.
And, by the way, I take no, repeat, no, responsibility for what we say
in this and the forthcoming articles. Enough of the bullshit, on to the
fun: after logging on your favorite bbs, you see on the high access board
a phone number! It says it's a great system to "fuck around with!" This
may be true, but how many other people are going to call the same number?
So: try to avoid calling a number given to the public. This is because
there are at least every other user calling, and how many other boards
will that number spread to? If you call a number far, far away, and you
plan on going through an extender or a re-seller, don't keep calling the
same access number (I.E. As you would if you had a hacker running), this
looks very suspicious and can make life miserable when the phone bill comes
in the mail. Most cities have a variety of access numbers and services,
so use as many as you can. Never trust a change in the system... The 414's,
the assholes, were caught for this reason: when one of them connected to
the system, there was nothing good there. The next time, there was a trek
game stuck right in their way! They proceeded to play said game for two,
say two and a half hours, while telenet was tracing them! Nice job, don't
you think? If anything looks suspicious, drop the line immediately!! As
in, yesterday!! The point we're trying to get across is: if you use a little
common sense, you won't get busted. Let the little kids who aren't smart
enough to recognize a trap get busted, it will take the heat off of the
real hackers. Now, let's say you get on a computer system... It looks great,
checks out, everything seems fine. OK, now is when it gets more dangerous.
You have to know the computer system to know what not to do. Basically,
keep away from any command something, copy a new file into the account,
or whatever! Always leave the account in the same status you logged in
with. Change *nothing*... If it isn't an account with priv's, then don't
try any commands that require them! All, yes all, systems are going to
be keeping log files of what users are doing, and that will show up. It
is just like dropping a trouble-card in an ESS system, after sending that
nice operator a pretty tone. Spend no excessive amounts of time on the
account in one stretch. Keep your calling to the very late night if possible,
or during business hours (believe it or not!). It so happens that there
are more users on during business hours, and it is very difficult to read
a log file with 60 users doing many commands every minute. Try to avoid
systems where everyone knows each other, don't try to bluff. And above
all: never act like you own the system, or are the best there is. They
always grab the people who's heads swell... There is some very interesting
front end equipment around nowadays, but first let's define terms... By
front end, we mean any device that you must pass through to get at the
real computer. There are devices that are made to defeat hacker programs,
and just plain old multiplexers. To defeat hacker programs, there are now
devices that pick up the phone and just sit there... This means that your
device gets no carrier, thus you think there isn't a computer on the other
end. The only way around it is to detect when it was picked up. If it picks
up after the same number ring, then you know it is a hacker-defeater. These
devices take a multi-digit code to let you into the system. Some are, in
fact, quite sophisticated to the point where it will also limit the user
name's down, so only one name or set of names can be valid logins after
they input the code... Other devices input a number code, and then they
dial back a pre-programmed number for that code. These systems are best
to leave alone, because they know someone is playing with their phone.
You may think "but I'll just reprogram the dial-back." Think again, how
stupid that is... Then they have your number, or a test loop if you were
just a little smarter. If it's your number, they have your balls (if male...),
if its a loop, then you are screwed again, since those loops are *monitored*.
As for multiplexers... What a plexer is supposed to do is this: The system
can accept multiple users. We have to time share, so we'll let the front-end
processor do it... Well, this is what a multiplexer does. Usually they
will ask for something like "enter class" or "line:". Usually it is programmed
for a double digit number, or a four to five letter word. There are usually
a few sets of numbers it accepts, but those numbers also set your 300/1200/2400
baud data type. These multiplexers are inconvenient at best, so not to
worry. A little about the history of hacking: hacking, by my definition,
means a great knowledge of some special area. Doctors and lawyers are hackers
of a sort, by this definition. But most often, it is being used in the
computer context, and thus we have a definition of "anyone who has a great
amount of computer or telecommunications knowledge." You are not a hacker
because you have a list of codes... Hacking, by my definition, has then
been around only about 15 years. It started, where else but, MIT and colleges
where they had computer science or electrical engineering departments.
Hackers have created some of the best computer languages, the most awesome
operating systems, and even gone on to make millions. Hacking used to have
a good name, when we could honestly say "we know what we are doing". Now
it means (in the public eye): the 414's, Ron Austin, the NASA hackers,
the arpanet hackers... All the people who have been caught, have done damage,
and are now going to have to face fines and sentences. Thus we come past
the moralistic crap, and to our purpose: educate the hacker community,
return to the days when people actually knew something...
63. Hacking DEC's
by The Jolly Roger
In this article you will learn how
to log in to dec's, logging out, and all the fun stuff to do in-between.
All of this information is based on a standard dec system. Since there
are dec systems 10 and 20, and I favor, the dec 20, there will be more
info on them in this article. It just so happens that the dec 20 is also
the more common of the two, and is used by much more interesting people
(if you know what I mean...) OK, the first thing you want to do when you
are receiving carrier from a dec system is to find out the format of login
names. You can do this by looking at who is on the system. Dec=> ` (the
'exec' level prompt) you=> sy sy: short for sy(stat) and shows you the
system status. You should see the format of login names. A systat usually
comes up in this form: Job Line Program User Job: The job number (not important
unless you want to log them off later) Line: What line they are on (used
to talk to them...) These are both two or three digit numbers. Program:
What program are they running under? If it says 'exec' they aren't doing
anything at all... User: ahhhahhhh! This is the user name they are logged
in under... Copy the format, and hack yourself outa working code... Login
format is as such: dec=> ` you=> login username password Username is the
username in the format you saw above in the systat. After you hit the space
after your username, it will stop echoing characters back to your screen.
This is the password you are typing in... Remember, people usually use
their name, their dog's name, the name of a favorite character in a book,
or something like this. A few clever people have it set to a key cluster
(qwerty or asdfg). Passwords can be from 1 to 8 characters long, anything
after that is ignored. You are finally in... It would be nice to have a
little help, wouldn't it? Just type a ? Or the word help, and it will give
you a whole list of topics... Some handy characters for you to know would
be the control keys, wouldn't it? Backspace on a dec 20 is rub which is
255 on your ASCII chart. On the dec 10 it is control-H. To abort a long
listing or a program, control-C works fine. Use Control-O to stop long
output to the terminal. This is handy when playing a game, but you don't
want to control-C out. Control-T for the time. Control-u will kill the
whole line you are typing at the moment. You may accidentally run a program
where the only way out is a control-X, so keep that in reserve. Control-s
to stop listing, control-Q to continue on both systems. Is your terminal
having trouble?? Like, it pauses for no reason, or it doesn't backspace
right? This is because both systems support many terminals, and you haven't
told it what yours is yet... You are using a VT05 so you need to tell it
you are one. Dec=> ` you=> information terminal -or- You=> info (This shows
you what your terminal is set up as.) Dec=>all sorts of shit, then the
` you=> set ter vt05 (This sets your terminal type to VT05.) Now let's
see what is in the account (here after abbreviated acct.) that you have
hacked onto. Say: => dir (Short for directory.) It shows you what the user
of the code has save to the disk. There should be a format like this: xxxxx.Oooxxxxx
is the file name, from 1 to 20 characters long. Ooo is the file type, one
of: exe, txt, dat, bas, cmd and a few others that are system dependant.
Exe is a compiled program that can be run (just by typing its name at the
`) Txt is a text file, which you can see by typing: =>type xxxxx.Txt Do
not try to: =>type xxxxx.Exe (This is very bad for your terminal and will
tell you absolutely nothing.) Dat is data they have saved. Bas is a basic
program, you can have it typed out for you. Cmd is a command type file,
a little too complicated to go into here. Try: =>take xxxxx.Cmd By the
way, there are other users out there who may have files you can use. (Gee,
why else am I here?) => dir <*.*> (Dec 20) => dir [*,*] (Dec 10) * is
a wildcard, and will allow you to access the files on other accounts if
the user has it set for public access. If it isn't set for public access,
then you won't see it. To run that program: dec=> ` you=> username program-name
Username is the directory you saw the file listed under, and file name
was what else but the file name? ** You are not alone ** remember, you
said (at the very start) sy short for systat, and how we said this showed
the other users on the system? Well, you can talk to them, or at least
send a message to anyone you see listed in a systat. You can do this by:
dec=> the user list (from your systat) you=> talkusername (Dec 20) send
username (Dec 10) Talk allows you and them immediate transmission of whatever
you/they type to be sent to the other. Send only allow you one message
to be sent, and send, they will send back to you, with talk you can just
keep going. By the way, you may be noticing with the talk command that
what you type is still acted upon by the parser (control program). To avoid
the constant error messages type either: you=> ;your message you=> rem
your message the semi-colon tells the parser that what follows is just
a comment. Rem is short for 'remark' and ignores you from then on until
you type a control-Z or control-C, at which point it puts you back in the
exec mode. To break the connection from a talk command type: you=> break
priv's: If you happen to have privs, you can do all sorts of things. First
of all, you have to activate those privs. You=> enable This gives you a
$ prompt, and allows you to do this: whatever you can do to your own directory
you can now do to any other directory. To create a new acct. Using your
privs, just type: =>build username If username is old, you can edit it,
if it is new, you can define it to be whatever you wish. Privacy means
nothing to a user with privs. By the way, there are various levels of privs:
operator, wheel, cia. Wheel is the most powerful, being that he can log
in from anywhere and have his powers. Operators have their power because
they are at a special terminal allowing them the privs. Cia is short for
'confidential information access', which allows you a low level amount
of privs. Not to worry though, since you can read the system log file,
which also has the passwords to all the other accounts. To de-activate
your privs, type: you=> disable when you have played your greedy heart
out, you can finally leave the system with the command: =>logout This logs
the job you are using off the system (there may be varients of this such
as kjob, or killjob.)
64. Harmless Bombs
by The Jolly Roger
To all those who do not wish to inflict
bodily damage on their victims but only terror. These are weapons that
should be used from high places. The Flour Bomb Take a wet paper towel
and pour a given amount of baking flour in the center. Then wrap it up
and put on a rubber band to keep it together. When thrown it will fly well
but when it hits, it covers the victim with the flower or causes a big
puff of flour which will put the victim in terror since as far as they
are concerned, some strange white powder is all over them. This is a cheap
method of terror and for only the cost of a roll of paper towels and a
bag of flour you and your friends can have loads of fun watching people
flee in panic. Smoke Bomb Projectile All you need is a bunch of those little
round smoke bombs and a wrist rocket or any sling-shot. Shoot the smoke
bombs and watch the terror since they think it will blow up! Rotten Eggs
(Good ones) Take some eggs and get a sharp needle and poke a small hole
in the top of each one. Then let them sit in a warm place for about a week.
Then you've got a bunch of rotten eggs that will only smell when they hit.
Glow in the Dark Terror Take one of those tubes of glow in the dark stuff
and pour the stuff on whatever you want to throw and when it gets on the
victim, they think it's some deadly chemical or a radioactive substance
so they run in total panic. This works especially well with flower bombs
since a gummy, glowing substance gets all over the victim. Fizzling Panic
Take a baggy of a water-baking soda solution and seal it. (Make sure there
is no air in it since the solution will form a gas and you don't want it
to pop on you.) Then put it in a bigger plastic bag and fill it with vinegar
and seal it. When thrown, the two substances will mix and cause a violently
bubbling substance to go all over the victim.
65. Breaking Into
Houses by The Jolly Roger
Okay You Need: Tear Gas or Mace A BB/Pellet
Gun An Ice Pick Thick Gloves What You Do Is: Call the house, or ring doorbell,
to find out if they're home. If they're not home then... Jump over the
fence or walk through gate (whatever). If you see a dog give him the mace
or tear gas. Put the gloves on!!!!!!! Shoot the BB gun slightly above the
window locks. Push the ice-pick through the hole (made by the BB gun).
Enter window. FIRST...Find the LIVING ROOM. (there're neat things there!).
Goto the bedroom to get a pillow case. Put the goodies in the pillow case.
Get out <-* FAST! -*> Notes: You should have certain targets worked
out (like computers, Radios, Ect.) Also <-* NEVER *-> Steal from your
own neighborhood. If you think they have an alarm...<-* FORGET IT! *->.
66. A Guide to
Hypnotism by The Jolly Roger
What hypnotism is? Hypnotism, contrary
to common belief, is merely state when your mind and body are in a state
of relaxation and your mind is open to positive, or cleverly worded negative,
influences. It is not a trance where you: Are totally influenceable. Cannot
lie. A sleep which you cannot wake up from without help. This may bring
down your hope somewhat, but, hypnotism is a powerful for self help, and/or
mischief. Your subconscious mind Before going in further, I'd like to state
that hypnotism not only is great in the way that it relaxes you and gets
you (in the long run) what you want, but also that it taps a force of incredible
power, believe it or not, this power is your subconscious mind. The subconscious
mind always knows what is going on with every part of your body, every
moment of the day. It protects you from negative influences, and retains
the power to slow your heartbeat down and stuff like that. The subconscious
mind holds just about all the info you would like to know About yourself,
or, in this case, the person you will be hypnotizing. There are many ways
to talk to your subconscious and have it talk back to you. One way is the
ouja board, no its not a spirit, merely the minds of those who are using
it. Another, which I will discuss here, is the pendulum method. OK, here
is how it goes. First, get a ring or a washer and tie it to a thread a
little longer than half of your forearm. Now, take a sheet of paper and
draw a big circle in it. In the big circle you must now draw a crosshair
(a big +). Now, put the sheet of paper on a table. Next, hold the thread
with the ring or washer on it and place it (holding the thread so that
the ring is 1 inch above the paper swinging) in the middle of the crosshair.
Now, swing the thread so the washer goes up and down, say to yourself the
word "Yes" now, do it side to side and say the word "no". Do it counter
clockwise and say "I don't know". And lastly, do it clockwise and say "I
don't want to say." Now, with the thread back in the middle of the crosshair,
ask yourself questions and wait for the pendulum to swing in the direction
for the answer. (yes, no, I don't know or I don't want to say...). Soon,
to your amazement, it will be answering questions like anything... Let
the pendulum answer, don't try.. When you try you will never get an answer.
Let the answer come to you. How to induce hypnotism Now that you know how
to talk to your subconscious mind, I will now tell you how to guide someone
into hypnosis. Note that I said guide, you can never, hypnotize someone,
they must be willing. OK, the subject must be lying or sitting in a comfortable
position, relaxed, and at a time when things aren't going to be interrupted.
Tell them the following or something close to it, in a peaceful, monotonous
tone (not a commanding tone of voice) Note: Light a candle and place it
somewhere where it can be easily seen. "Take a deep breath through your
nose and hold it in for a count of 8. Now, through your mouth, exhale completely
and slowly. Continued breathing long, deep, breaths through your nose and
exhaling through your mouth. Tense up all your muscles very tight, now,
counting from ten to one, release them slowly, you will find them very
relaxed. Now, look at the candle, as you look at it, with every breath
and passing moment, you are feeling increasingly more and more peaceful
and relaxed. The candles flame is peaceful and bright. As you look at it
I will count from 100 down, as a count, your eyes will become more and
more relaxed, getting more and more tired with each passing moment." Now,
count down from 100, about every 10 numbers say "When I reach xx your eyes
(or you will find your eyes) are becoming more and more tired." Tell them
they may close their eyes whenever they feel like it. If the persons eyes
are still open when you get to 50 then instead of saying "your eyes will.."
Say "your eyes are...". When their eyes are shut say the following. As
you lie (or sit) here with your eyes comfortably close you find yourself
relaxing more and more with each moment and breath. The relaxation feels
pleasant and blissful so, you happily give way to this wonderful feeling.
Imagine yourself on a cloud, resting peacefully, with a slight breeze caressing
your body. A tingling sensation begins to work its way, within and without
your toes, it slowly moves up your feet, making them warm, heavy and relaxed.
The cloud is soft and supports your body with its soft texture, the scene
is peaceful and absorbing, the peacefulness absorbs you completely. The
tingling gently and slowly moves up your legs, relaxing them. Making them
warm and heavy. The relaxation feels very good, it feels so good to relax
and let go. As the tingling continues its journey up into your solar plexus,
you feel your inner stomach become very relaxed. Now, it moves slowly into
your chest, making your breathing relaxed as well. The feeling begins to
move up your arms to your shoulders, making your arms heavy and relaxed
as well. You are aware of the total relaxation you are now experiencing,
and you give way to it. It is good and peaceful, the tingling now moves
into your face and head, relaxing your jaws, neck, and facial muscles,
making your cares and worries float away. Away into the blue sky as you
rest blissfully on the cloud. If they are not responsive or you think they
(he or she) is going to sleep, then add in a "...always concentrating upon
my voice, ignoring all other sounds. Even though other sounds exists, they
aid you in your relaxation..." They should soon let out a sigh as if they
were letting go, and their face should have a "woodiness" to it, becoming
featureless... Now, say the following "... You now find yourself in a hallway,
the hallway is peaceful and nice. As I count from 10 to 1 you will imagine
yourself walking further and further down the hall. When I reach one you
will find yourself where you want to be, in another, higher state of conscious
and mind. (count from ten to one)..." Do this about three or four times.
Then, to test if the subject is under hypnosis or not, say "... You feel
a strange sensation in your (arm they write with) arm, the feeling begins
at your fingers and slowly moves up your arm, as it moves through your
arm your arm becomes lighter and lighter, it will soon be so light it will
... becoming lighter and lighter which each breath and moment..." Their
fingers should begin to twitch and then move up, the arm following, now
my friend, you have him/her in hypnosis. The first time you do this, while
he/she is under say good things, like: "Your going to feel great tomorrow"
or "Every day in every way you will find yourself becoming better and better"..
Or some crap like that... The more they go under, the deeper in hypnosis
they will get each time you do it. What to do when hypnotized When you
have them under you must word things very carefully to get your way. You
cannot simply say... Take off your clothes and fuck the pillow. No, that
would not really do the trick. You must say something like.... "you find
your self at home, in your room and you have to take a shower (vividly
describe their room and what's happening), you begin to take off your clothes..."
Now, it can't be that simple, you must know the persons house, room, and
shower room. Then describe things vividly and tell them to act it out (they
have to be deeply under to do this). I would just suggest that you experiment
a while, and get to know how to do things. Waking up Waking up is very
easy, just say "...as I count from 1 to 5 you will find yourself becoming
more and more awake, more and more lively. When you wake up you will find
yourself completely alive, awake, and refreshed. Mentally and physically,
remembering the pleasant sensation that hypnosis brings... Waking up feeling
like a new born baby, reborn with life and vigor, feeling excellent. Remembering
that next time you enter hypnosis it will become an ever increasing deeper
and deeper state than before. You feel energy course throughout your limbs.
You begin to breathe deeply, stirring. Beginning to move more and more
your eyes open, bringing you up to full conscious. You are up, up, up and
awakening more and more. You are awake and feeling great. And that's it!
You now know how to hypnotize yourself and someone else. You will learn
more and more as you experiment.
67. The Remote
Informer Issue #1 by Tracker and Noman Bates
Introduction Welcome to the first issue
of 'The Remote Informer'! This newsletter is reader supported. If the readers
of this newsletter do not help support it, then it will end. We are putting
this out to help out the ones that would like to read it. If you are one
of those who thinks they know everything, then don't bother reading it.
This newsletter is not anything like the future issues. The future issues
will contain several sections, as long as reader input is obtained. Below
is an outline overview of the sections in the future issues. I/O Board
(Input/Output Board) The I/O Board is for questions you have, that we might
be able to answer or at least refer you to someone or something. We will
be honest if we cannot help you. We will not make up something, or to the
effect, just to make it look like we answered you. There will be a section
in the I/O Board for questions we cannot answer, and then the readers will
have the opportunity to answer it. We will print anything that is reasonable
in the newsletter, even complaints if you feel like you are better than
everyone. NewsCenter This section will be for news around the underworld.
It will talk of busts of people in the underworld and anything else that
would be considered news. If you find articles in the paper, or something
happens in your local area, type it up, and upload it to one of the boards
listed at the end of the newsletter. Your handle will be placed in the
article. If you do enter a news article, please state the date and from
where you got it. Feature Section The Feature Section will be the largest
of the sections as it will be on the topic that is featured in that issue.
This will be largely reader input which will be sent in between issues.
At the end of the issue at hand, it will tell the topic of the next issue,
therefore, if you have something to contribute, then you will have ample
time to prepare your article. Hardware/Software Review In this section,
we will review the good and bad points of hardware and software related
to the underworld. It will be an extensive review, rather than just a small
paragraph. The Tops This section will be the area where the top underworld
BBS's, hacking programs, modem scanners, etc. will be shown. This will
be reader selected and will not be altered in anyway. The topics are listed
below. Underworld BBS's (Hack, Phreak, Card, Anarchy, etc.) Hacking programs
for Hayes compatables Hacking programs for 1030/Xm301 modems Modem scanners
for Hayes compatables Modem scanners for 1030/Xm301 modems Other type illegal
programs You may add topics to the list if enough will support it. Tid
Bits This will contain tips and helpful information sent in by the users.
If you have any information you wish to contribute, then put it in a text
file and upload it to one of the BBS's listed at the end of the newsletter.
Please, no long distance codes, mainframe passwords, etc. We may add other
sections as time goes by. This newsletter will not be put out on a regular
basis. It will be put out when we have enough articles and information
to put in it. There may be up to 5 a month, but there will always be at
least one a month. We would like you, the readers, to send us anything
you feel would be of interest to others, like hacking hints, methods of
hacking long distance companies, companies to card from, etc. We will maintain
the newsletter as long as the readers support it. That is the end of the
introduction, but take a look at this newsletter, as it does contain information
that may be of value to you. Hacking Sprint: The Easy Way If you hack US
Sprint, 950-0777 (by the way it is no longer GTE Sprint), and you are frustrated
at hacking several hours only to find one or two codes, then follow these
tips, and it will increase your results tremendously. First, one thing
that Mr. Mojo proved is that Sprint will not store more than one code in
every hundred numbers. (ex: 98765400 to 98765499 may contain only one code).
There may NOT be a code in that hundred, but there will never be more than
one. Sprint's 9 digit codes are stored from 500000000 through 999999999.
In the beginning of Sprint's 950 port, they only had 8 digit codes. Then
they started converting to 9 digit codes, storing all 8 digit codes between
10000000 and 49999999 and all 9 digit codes between 500000000 and 999999999.
Sprint has since canceled most 8 digit codes, although there are a few
left that have been denoted as test codes. Occasionally, I hear of phreaks
saying they have 8 digit codes, but when verifying them, the codes were
invalid. Now, where do you start? You have already narrowed the low and
high numbers in half, therefore already increasing your chances of good
results by 50 percent. The next step is to find a good prefix to hack.
By the way, a prefix, in hacking terms, is the first digits in a code that
can be any length except the same number of digits the code is. (ex: 123456789
is a code. That means 1, 12, 123, 1234, 12345, 123456, 1234567, and 12345678
are prefixes) The way you find a good prefix to hack is to manually enter
a code prefix. If when you enter the code prefix and a valid destination
number and you do not hear the ringing of the recording telling you that
the code is invalid until near the end of the number, then you know the
prefix is valid. Here is a chart to follow when doing this: Code - Destination
Range good codes exist --------------------------------------pread Them?
Do you ever get tired of hearing rumors? You know, someone gets an urge
to impress others, so they create a rumor that some long distance company
is now using tracing equipment. Why start rumors? It only scares others
out of phreaking, and then makes you, the person who started the rumor,
look like Mr. Big. This article is short, but it should make you aware
of the rumors that people spread for personal gain. The best thing to do
is to denote them as a rumor starter and then leave it at that. You should
not rag on them constantly, since if the other users cannot determine if
it is fact or rumor, then they should suffer the consequences. The New
Sprint FON Calling Cards US Sprint has opened up a new long distance network
called the Fiber Optic Network (FON), in which subscribers are given calling
cards. These calling cards are 14 digits, and though, seem randomly generated,
they are actually encrypted. The rumors floating around about people getting
caught using the Sprint FON calling cards are fact, not rumors. The reason
people are getting caught is that they confuse the FON calling cards with
the local 950 port authorization codes. If you will remember, you never
use AT&T calling cards from you home phone. It has ANI capability,
which is not tracing, but rather the originating phone number is placed
on the bill as soon as the call is completed. They know your phone number
when you call the 800 access port, but they do not record it until your
call is completed. Also, through several of my hacks, I came up with some
interesting information surrounding the new Sprint network. They are listed
below. 800-877-0000 - This number is for information on US Sprint's 800
calling card service. I have not played around with it, but I believe it
is for trouble or help with the FON calling cards. I am not sure if it
is for subscribing to the FON network. 800-877-0002 - You hear a short
tone, then nothing. 800-877-0003 - US Sprint Alpha Test Channel #1 800-877-(0004-0999)
- When you call these numbers, you get a recording saying: "Welcome to
US Sprint's 1 plus service." When the recording stops, if you hit the pound
key (#) you will get the calling card dial tone. Other related Sprint numbers
800-521-4949 - This is the number that you subscribe to US Sprint with.
You may also subscribe to the FON network on this number. It will take
4 to 5 weeks for your calling card to arrive. 10777 - This is US Sprint's
equal access number. When you dial this number, you then dial the number
you are calling, and it will be billed through US Sprint, and you will
receive their long distance line for that call. Note that you will be billed
for calls made through equal access. Do not mistake it to be a method of
phreaking, unless used from a remote location. If you are in US Sprint's
1+ service then call 1+700-555-1414, which will tell you which long distance
company you are using. When you hear: "Thank you for choosing US Sprint's
1 plus service," hit the pound key (#), and then you will get the US Sprint
dial tone. This however is just the same as if you are calling from your
home phone if you dial direct, so you would be billed for calls made through
that, but there are ways to use this to your advantage as in using equal
access through a PBX. Automatic Number Identification (ANI) The true definition
for Automatic Number Identification has not been widely known to many.
Automatic Number Identification, (AKA: ANI), is the process of the destination
number knowing the originating number, which is where you are calling from.
The method of achieving this is to send the phone number that you are calling
from in coded form ahead of the destination number. Below is an example
of this. ANI Method Dial: 267-0293 Sent: ********2670293 * - Denotes the
originating number which is coded and sent before the number As you noticed
there are 8 digits in the coded number. This is because, at least I believe,
it is stored in a binary-like form. Automatic Number Identification means
a limited future in phreaking. ANI does not threaten phreaking very much
yet, but it will in the near future. A new switching system will soon be
installed in most cities that are covered by ESS, Electronic Switching
System, now. The system will have ANI capabilities which will be supplied
to the owners of phone lines as an added extra. The owner's phone will
have an LED read-out that will show the phone number of the people that
call you. You will be able to block some numbers, so that people cannot
call you. This system is in the testing stages currently, but will soon
be installed across most of the country. As you see, this will end a large
part of phreaking, until we, the phreakers, can come up with an alternative.
As I have been told by several, usually reliable, people, this system is
called ISS, which I am not sure of the meaning of this, and is being tested
currently in Rhode Island. 800 in-watts lines set up by AT&T support
ANI. The equipment to decode an ANI coded origination number does not costs
as much as you would expect. 950 ports do not offer ANI capability, no
matter what you have been told. The 950 ports will only give the city in
which they are based, this usually being the largest in the state, sometimes
the capitol. One last thing that I should tell you is that ANI is not related
to tracing. Tracing can be done on any number whether local, 950, etc.
One way around this, especially when dialing Alliance TeleConferencing,
is to dial through several extenders or ports. ANI will only cover the
number that is calling it, and if you call through a number that does not
support ANI, then your number will never be known.
68. Jackpotting
ATM Machines by The Jolly Roger
JACKPOTTING was done rather successfully
a while back in (you guessed it) New York. What the culprits did was sever
(actually cross over) the line between the ATM and the host. Insert a microcomputer
between the ATM and the host. Insert a fraudulent card into the ATM. (By
card I mean cash card, not hardware.) What the ATM did was: send a signal
to the host, saying "Hey! Can I give this guy money, or is he broke, or
is his card invalid?" What the microcomputer did was: intercept the signal
from the host, discard it, send "there's no one using the ATM" signal.
What the host did was: get the "no one using" signal, send back "okay,
then for God's sake don't spit out any money!" signal to ATM. What the
microcomputer did was intercept the signal (again), throw it away (again),
send "Wow! That guy is like TOO rich! Give him as much money as he wants.
In fact, he's so loaded, give him ALL the cash we have! He is really a
valued customer." signal. What the ATM did: what else? Obediently dispense
cash till the cows came home (or very nearly so). What the crooks got was
well in excess of $120,000 (for one weekend's work), and several years
when they were caught. This story was used at a CRYPTOGRAPHY conference
I attended a while ago to demonstrate the need for better information security.
The lines between ATM's & their hosts are usually 'weak' in the sense
that the information transmitted on them is generally not encrypted in
any way. One of the ways that JACKPOTTING can be defeated is to encrypt
the information passing between the ATM and the host. As long as the key
cannot be determined from the ciphertext, the transmission (and hence the
transaction) is secure. A more believable, technically accurate story might
concern a person who uses a computer between the ATM and the host to determine
the key before actually fooling the host. As everyone knows, people find
cryptanalysis a very exciting and engrossing subject..don't they? (Hee-Hee)
_____ ______ | |-<<-| |-<<-| | |ATM| micro |Host| |___|->>-|
|->>-|____| The B of A ATM's are connected through dedicated lines to a
host computer as the Bishop said. However, for maintenance purposes, there
is at least one separate dial-up line also going to that same host computer.
This guy basically BS'ed his way over the phone till he found someone stupid
enough to give him the number. After finding that, he had has Apple hack
at the code. Simple. Next, he had a friend go to an ATM with any B of A
ATM card. He stayed at home with the Apple connected to the host. When
his friend inserted the card, the host displayed it. The guy with the Apple
modified the status & number of the card directly in the host's memory.
He turned the card into a security card, used for testing purposes. At
that point, the ATM did whatever it's operator told it to do. The next
day, he went into the bank with the $2000 he received, talked to the manager
and told him every detail of what he'd done. The manager gave him his business
card and told him that he had a job waiting for him when he got out of
school. Now, B of A has been warned, they might have changed the system.
On the other hand, it'd be awful expensive to do that over the whole country
when only a handful of people have the resources and even less have the
intelligence to duplicate the feat. Who knows?
69. Jug Bomb by
The Jolly Roger
Take a glass jug, and put 3 to 4 drops
of gasoline into it. Then put the cap on, and swish the gas around so the
inner surface of the jug is coated. Then add a few drops of potassium permanganate
solution into it and cap it. To blow it up, either throw it at something,
or roll it at something.
70. Fun at K-Mart
by The Jolly Roger
Well, first off, one must realize the
importance of K-Marts in society today. First off, K-Marts provide things
cheaper to those who can't afford to shop at higher quality stores. Although,
all I ever see in there is minorities and Senior Citizens, and the poor
people in our city. Personally, I wouldn't be caught dead in there. But,
once, I did. You see, once, after The Moon Roach and Havoc Chaos (Dear
friends of mine) and I were exploring such fun things as rooftops, we came
along a K-Mart. Amused, and cold for that matter, we wandered in. The Tension
mounts. As we walked up to the entrance, we were nearly attacked by Youth
Groups selling cheap cookies, and wheelchair sticken people selling American
Flags. After laughing at these people, we entered. This is where the real
fun begins... First, we wandered around the store, and turned on all the
blue lights we could find. That really distracts and confuses the attendents...Fun
to do... The first neat thing, is to go to the section of the store where
they sell computers. Darkness engulfs the earth the day they find Apple
Computers being sold there. Instead, lesser computers like the laughable
C-64 can be found there...Turn it on, and make sure nobody's looking...Then,
once in Basic, type... ]10 PRINT "Fuck the world! Anarchy Rules!" (or something
to that effect.) ]20 GOTO 10 and walk away. Also, set the sample radios
in the store to a satanic rock station, and turn the radio off. Then, set
the alarm for two minutes ahead of the time displayed there. Turn the volume
up all the way, and walk away. After about two minutes, you will see the
clerk feebly attempt to turn the radio down or off. It's really neat to
set ten or more radios to different stations, and walk away. One of my
favorite things to do, is to get onto the intercom system of the store.
Easier typed then done. First, check out the garden department. You say
there's no attendent there? Good. Sneak carefully over to the phone behind
the cheap counter there, and pick it up. Dial the number corresponding
to the item that says 'PAGE'... And talk. You will note that your voice
will echo all over the bowels of K-Mart. I would suggest announcing something
on the lines of: "Anarchy rules!!"
71. Mace Substitute
by The Jolly Roger
3 parts Alcohol « part Iodine
« part Salt -or- 3 parts Alcohol 1 part Iodized Salt (Mortons) It's
not actual mace, but it does a damn good job on the eyes...
72. How to grow
Marijuana by The Jolly Roger
MARIJUANA Marijuana is a deciduous
plant which grows from seeds. The fibrous section of the plant was (has
been replaced by synthetics) used to make rope. The flowering tops, leaves,
seeds, and resin of the plant is used by just about everyone to get HIGH.
Normally, the vegetable parts of the plant are smoked to produce this "high,"
but they can also be eaten. The active ingredient in marijuana resin is
THC (Tetahydrocannabinol). Marijuana contains from 1%-4% THC (4% must be
considered GOOD dope). Marijuana grows wild in many parts of the world,
and is cultivated in Mexico, Vietnam, Africa, Nepal, India, South America,
etc. The marijuana sold in the United States comes primarily from, yes,
the United States. It is estimated that at least 50% of the grass on the
streets in America is homegrown. The next largest bunch comes across the
borders from Mexico, with smaller amounts filtering in from Panama, occasionally
South America, and occasionally, Africa. Hashish is the pure resin of the
marijuana plant, which is scraped from the flowering tops of the plant
and lumped together. Ganja is the ground-up tops of the finest plants.
(It is also the name given to any sort of marijuana in Jamaica.) Marijuana
will deteriorate in about two years if exposed to light, air or heat. It
should always be stored in cool places. Grass prices in the United States
are a direct reflection of the laws of supply and demand (and you thought
that high school economics would never be useful). A series of large border
busts, a short growing season, a bad crop, any number of things can drive
the price of marijuana up. Demand still seems to be on the increase in
the US, so prices seldom fall below last year's level. Each year a small
seasonal drought occurs, as last year's supply runs low, and next year's
crop is not up yet. Prices usually rise about 20%-75% during this time
and then fall back to "normal." Unquestionably, a large shortage of grass
causes a percentage of smokers to turn to harder drugs instead. For this
reason, no grass control program can ever be beneficial or "successful."
GROW IT! There is one surefire way of avoiding high prices and the grass
DT's: Grow your own. This is not as difficult as some "authorities" on
the subject would make you believe. Marijuana is a weed, and a fairly vivacious
one at that, and it will grow almost in spite of you. OUTDOORS Contrary
to popular belief, grass grows well in many place on the North American
continent. It will flourish even if the temperature does not raise above
75ø. The plants do need a minimum of eight hours of sunlight per
day and should be planted in late April/early May, BUT DEFINITELY, after
the last frost of the year. Growing an outdoor, or "au naturel", crop has
been the favored method over the years, because grass seems to grow better
without as much attention when in its natural habitat. Of course, an outdoors
setting requires special precautions not encountered with an indoors crop;
you must be able to avoid detection, both from law enforcement freaks and
common freaks, both of whom will take your weed and probably use it. Of
course, one will also arrest you. You must also have access to the area
to prepare the soil and harvest the crop. There are two schools of thought
about starting the seeds. One says you should start the seedlings for about
ten days in an indoor starter box (see the indoor section) and then transplant.
The other theory is that you should just start them in the correct location.
Fewer plants will come up with this method, but there is no shock of transplant
to kill some of the seedlings halfway through. The soil should be prepared
for the little devils by turning it over a couple of times and adding about
one cup of hydrated lime per square yard of soil and a little bit (not
too much, now) of good water soluble nitrogen fertilizer. The soil should
now be watered several times and left to sit about one week. The plants
should be planted at least three feet apart, getting too greedy and stacking
them too close will result in stunted plants. The plants like some water
during their growing season, BUT not too much. This is especially true
around the roots, as too much water will rot the root system. Grass grows
well in corn or hops, and these plants will help provide some camouflage.
It does not grow well with rye, spinach, or pepperweed. It is probably
a good idea to plant in many small, broken patches, as people tend to notice
patterns. GENERAL GROWING INFO Both the male and he female plant produce
THC resin, although the male is not as strong as the female. In a good
crop, the male will still be plenty smokable and should not be thrown away
under any circumstances. Marijuana can reach a height of twenty feet (or
would you rather wish on a star) and obtain a diameter of 4« inches.
If normal, it has a sex ratio of about 1:1, but this can be altered in
several ways. The male plant dies in the 12th week of growing, the female
will live another 3-5 weeks to produce her younguns. Females can weigh
twice as much as males when they are mature. Marijuana soil should compact
when you squeeze it, but should also break apart with a small pressure
and absorb water well. A nice test for either indoor or outdoor growing
is to add a bunch of worms to the soil, if they live and hang around, it
is good soil, but if they don't, well, change it. Worms also help keep
the soil loose enough for the plants to grow well. SEEDS To get good grass,
you should start with the right seeds. A nice starting point is to save
the seeds form the best batch you have consumed. The seeds should be virile,
that is, they should not be gray and shriveled up, but green, meaty, and
healthy appearing. A nice test is to drop the seeds on a hot frying pan.
If they "CRACK," they are probably good for planting purposes. The seeds
should be soaked in distilled water overnight before planting. BE SURE
to plant in the ground with the pointy end UP. Plant about «" deep.
Healthy seeds will sprout in about five days. SPROUTING The best all around
sprouting method is probably to make a sprouting box (as sold in nurseries)
with a slated bottom or use paper cups with holes punched in the bottoms.
The sprouting soil should be a mixture of humus, soil, and five sand with
a bit of organic fertilizer and water mixed in about one week before planting.
When ready to transplant, you must be sure and leave a ball of soil around
the roots of each plant. This whole ball is dropped into a baseball-sized
hold in the permanent soil. If you are growing/transplanting indoors, you
should use a green safe light (purchased at nurseries) during the transplanting
operation. If you are transplanting outdoors, you should time it about
two hours before sunset to avoid damage to the plant. Always wear cotton
gloves when handling the young plants. After the plants are set in the
hole, you should water them. It is also a good idea to use a commercial
transplant chemical (also purchased at nurseries) to help then overcome
the shock. INDOOR GROWING Indoor growing has many advantages, besides the
apparent fact that it is much harder to have your crop "found," you can
control the ambient conditions just exactly as you want them and get a
guaranteed "good" plant. Plants grown indoors will not appear the same
as their outdoor cousins. They will be scrawnier appearing with a weak
stems and may even require you to tie them to a growing post to remain
upright, BUT THEY WILL HAVE AS MUCH OR MORE RESIN! If growing in a room,
you should put tar paper on the floors and then buy sterilized bags of
soil form a nursery. You will need about one cubic foot of soil for each
plant. The plants will need about 150 mL. of water per plant/per week.
They will also need fresh air, so the room must be ventilated. (However,
the fresh air should contain NO TOBACCO smoke.) At least eight hours of
light a day must be provided. As you increase the light, the plants grow
faster and show more females/less males. Sixteen hours of light per day
seems to be the best combination, beyond this makes little or no appreciable
difference in the plant quality. Another idea is to interrupt the night
cycle with about one hour of light. This gives you more females. The walls
of your growing room should be painted white or covered with aluminum foil
to reflect the light. The lights themselves can be either bulbs of fluorescent.
Figure about 75 watts per plant or one plant per two feet of fluorescent
tube. The fluorescents are the best, but do not use "cool white" types.
The light sources should be an average of twenty inches from the plant
and NEVER closer than 14 inches. They may be mounted on a rack and moved
every few days as the plants grow. The very best light sources are those
made by Sylvania and others especially for growing plants (such as the
"gro lux" types). HARVESTING AND DRYING The male plants will be taller
and have about five green or yellow sepals, which will split open to fertilize
the female plant with pollen. The female plant is shorter and has a small
pistillate flower, which really doesn't look like a flower at all but rather
a small bunch of leaves in a cluster. If you don't want any seeds, just
good dope, you should pick the males before they shed their pollen as the
female will use some of her resin to make the seeds. After another three
to five weeks, after the males are gone, the females will begin to wither
and die (from loneliness?), this is the time to pick. In some nefarious
Middle Eastern countries, farmers reportedly put their beehives next to
fields of marijuana. The little devils collect the grass pollen for their
honey, which is supposed to contain a fair dosage of THC. The honey is
then enjoyed by conventional methods or made into ambrosia. If you want
seeds - let the males shed his pollen then pick him. Let the female go
another month and pick her. To cure the plants, they must be dried. On
large crops, this is accomplished by constructing a drying box or drying
room. You must have a heat source (such as an electric heater) which will
make the box/room each 130ø. The box/room must be ventilated to
carry off the water-vapor-laden air and replace it with fresh. A good box
can be constructed from an orange crate with fiberglass insulated walls,
vents in the tops, and screen shelves to hold the leaves. There must be
a baffle between the leaves and the heat source. A quick cure for smaller
amounts is to: cut the plant at the soil level and wrap it in a cloth so
as not to loose any leaves. Take out any seeds by hand and store. Place
all the leaves on a cookie sheet or aluminum foil and put them in the middle
shelf of the oven, which is set on "broil." In a few seconds, the leaves
will smoke and curl up, stir them around and give another ten seconds before
you take them out. TO INCREASE THE GOOD STUFF There are several tricks
to increase the number of females, or the THC content of plants: You can
make the plants mature in 36 days if you are in a hurry, by cutting back
on the light to about 14 hours, but the plants will not be as big. You
should gradually shorten the light cycle until you reach fourteen hours.
You can stop any watering as the plants begin to bake the resin rise to
the flowers. This will increase the resin a bit. You can use a sunlamp
on the plants as they begin to develop flower stalks. You can snip off
the flower, right at the spot where it joins the plant, and a new flower
will form in a couple of weeks. This can be repeated two or three times
to get several times more flowers than usual. If the plants are sprayed
with Ethrel early in their growing stage, they will produce almost all
female plants. This usually speeds up the flowering also, it may happen
in as little as two weeks. You can employ a growth changer called colchicine.
This is a bit hard to get and expensive. (Should be ordered through a lab
of some sort and costs about $35 a gram.) To use the colchicine, you should
prepare your presoaking solution of distilled water with about 0.10 per
cent colchicine. This will cause many of the seeds to die and not germinate,
but the ones that do come up will be polyploid plants. This is the accepted
difference between such strains as "gold" and normal grass, and yours will
DEFINITELY be superweed. The problem here is that colchicine is a poison
in larger quantities and may be poisonous in the first generation of plants.
Bill Frake, author of CONNOISSEUR'S HANDBOOK OF MARIJUANA runs a very complete
colchicine treatment down and warns against smoking the first generation
plants (all succeeding generations will also be polyploid) because of this
poisonous quality. However, the Medical Index shows colchicine being given
in very small quantities to people for treatment if various ailments. Although
these quantities are small, they would appear to be larger than any you
could receive form smoking a seed-treated plant. It would be a good idea
to buy a copy of CONNOISSEUR'S, if you are planning to attempt this, and
read Mr. Drake's complete instructions. Another still-experimental process
to increase the resin it to pinch off the leaf tips as soon as they appear
from the time the plant is in the seedling stage on through its entire
life-span. This produces a distorted, wrecked-looking plant which would
be very difficult to recognize as marijuana. Of course, there is less substance
to this plant, but such wrecked creatures have been known to produce so
much resin that it crystallizes a strong hash all over the surface of the
plant - might be wise to try it on a plant or two and see what happens.
PLANT PROBLEM CHART Always check the overall environmental conditions prior
to passing judgment - soil around 7 pH or slightly less - plenty of water,
light, fresh air, loose soil, no water standing in pools. SYMPTOMPROBABLY
PROBLEM/CURELarger leaves turning yellow - smaller leaves still green.Nitrogen
deficiency - add nitrate of soda or organic fertilizer.Older leaves will
curl at edges, turn dark, possibly with a purple cast.Phosphorous deficiency
- add commercial phosphate.Mature leaves develop a yellowish cast to
least venial areas.Magnesium deficiency - add commercial fertilizer with
a magnesium content.Mature leaves turn yellow and then become spotted
with edge areas turning dark gray.Potassium deficiency - add muriate of
potash.Cracked stems, no healthy support tissue.Boron deficiency - add
any plant food containing boron.Small wrinkled leaves with yellowish
vein systems.Zinc deficiency - add commercial plant food containing zinc.Young
leaves become deformed, possibly yellowing.Molybdenum deficiency - use
any plant food with a bit of molybdenum in it.
EXTRA SECTION: BAD WEED/GOOD WEED Can
you turn bad weed into good weed? Surprisingly enough, the answer to this
often-asked inquiry is, yes! Like most other things in life, the amount
of good you are going to do relates directly to how much effort you are
going to put into it. There are no instant, supermarket products which
you can spray on Kansas catnip and have wonderweed, but there are a number
of simplified, inexpensive processes (Gee, Mr. Wizard!) which will enhance
mediocre grass somewhat, and there are a couple of fairly involved processes
which will do up even almost-parsley weed into something worth writing
home about. EASES Place the dope in a container which allows air to enter
in a restricted fashion (such as a can with nail holes punched in its lid)
and add a bunch of dry ice, and the place the whole shebang in the freezer
for a few days. This process will add a certain amount of potency to the
product, however, this only works with dry ice, if you use normal, everyday
freezer ice, you will end up with a soggy mess... Take a quantity of grass
and dampen it, place in a baggy or another socially acceptable container,
and store it in a dark, dampish place for a couple of weeks (burying it
also seems to work). The grass will develop a mold which tastes a bit harsh,
a and burns a tiny bit funny, but does increase the potency. Expose the
grass to the high intensity light of a sunlamp for a full day or so. Personally,
I don't feel that this is worth the effort, but if you just spent $400
of your friend's money for this brick of super-Colombian, right-from-the-President's-personal-stash,
and it turns out to be Missouri weed, and you're packing your bags to leave
town before the people arrive for their shares, well, you might at least
try it. Can't hurt. Take the undesirable portions of our stash (stems,
seeds, weak weed, worms, etc.) and place them in a covered pot, with enough
rubbing alcohol to cover everything. Now CAREFULLY boil the mixture on
an ELECTRIC stove or lab burner. DO NOT USE GAS - the alcohol is too flammable.
After 45 minutes of heat, remove the pot and strain the solids out, SAVING
THE ALCOHOL. Now, repeat the process with the same residuals, but fresh
alcohol. When the second boil is over, remove the solids again, combine
the two quantities of alcohol and reboil until you have a syrupy mixture.
Now, this syrupy mixture will contain much of the THC formerly hidden in
the stems and such. One simply takes this syrup the thoroughly combines
it with the grass that one wishes to improve upon. SPECIAL SECTION ON RELATED
SUBJECT MARYGIN Marygin is an anagram of the words marijuana and gin, as
in Eli Whitney. It is a plastic tumbler which acts much like a commercial
cotton gin. One takes about one ounce of an herb and breaks it up. This
is then placed in the Marygin and the protruding knob is rotated. This
action turns the internal wheel, which separates the grass from the debris
(seeds, stems). It does not pulverize the grass as screens have a habit
of doing and is easily washable. Marygin is available from: P.O. Box 5827
Tuscon, Arizona 85703 $5.00 GRASS Edmund Scientific Company 555 Edscorp
Building Barrington, New Jersy 08007 Free Catalog is a wonder of good things
for the potential grass grower. They have an electric thermostat greenhouse
for starting plants. Lights which approximate the true color balance of
the sun and are probably the most beneficial types available: 40 watt,
48 inch Indoor sun bulb, 75 or 150 watt And, they have a natural growth
regulator for plants (Gibberellin) which can change height, speed growth,
and maturity, promote blossoming, etc. Each plant reacts differently to
treatment with Gibberellin...there's no fun like experimenting. SUGGESTED
READING THE CONNOISSEUR'S HANDBOOK OF MARIJUANA, Bill Drake Straight Arrow
Publishing - $3«0 625 Third Street San Francisco, California FLASH
P.O.Box 16098 San Fransicso, California 94116 Stocks a series of pamphlets
on grass, dope manufacture, cooking. Includes the Mary Jane Superweed series.
73. Match Head
Bomb by The Jolly Roger
Simple safety match heads in a pipe,
capped at both ends, make a devastating bomb. It is set off with a regular
fuse. A plastic baggy is put into the pipe before the heads go in to prevent
detonation by contact with the metal. Cutting enough match heads to fill
the pipe can be tedious work for one but an evening's fun for the family
if you can drag them away from the TV.
74. How To Terrorize
McDonalds by The Jolly Roger
Now, although McDonalds is famous for
it's advertising and making the whole world think that the BigMac is the
best thing to come along since sliced bread (buns?), each little restaurant
is as amateur and simple as a new-found business. Not only are all the
employees rather inexperienced at what they're supposed to do, but they
will just loose all control when an emergency occurs....here we go!!! First,
get a few friends (4 is good...I'll get to this later) and enter the McDonalds
restaurant, talking loudly and reeking of some strange smell that automatically
makes the old couple sitting by the door leave. If one of those pimply-faced
goons is wiping the floor, then track some crap all over it (you could
pretend to slip and break your head, but you might actually do so). Next,
before you get the food, find a table. Start yelling and releasing some
strange body odor so anybody would leave their table and walk out the door.
Sit two friends there, and go up to the counter with another. Find a place
where the line is short, or if the line is long say "I only wanna buy a
coke." and you get moved up. Now, you get to do the ordering ...heh heh
heh. Somebody always must want a plain hamburger with absolutely nothing
on it (this takes extra time to make, and drives the little hamburger-makers
insane)..order a 9-pack of chicken McNuggets...no, a 20 pack...no, three
6 packs...wait...go back to the table and ask who wants what. Your other
friend waits by the counter and makes a pass at the female clerk. Get back
to the thing and order three 6-packs of chicken etc....now she says "What
kind of sauce would you like?". Of course, say that you all want barbecue
sauce one of your friends wants 2 (only if there are only 2 containers
of barbecue sauce left). Then they hafta go into the storeroom and open
up another box. Finally, the drinks...somebody wants coke, somebody root
beer, and somebody diet coke. After these are delivered, bring them back
and say "I didn't order a diet coke! I ordered a sprite!" This gets them
mad; better yet, turn down something terrible that nobody wants to drink,
so they hafta throw the drink away; they can't sell it. After all the food(?)
is handed to you, you must never have enough money to pay. The clerk will
be so angry and confused that she'll let you get away with it (another
influence on her is your friend asking her "If you let us go, I'll go out
with you." and giving her a fake fone number). Now, back to your table.
But first, somebody likes ketchup and mustard. And plenty (too much) of
napkins. Oh, and somebody likes forks and knives, so always end up breaking
the ones you pick outta the box. Have your friends yell out, Yay!!!!!
We have munchies!!" As loud as they can. That'll worry the entire restaurant.
Proceed to sit down. So, you are sitting in the smoking section (by accident)
eh? Well, while one of the tobacco-breathers isn't looking, put a sign
from the other side of the room saying "Do not smoke here" and he'll hafta
move...then he goes into the real non-smoking section, and gets yelled
at. He then thinks that no smoking is allowed in the restaurant, so he
eats outside (in the pouring rain) after your meal is finished (and quite
a few splattered-opened ketchup packets are all over your table), try to
leave. But oops! Somebody has to do his duty in the men's room. As he goes
there, he sticks an uneaten hamburger (would you dare to eat one of their
hamburgers?) Inside the toilet, flushes it a while, until it runs all over
the bathroom. Oops! Send a pimply-faced teenager to clean it up. (He won't
know that brown thing is a hamburger, and he'll get sick. Wheee!) As you
leave the restaurant, looking back at your uncleaned table, somebody must
remember that they left their chocolate shake there! The one that's almost
full!!!! He takes it then says "This tastes like crap!", Then he takes
off the lid and throws it into the garbage can...oops! He missed, and now
the same poor soul who's cleaning up the bathroom now hasta clean up chocolate
shake. Then leave the joint, reversing the "Yes, we're open" sign (as a
reminder of your visit) There you have it! You have just put all of McDonalds
into complete mayhem. And since there is no penalty for littering in a
restaurant, bugging people in a public eatery (or throw-upery, in this
case) you get off scot-free. Wasn't that fun?
75. "Mentor's
Last Words" by +++The Mentor+++
The following file is being reprinted
in honor and sympathy for the many phreaks and hackers that have been busted
recently by the Secret Service. The Conscience of a Hacker Another one
got caught today, it's all over the papers. "Teenager Arrested in Computer
Crime Scandal", "Hacker Arrested after Bank Tampering"... Damn kids. They're
all alike. But did you, in your three-piece psychology and 1950's technobrain,
ever take a look behind the eyes of the hacker? Did you ever wonder what
made him tick, what forces shaped him, what may have molded him? I am a
hacker, enter my world... Mine is a world that begins with school... I'm
smarter than most of the other kids, this crap they teach us bores me...
Damn underachiever. They're all alike. I'm in junior high or high school.
I've listened to teachers explain for the fifteenth time how to reduce
a fraction. I understand it. "No, Ms. Smith, I didn't show my work. I did
it in my head..." Damn kid. Probably copied it. They're all alike. I made
a discovery today. I found a computer. Wait a second, this is cool. It
does what I want it to. If it makes a mistake, it's because I screwed it
up. Not because it doesn't like me or feels threatened by me or thinks
I'm a smart ass or doesn't like teaching and shouldn't be here...damn kid.
All he does is play games. They're all alike. And then it happened. A door
opened to a world. Rushing through the phone line like heroin through an
addict's veins, an electronic pulse is sent out, a refuge from the day-to-day
incompetencies is sought... a board is found. "This is it... this is where
I belong..." I know everyone here... even if I've never met them, never
talked to them, may never hear from them again... I know you all... Damn
kid. Tying up the phone line again. They're all alike... You bet your ass
we're all alike... we've been spoon-fed baby food at school when we hungered
for steak... the bits of meat that you did let slip through were pre-chewed
and tasteless. We've been dominated by sadists, or ignored by the apathetic.
The few that had something to teach found us willing pupils, but those
few are like drops of water in the desert. This is our world now... the
world of the electron and the switch, the beauty of the baud. We make use
of a service already existing without paying for what could be dirt-cheap
if it wasn't run by profiteering gluttons, and you call us criminals. We
explore... and you call us criminals. We seek after knowledge... and you
call us criminals. We exist without skin color, without nationality, without
religious bias... and you call us criminals. You build atomic bombs, you
wage wars, you murder, cheat, and lie to us and try to make us believe
it's for our own good, yet we're the criminals. Yes, I am a criminal. My
crime is that of curiosity. My crime is that of judging people by what
they say and think, not what they look like. My crime is that of outsmarting
you, something that you will never forgive me for. I am a hacker, and this
is my manifesto. You may stop this individual, but you can't stop us all...
after all, we're all alike. +++The Mentor+++ May the members of the phreak
community never forget his words -JR
76. The Myth of
the 2600hz Detector by The Jolly Roger
Just about everyone I talk to these
days about ESS seems to be scared witless about the 2600hz detector. I
don't know who thought this one up, but it simply does not exist. So many
of you people whine about this so-called phreak catching device for no
reason. Someone with AT&T said they had it to catch phreakers. This
was just to scare the blue-boxers enough to make them quit boxing free
calls. I'm not saying ESS is without its hang-ups, either. One thing that
ESS can detect readily is the kick-back that the trunk circuitry sends
back to the ESS machine when your little 2600hz tone resets the toll trunk.
After an ESS detects a kickback it turns an M-F detector on and records
any M-F tones transmitted. Defeating the kick-back detector As mentioned
in my previous note, kick-back detection can be a serious nuisance to anyone
interested in gaining control of a trunk line. The easiest way to by-pass
this detection circuitry is not really by-passing it at all, it is just
letting the kick-back get detected on some other line. This other line
is your local MCI, sprint, or other long distance carrier (except AT&T).
The only catch is that the service you use must not disconnect the line
when you hit the 2600hz tone. This is how you do it: call up your local
extender, put in the code, and dial a number in the 601 area code and the
644 exchange. Lots of other exchanges work across the country, I'm sure,
but this is the only one that I have found so far. Anyway, when it starts
ringing, simply hit 2600Hz and you'll hear the kick-back, (ka-chirp, or
whatever). Then you are ready to dial whoever you want (conferences, inward,
route and rate, overseas, etc.) From the trunk line in operator tones!
Since blowing 2600Hz doesn't make you a phreaker until the toll equipment
resets the line, kickback detection is the method AT&T chooses (for
now) this information comes as a result of my experiments & experience
and has been verified by local AT&T employees I have as acquaintances.
They could only say that this is true for my area, but were pretty sure
that the same idea is implemented across the country. Now that you know
how to access a trunk line or as operators say a loop, I will tell you
the many things you can do with it. Here is a list of AT&T services
accessible to you by using a blue box. A/C+101 TOLL SWITCHING A/C+121 INWARD
OPERATOR A/C+131 INFORMATION A/C+141 ROUTE & RATE OP. A/C+11501 MOBILE
OPERATOR A/C+11521 MOBILE OPERATOR Starting conferences: This is one the
most useful attributes of blue boxing. Now the confs. are up 24 hours/day
and 7 days/week and the billing lines are being billed. Since I believe
the above is true (about the billing lines being billed) I would recommend
that you never let your number show up on the conf. If you started it,
put it on a loop and then call the loop. Enough bullshit!!!!! To start
the conf. Dial one of these three numbers in m-f while you are on the trunk.
213+080+XXXX XXXX=1050,3050 SPECIAL XXXX=1000,1100,1200,1500,2200,2500.
These numbers are in LA and are the most watched, I do not advise using
this NPA. 312+001+1050 OR 3050 914+042+1050 OR 1100,1200 ECT.. I believe
only 914 works at the moment. Once connected with one of these you will
either hear a re-order, busy, or chirp. When you hear the chirp enter the
billing line in M-F. I use the conf. dial- up. A billing line example:
kp312+001+1050st you will then hear two tutes and a recording asking you
for the number of conferees including yourself. Enter a number between
20 and 30. If you ever get over 30 people on a conference all you will
hear is jumbled voices. After the it says "your conference size is xx"
then hit the pound (#) sign. Add your favorite loop on and hit 6 to transfer
control to it. After it says control will be transferred hang up and call
the other side of the loop, hit the pound sign (#) and follow the instructions.
A bonus for conf. is to add an international number dial 1+011+cc+number
pretty cool ehhh. A few extra notes. Do not add numbers that you will want
to hang up, add these through MCI or Sprint. You cannot blow anyone off
with 2600hz unless they are in an old x-bar or older system. Many DA operators
will stay on after you abuse them; you may have to start another or at
least don't say any numbers. Never add the tone side of a loop onto a conf.
never add more than one MCI node on your conf. Route & rate: Note route
& rate and RQS perform the same service. R&R simply tells you route
and rate info which is very valuable, ex. Such as the inward routing for
an exchange in an area code. An inward routing will let you call her and
she can do an emergency interrupt for you. She can tell you how to get
international operators, ect. Here are the terms you are required to use:
International, -Operator route for [country, city]. -gives you inward op.
-Directory route for [country, city]. -gives you directory ass. -City route
for [country, city]. -gives you country and city code. Operator route for
[a/c]+ [exchange] -gives you inward op. Route Ex. [a/c]+ or [a/c]+0xx+
when she says plus she means plus 121. Numbers route for [state, city]
-gives you a/c. Place name [a/c]+[exchange] -gives you city/state for that
a/c and Exchange. International calls: To call international over cable
simply access a trunk and dial kp011xxxst wait for sender tone, kpxxxcc-numberst
xxx - a 3 digit country code, it may not be 3 digits so just put 1 or 2
0's in front of it. Cc - is the city code to go by satellite: Dial kp18xst
x - numbers 2-8 wait for sender tone then Kpxxxccnumberst
77. Blue Box by
The Jolly Roger
To quote Karl Marx, blue boxing has
always been the most noble form of phreaking. As opposed to such things
as using an MCI code to make a free fone call, which is merely mindless
pseudo-phreaking, blue boxing is actual interaction with the Bell System
toll network. It is likewise advisable to be more cautious when blue boxing,
but the careful phreak will not be caught, regardless of what type of switching
system he is under. In this part, I will explain how and why blue boxing
works, as well as where. In later parts, I will give more practical information
for blue boxing and routing information. To begin with, blue boxing is
simply communicating with trunks. Trunks must not be confused with subscriber
lines (or "customer loops") which are standard telefone lines. Trunks are
those lines that connect central offices. Now, when trunks are not in use
(i.e., idle or "on-hook" state) they have 2600Hz applied to them. If they
are two-way trunks, there is 2600Hz in both directions. When a trunk IS
in use (busy or "off-hook" state), the 2600Hz is removed from the side
that is off-hook. The 2600Hz is therefore known as a supervisory signal,
because it indicates the status of a trunk; on hook (tone) or off-hook
(no tone). Note also that 2600Hz denoted SF (single frequency) signaling
and is "in-band." This is very important. "In-band" means that is within
the band of frequencies that may be transmitted over normal telefone lines.
Other SF signals, such as 3700Hz are used also. However, they cannot be
carried over the telefone network normally (they are "out-of-band" and
are therefore not able to be taken advantage of as 2600Hz is. Back to trunks.
Let's take a hypothetical phone call. You pick up your fone and dial 1+806-258-1234
(your good friend in Amarillo, Texas). For ease, we'll assume that you
are on #5 Crossbar switching and not in the 806 area. Your central office
(CO) would recognize that 806 is a foreign NPA, so it would route the call
to the toll center that serves you. [For the sake of accuracy here, and
for the more experienced readers, note that the CO in question is a class
5 with LAMA that uses out-of-band SF supervisory signaling]. Depending
on where you are in the country, the call would leave your toll center
(on more trunks) to another toll center, or office of higher "rank". Then
it would be routed to central office 806-258 eventually and the call would
be completed. Illustration A---CO1-------TC1------TC2----CO2----B A....
you CO1.. your central office TC1.. your toll office. TC2.. toll office
in Amarillo. CO2.. 806-258 central office. B.... your friend (806-258-1234)
In this situation it would be realistic to say that CO2 uses SF in-band
(2600Hz) signaling, while all the others use out-of-band signaling (3700Hz).
If you don't understand this, don't worry. I am pointing this out merely
for the sake of accuracy. The point is that while you are connected to
806-258-1234, all those trunks from YOUR central office (CO1) to the 806-258
central office (CO2) do *NOT* have 2600Hz on them, indicating to the Bell
equipment that a call is in progress and the trunks are in use. Now let's
say you're tired of talking to your friend in Amarillo, so you send a 2600Hz
down the line. This tone travels down the line to your friend's central
office (CO2) where it is detected. However, that CO thinks that the 2600Hz
is originating from Bell equipment, indicating to it that you've hung up,
and thus the trunks are once again idle (with 2600Hz present on them).
But actually, you have not hung up, you have fooled the equipment at your
friend's CO into thinking you have. Thus, it disconnects him and resets
the equipment to prepare for the next call. All this happens very quickly
(300-800ms for step-by-step equipment and 150-400ms for other equipment).
When you stop sending 2600Hz (after about a second), the equipment thinks
that another call is coming towards --> on hook, no tone -->off hook. Now
that you've stopped sending 2600Hz, several things happen: A trunk is seized.
A "wink" is sent to the CALLING end from the CALLED end indicating that
the CALLED end (trunk) is not ready to receive digits yet. A register is
found and attached to the CALLED end of the trunk within about two seconds
(max). A start-dial signal is sent to the CALLING end from the CALLED end
indicating that the CALLED end is ready to receive digits. Now, all of
this is pretty much transparent to the blue boxer. All he really hears
when these four things happen is a
78. Napalm II
by The Jolly Roger
[See file #021 of the Cookbook for
an easy way to make it!!] About the best fire bomb is napalm. It has a
thick consistency, like jam and is best for use on vehicles or buildings.
Napalms is simply one part gasoline and one part soap. The soap is either
soap flakes or shredded bar soap. Detergents won't do. The gasoline must
be heated in order for the soap to melt. The usual way is with a double
boiler where the top part has at least a two-quart capacity. The water
in the bottom part is brought to a boil and the double boiler is taken
from the stove and carried to where there is no flame. Then one part, by
volume, of gasoline is put in the top part and allowed to heat as much
as it will and the soap is added and the mess is stirred until it thickens.
A better way to heat gasoline is to fill a bathtub with water as hot as
you can get it. It will hold its heat longer and permit a much larger container
than will the double boiler.
79. Nitroglycerin
Recipe by The Jolly Roger
Like all chemists I must advise you
all to take the greatest care and caution when you are doing this. Even
if you have made this stuff before. This first article will give you information
on making nitroglycerin, the basic ingredient in a lot of explosives such
as straight dynamites, and gelatin dynamites. Making nitroglycerin: Fill
a 75-milliliter beaker to the 13 mL. Level with fuming red nitric acid,
of 98% pure concentration. Place the beaker in an ice bath and allow to
cool below room temp. After it has cooled, add to it three times the amount
of fuming sulferic acid (99% h2so4). In other words, add to the now-cool
fuming nitric acid 39 mL. Of fuming sulferic acid. When mixing any acids,
always do it slowly and carefully to avoid splattering. When the two are
mixed, lower their temp. By adding more ice to the bath, about 10-15øC.
(Use a mercury-operated thermometer) When the acid solution has cooled
to the desired temperature, it is ready for the glycerin. The glycerin
must be added in small amounts using a medicine dropper. (Read this step
about 10 times!) Glycerin is added slowly and carefully (I mean careful!)
Until the entire surface of the acid it covered with it. This is a dangerous
point since the nitration will take place as soon as the glycerin is added.
The nitration will produce heat, so the solution must be kept below 30øC!
If the solution should go above 30øC, immediately dump the solution
into the ice bath! This will insure that it does not go off in your face!
For the first ten minutes of nitration, the mixture should be gently stirred.
In a normal reaction the nitroglycerin will form as a layer on top of the
acid solution, while the sulferic acid will absorb the excess water. After
the nitration has taken place, and the nitroglycerin has formed on the
top of the solution, the entire beaker should be transferred slowly and
carefully to another beaker of water. When this is done the nitroglycerin
will settle at the bottom so the other acids can be drained away. After
removing as much acid as possible without disturbing the nitroglycerin,
remove the nitroglycerin with an eyedropper and place it in a bicarbonate
of soda (sodium bicarbonate in case you didn't know) solution. The sodium
is an alkali and will neutralize much of the acid remaining. This process
should be repeated as much as necessary using blue litmus paper to check
for the presence of acid. The remaining acid only makes the nitroglycerin
more unstable than it already is. Finally! The final step is to remove
the nitroglycerin from the bicarbonate. His is done with and eye- dropper,
slowly and carefully. The usual test to see if nitration has been successful
is to place one drop of the nitroglycerin on metal and ignite it. If it
is true nitroglycerin it will burn with a clear blue flame. ** Caution
** Nitro is very sensitive to decomposition, heating dropping, or jarring,
and may explode if left undisturbed and cool.
80. Operation:
Fuckup by The Jolly Roger
This is a guide for Anarchists and
can be funny for non-believers and 12 and 13 year old runts, and can be
a lexicon of deadly knowledge for True Anarchists... Serious damage is
intended to be dealt here. Do not try this stuff unless you want to do
a lot of serious Anarchy. [Simulation] Asshole - 'Listen, you little teenager
punk shit, shut the fuck up, or I'll knock you down!' Anarchist - 'O.K.
You can't say I didn't warn you. You don't know my rue power...' (soooo
casually) Asshole - 'Well, er, what do you mean? Anarchist - '
81. Stealing calls
from payphones by The Jolly Roger
Now to make free local calls, you need
a finishing nail. I highly recommend "6D E.G. FINISH C/H, 2 INCH" nails.
These are about 3/32 of an inch in diameter and 2 inches long (of course).
You also need a large size paper clip. By large I mean they are about 2in
long (FOLDED). Then you unfold the paper clip. Unfold it by taking each
piece and moving it out 90ø. When it is done it should look somewhat
like this: /----------\ : : : : : : : : \----- Now, on to the neat stuff.
What you do, instead of unscrewing the glued-on mouthpiece, is insert the
nail into the center hole of the mouthpiece (where you talk) and push it
in with pressure or just hammer it in by hitting the nail on something.
Just DON'T KILL THE MOUTHPIECE! You could damage it if you insert the nail
too far or at some weird angle. If this happens then the other party won't
be able to hear what you say. You now have a hole in the mouthpiece in
which you can easily insert the paper clip. So, take out the nail and put
in the paper clip. Then take the other end of the paper clip and shove
it under the rubber cord protector at the bottom of the handset (you know,
the blue guy...). This should end up looking remotely like...like this:
/----------\ Mouthpiece : : Paper clip --> : : / : /---:---\ : : : :------------>
====================\---))): : To earpiece -> ^ ^ \-------------------->
: : : : Cord Blue guy (The paper clip is shoved under the blue guy to make
a good connection between the inside of the mouthpiece and the metal cord.)
Now, dial the number of a local number you wish to call, sayyyy, MCI. If
everything goes okay, it should ring and not answer with the "The Call
You Have Made Requires a 20 Cent Deposit" recording. After the other end
answers the phone, remove the paper clip. It's all that simple, see? There
are a couple problems, however. One is, as I mentioned earlier, the mouthpiece
not working after you punch it. If this happens to you, simply move on
to the next payphone. The one you are now on is lost. Another problem is
that the touch tones won't work when the paper clip is in the mouthpiece.
There are two ways around this.. Dial the first 6 numbers. This should
be done without the paper clip making the connection, i.e., one side should
not be connected. Then connect the paper clip, hold down the last digit,
and slowly pull the paper clip out at the mouthpiece's end. Don't use the
paper clip at all. Keep the nail in after you punch it. Dial the first
6 digits. Before dialing the last digit, touch the nail head to the plate
on the main body of the phone, the money safe thingy..then press the last
number. The reason that this method is sometimes called clear boxing is
because there is another type of phone which lets you actually make the
call and listen to them say "Hello, hello?" but it cuts off the mouthpiece
so they can't hear you. The Clear Box is used on that to amplify your voice
signals and send it through the earpiece. If you see how this is even slightly
similar to the method I have just described up there, kindly explain it
to ME!! Cause I don't GET IT! Anyways, this DOES work on almost all single
slot, Dial Tone First payphones (Pacific Bell for sure). I do it all the
time. This is the least, I STRESS *LEAST*, risky form of Phreaking.
82. Pool Fun by
The Jolly Roger
First of all, you need know nothing
about pools. The only thing you need know is what a pool filter looks like.
If you don't know that. Second, dress casual. Preferably, in black. Visit
your "friends" house, the one whose pool looks like fun!! Then you reverse
the polarity of his/her pool, by switching the wires around. They are located
in the back of the pump. This will have quite an effect when the pump goes
on. In other words. Boooooooooooommm! That's right, when you mix + wires
with - plugs, and vice- versa, the 4th of July happens again. Not into
total destruction??? When the pump is off, switch the pump to "backwash".
Turn the pump on and get the phuck out! When you look the next day, phunny.
The pool is dry. If you want permanent damage, yet no great display like
my first one mentioned, shut the valves of the pool off. (There are usually
2) One that goes to the main drain and one that goes to the filter in the
pool. That should be enough to have one dead pump. The pump must take in
water, so when there isn't any... Practical jokes: these next ones deal
with true friends and there is *no* permanent damage done. If you have
a pool, you must check the pool with chemicals. There is one labeled orthotolidine.
The other is labeled alkaline (pH). You want orthotolidine. (It checks
the chlorine). Go to your local pool store and tell them you're going into
the pool business, and to sell you orthotolidine (a CL detector) Buy this
in great quantities if possible. The solution is clear. You fill 2 baggies
with this chemical. And sew the bags to the inside of your suit. Next,
go swimming with your friend! Then open the bags and look like you're enjoying
a piss. And anyone there will turn a deep red! They will be embarrassed
so much, Especially if they have guests there! Explain what it is, then
add vinegar to the pool. Only a little. The "piss" disappears.
83. Free Postage
by The Jolly Roger
The increasing cost of postage to mail
letters and packages is bringing down our standard of living. To remedy
this deplorable situation, some counter control measures can be applied.
For example, if the stamps on a letter are coated with Elmer's Glue by
the sender, the cancellation mark will not destroy the stamp: the Elmer's
drives to form an almost invisible coating that protects the stamps from
the cancellation ink. Later, the receiver of the letter can remove the
cancellation mark with water and reuse the stamps. Furthermore, ecological
saving will also result from recycling the stamps. Help save a tree. The
glue is most efficiently applied with a brush with stiff, short bristles.
Just dip the brush directly into the glue and spread it on evenly, covering
the entire surface of the stamp. It will dry in about 15 minutes. For mailing
packages, just follow the same procedure as outlined above; however, the
package should be weighed and checked to make sure that it has the correct
amount of postage on it before it is taken to the Post Office. Removing
the cancellation and the glue from the stamps can be easily accomplished
by soaking the stamps in warm water until they float free from the paper.
The stamps can then be put onto a paper towel to dry. Processing stamps
in large batches saves time too. Also, it may be helpful to write the word
'Elmer' at the top of the letter (not on the envelope) to cue the receiving
party in that the stamps have been protected with the glue. We all know
that mailing packages can be expensive. And we also know that the handicapped
are sometimes discriminated against in jobs. The Government, being the
generous people they are, have given the blind free postal service. Simply
address you envelope as usual, and make one modification. In the corner
whýÿÿÿw peanuts (not roasted.) Shell them, saving
the skins and discarding the shells. Eat the nuts. Grind up the skins and
smoke them.
86. The Art of
Carding by The Jolly Roger
Obtaining a credit card number: There
are many ways to obtain the information needed to card something. The most
important things needed are the card number and the expiration date. Having
the card-holders name doesn't hurt, but it is not essential. The absolute
best way to obtain all the information needed is by trashing. The way this
is done is simple. You walk around your area or any other area and find
a store, mall, supermarket, etc., that throws their garbage outside on
the sidewalk or dumpster. Rip the bag open and see if you can find any
carbons at all. If you find little shreds of credit card carbons, then
it is most likely not worth your time to tape together. Find a store that
does not rip their carbons at all or only in half. Another way is to bullshit
the number out of someone. That is call them up and say "Hello, this is
Visa security and we have a report that your card was stolen." They will
deny it and you will try to get it out of them from that point on. You
could say, "It wasn't stolen? Well what is the expiration date and maybe
we can fix the problem.... OK and what is the number on your card?......Thank
you very much and have a nice day." Or think of something to that degree.
Another way to get card numbers is through systems such as TRW and CBI,
this is the hard way, and probably not worth the trouble, unless you are
an expert on the system. Using credit card numbers posted on BBS's is risky.
The only advantage is that there is a good chance that other people will
use it, thus decreasing the chances of being the sole-offender. The last
method of getting numbers is very good also. In most video rental stores,
they take down your credit card number when you join to back-up your rentals.
So if you could manage to steal the list or make a copy of it, then you
are set for a LONG time. Choosing a victim: Once you have the card number,
it is time to make the order. The type of places that are easiest to victimize
are small businesses that do mail order or even local stores that deliver.
If you have an ad for a place with something you want and the order number
is NOT a 1-800 number then chances are better that you will succeed. Ordering
When you call the place up to make the order, you must have several things
readily at hand. These are the things you will need: A name, telephone
number, business phone, card number (4 digit bank code if the card is MasterCard),
expiration date, and a complete shipping and billing address. I will talk
about all of these in detail. A personal tip: When I call to make an order,
it usually goes much smoother if the person you are talking to is a woman.
In many cases they are more gullible than men. The name: You could use
the name on the card or the name of the person who you are going to send
the merchandise to. Or you could use the name on the card and have it shipped
to the person who lives at the drop (Say it is a gift or something). The
name is really not that important because when the company verifies the
card, the persons name is never mentioned, EXCEPT when you have a Preferred
Visa card. Then the name is mentioned. You can tell if you have a Preferred
Visa card by the PV to the right of the expiration date on the carbon.
No phone all day long waiting for the company to call (Which they will),
then the phone number to give them as your home-phone could be one of the
following: A number that is ALWAYS busy, a number that ALWAYS rings, a
payphone number, low end of a loop (and you will wait on the other end),
or a popular BBS. NEVER give them your home phone because they will find
out as soon as the investigation starts who the phone belongs to. The best
thing would be to have a payphone call forward your house (via Cosm The
business number.) When asked for, repeat the number you used for your home
phone. Card number: The cards you will use will be Visa, Mastercard, and
American Express. The best is by far Visa. It is the most straight-forward.
Mastercard is pretty cool except for the bank code. When they ask for the
bank code, they sometimes also ask for the bank that issued it. When they
ask that just say the biggest bank you know of in your area. Try to avoid
American Express. They tend to lead full scale investigations. Unfortunately,
American Express is the most popular card out. When telling the person
who is taking your call the card number, say it slow, clear, and with confidence.
e.g. CC# is 5217-1234-5678-9012. Pause after each set of four so you don't
have to repeat it. Expiration date: The date must be at LEAST in that month.
It is best to with more than three months to go. The address: More commonly
referred to as the 'drop'. Well the drop can range from an abandoned building
to your next door neighbors apartment. If you plan to send it to an apartment
building then be sure NOT to include an apartment number. This will confuse
UPS or postage men a little and they will leave the package in the lobby.
Here is a list of various drops: The house next door whose family is on
vacation, the apartment that was just moved out of, the old church that
will be knocked down in six months, your friends house who has absolutely
nothing to do with the type of merchandise you will buy and who will also
not crack under heat from feds, etc.. There are also services that hold
merchandise for you, but personally I would not trust them. And forget
about P.O. Boxes because you need ID to get one and most places don't ship
to them anyway. Other aspects of carding: Verifying cards, seeing if they
were reported stolen. Verifying cards: Stores need to verify credit cards
when someone purchases something with one. They call up a service that
checks to see if the customer has the money in the bank. The merchant identifies
himself with a merchant number. The service then holds the money that the
merchant verified on reserve. When the merchant sends in the credit card
form, the service sends the merchant the money. The service holds the money
for three days and if no form appears then it is put back into the bank.
The point is that if you want to verify something then you should verify
it for a little amount and odds are that there will be more in the bank.
The good thing about verification is that if the card doesn't exist or
if it is stolen then the service will tell you. To verify MasterCard and
Visa try this number. It is voice: 1-800-327-1111 merchant code is 596719.
Stolen cards: Mastercard and Visa come out with a small catalog every week
where they publish EVERY stolen or fraudulently used card. I get this every
week by trashing the same place on the same day. If you ever find it trashing
then try to get it every week. Identifying cards: Visa card numbers begin
with a 4 and have either 13 or 16 digits. MasterCard card numbers begin
with a 5 and have 16 digits. American Express begins with a 3 and has 15
digits. They all have the formats of the following: 3xxx-xxxxxx-xxxxx American
Express 4xxx-xxx-xxx-xxx Visa 4xxx-xxxx-xxxx-xxxx Visa 5xxx-xxxx-xxxx-xxxx
MasterCard Gold cards: A gold card simply means that credit is good for
$5000. Without a gold card, credit would be normally $2000. To recognize
a gold card on a carbon there are several techniques: American Express-none.
Visa-PV instead of CV. Note-When verifying a PV Visa, you have to have
the real name of the cardholder. Mastercard-An asterisk can signify a gold
card, but this changes depending when the card was issued. I am going to
type out a dialog between a carder and the phone operator to help you get
the idea. Operator: "Over-priced Computer Goods, may I help you?" Carder:
"Hi, I would like to place an order please." Operator: "Sure, what would
you like to order?" Carder: "400 generic disks and a double density drive."
Operator: "Ok, is there anything else?" Carder: "No thank you, that's all
for today." Operator: "Ok, how would you like to pay for this? MasterCard
or Visa?" Carder: "Visa." Operator: "And your name is?" Carder: "Lenny
Lipshitz." (Name on card) Operator: "And your Visa card number is?" Carder:
"4240-419-001-340" (Invalid card) Operator: "Expiration date?" Carder:
"06-92." Operator: "And where would you like the package shipped to?" Carder:
"6732 Goatsgate Port. Paris, Texas, 010166." Operator: "And what is your
home telephone number?" Carder: "212-724-9970" (This number is actually
always busy) Operator: "I will also need your business phone number in
case we have to reach you." Carder: "You can reach me at the same number.
212-724-9970" Operator: "O.K. Thank you very much and have nice day." Carder:
"Excuse me, when will the package arrive?" Operator: "In six to seven days
UPS." Carder: "Thanks a lot, and have a pleasant day." Now you wait 6-7
days when the package will arrive to the address which is really a house
up for sale. There will be a note on the door saying, "Hello UPS, please
leave all packages for Lenny Lipshitz in the lobby or porch. Thanks a lot,
Lenny Lipshitz" (Make the signature half-way convincing)
87. Recognizing
credit cards by The Jolly Roger
[Sample: American Express] XXXX XXXXXX
XXXXX MM/Y1 THRU MM/Y2 Y1 John Doe AX Explanation: The first date is the
date the person got the card, the second date is the expiration date, after
the expiration date is the same digits in the first year. The American
Express Gold has many more numbers (I think 6 8 then 8). If you do find
a Gold card keep it for it has a $5000.00 backup even when the guy has
no money! [Sample: Master Card] 5XXX XXXX XXXX XXXX XXXX AAA DD-MM-YY MM/YY
John Doe. Explanation: The format varies, I have never seen a card that
did not start with a 5XXX there is another 4 digits on the next line that
is sometimes asked for when ordering stuff, (and rarely a 3 digit letter
combo (e. ANB). The first date is the date the person got the card and
the second date is the expiration date. Master Card is almost always accepted
at stores. [Sample: VISA] XXXX XXX(X) XXX(X) XXX(X) MM/YY MM/YY*VISA John
Doe Explanation: Visa is the most straight forward of the cards, for it
has the name right on the card itself, again the first date is the date
he got the card and the second is the expiration date. (Sometimes the first
date is left out). The numbers can either be 4 3 3 3 or 4 4 4 4. Visa is
also almost always accepted at stores, therefore, the best of cards to
use.
88. How To Create
A New Identity by The Walking Glitch
You might be saying, "Hey Glitch, what
do I need a new identity for?" The answer is simple. You might want to
go buy liquor somewhere, right? You might want to go give the cops the
false name when you get busted so you keep your good name, eh? You might
even want to use the new identity for getting a P.O. Box for carding. Sure!
You might even want the stuff for renting yourself a VCR at some dickless
loser of a convenience store. Here we go: Getting a new ID isn't always
easy, no one said it would be. By following these steps, any bozo can become
a new bozo in a couple of weeks. STEP 1 The first step is to find out who
exactly you'll become. The most secure way is to use someone's ID who doesn't
use it themselves. The people who fit that bill the best are dead. As an
added bonus they don't go complaining one bit. Go to the library and look
through old death notices. You have to find someone who was born about
the same time as you were, or better yet, a year or two older so you can
buy booze, etc. You should go back as far as you can for the death because
most states now cross index deaths to births so people can't do this in
the future. The cutoff date in Wisconsin is 1979, folks in this grand state
gotta look in 1978 or earlier. Anything earlier there is cool. Now, this
is the hardest part if you're younger. Brats that young happen to be quite
resilient, taking falls out of three story windows and eating rat poison
like its Easter candy, and not a scratch or dent. There ain't many that
die, so ya gotta look your ass off. Go down to the library and look up
all the death notices you can, if it's on microfilm so much the better.
You might have to go through months of death notices though, but the results
are well worth it. You gotta get someone who died locally in most instances:
the death certificate is filed only in the county of death. Now you go
down to the county courthouse in the county where he died and get the death
certificate, this will cost you around $3-$5 depending on the state you're
in. Look at this hunk of paper, it could be your way to vanish in a cloud
of smoke when the right time comes, like right after that big scam. If
You're lucky, the slobs parents signed him up with social security when
he was a snot nosed brat. That'll be another piece of ID you can get. If
not, that's Ok too. It'll be listed on the death certificate if he has
one. If you're lucky, the stiff was born locally and you can get his birth
certificate right away. STEP 2 Now check the place of birth on the death
certificate, if it's in the same place you standing now you're all set.
If not, you can mail away for one from that county but its a minor pain
and it might take a while to get, the librarian at the desk has listings
of where to write for this stuff and exactly how much it costs. Get the
Birth certificate, its worth the extra money to get it certified because
that's the only way some people will accept it for ID. When you're getting
this stuff the little forms ask for the reason you want it, instead of
writing in "Fuck you", try putting in the word "Genealogy". They get this
all the time. If the Death certificate looks good for you, wait a day or
so before getting the certified birth certificate in case they recognize
someone wanting it for a dead guy. STEP 3 Now your cooking! You got your
start and the next part's easy. Crank out your old Dot matrix printer and
run off some mailing labels addressed to you at some phony address. Take
the time to check your phony address that there is such a place. Hotels
that rent by the month or large apartment buildings are good, be sure to
get the right zip code for the area. These are things that the cops might
notice that will trip you up. Grab some old junk mail and paste your new
labels on them. Now take them along with the birth certificate down to
the library. Get a new library card. If they ask you if you had one before
say that you really aren't sure because your family moved around a lot
when you were a kid. Most libraries will allow you to use letters as a
form of ID when you get your card. If they want more give them a sob story
about how you were mugged and got your wallet stolen with all your identification.
Your card should be waiting for you in about two weeks. Most libraries
ask for two forms of ID, one can be your trusty Birth Certificate, and
they do allow letters addressed to you as a second form. STEP 4 Now you
got a start, it isn't perfect yet, so let's continue. You should have two
forms of ID now. Throw away the old letters, or better yet stuff them inside
the wallet you intend to use with this stuff. Go to the county courthouse
and show them what nice ID you got and get a state ID card. Now you got
a picture ID. This will take about two weeks and cost about $5, its well
worth it. STEP 5 If the death certificate had a social security number
on it you can go out and buy one of those metal SS# cards that they sell.
If it didn't, then you got all kinds of pretty ID that shows exactly who
you are. If you don't yet have an SS#, Go down and apply for one, these
are free but they could take five or six weeks to get, Bureaucrats you
know... You can invent a SS# too if you like, but the motto of 'THE WALKING
GLITCH' has always been "Why not excellence?". STEP 6 If you want to go
whole hog you can now get a bank account in your new name. If you plan
to do a lot of traveling then you can put a lot of money in the account
and then say you lost the account book. After you get the new book you
take out all the cash. They'll hit you with a slight charge and maybe tie-up
your money some, but if you're ever broke in some small town that bank
book will keep you from being thrown in jail as a vagrant. ALL DONE? So
kiddies, you got ID for buying booze, but what else? In some towns (the
larger the more likely) the cops if they catch you for something petty
like shoplifting stuff under a certain dollar amount, will just give you
a ticket, same thing for pissing in the street. That's it! No fingerprints
or nothing, just pay the fine (almost always over $100) or appear in court.
Of course they run a radio check on your ID, you'll be clean and your alter-ego
gets a blot on his record. Your free and clear. That's worth the price
of the trouble you've gone through right there. If your smart, you'll toss
that ID away if this happens, or better yet, tear off your picture and
give the ID to someone you don't like, maybe they'll get busted with it.
If you're a working stiff, here's a way to stretch your dollar. Go to work
for as long as it takes to get unemployment and then get yourself fired.
Go to work under the other name while your getting the unemployment. With
a couple of sets of ID, you can live like a king. These concepts for survival
in the new age come to you compliments of THE WALKING GLITCH.
89. Remote Informer
Issue #2 by Tracker, Norman Bates, and Ye Cap'n Raggers and Braggers
This section is to make you aware of
well-known raggers and braggers. Since this is the first time this section
is being printed, we will tell you what classifies people as raggers and
braggers. In the future issues the top raggers and braggers will be listed
in this newsletter to let the SysOps know who not to let on their board,
or to atleast keep an eye on. A ragger is someone who will put someone
else down for something. The person might post a message asking a novice
question about hacking and phreaking, or may say something that is completely
wrong, and a ragger will put the other person down for he said, posted,
etc. The ones that usually classify in this category are the ones that
think they know it all and consider themselves right no matter what anyone
says. Most of the users that use codes and consider themselves a master
phreaker usually become raggers. A bragger is someone who either does or
thinks he does know everything, and puts it upon himself to tell the whole
world that he knows it all. This person is also one who thinks he is better
than everyone else and he believes he is Elite, and no one else is. People
who tend to do this are those who have, for some reason, become well-known
in the underworld, and as a result become a bragger. Those usually not
too well-known will not tend to brag as much as those who think everyone
would love to be their friend and be like them. As a well-known ragger
and bragger, The Toad, learned that it does not help to be one or both
of those. He has since changed and is now easily accepted by most. Most
people disliked him because others they knew had said something bad about
him. This is called peer pressure and is a bad influence to those who are
new to the underworld. I would suggest in the future, to not judge someone
by what others say, but rather by how they act around/to you. The current
most popular Atarian that classifies as a ragger and a bragger is Ace of
Aces, and is well-hated by many users and SysOps, since he tends to put
down anything anyone says and considers himself the best at writing hacking
programs. He is commonly referred to as Ass of Asses and Ass of Assholes.
Even holding an open mind about this guy, you would soon come to find that
what others said coincides with what you see from him. A New 950 has arrived!
LDDS, who as mentioned above bought out TMC, is installing a new 950 port
to most major cities. By the time you read this, it should be in almost
every area that supports 950 ports. The number is 950-1450. This port will
dial 976 numbers, but not 700, 800, or 900 numbers. The dialing method
for LDDS is: 7 digit code, then even if the code is bad it will give you
a dial tone. Then dial the area code plus the number. If you have a bad
code it will simply say your call cannot be completed as it was dialed.
There is a default code used on the system that currently works. The code
is simply, 1234567. I have seen codes from 5 different companies and they
all are in the format of 00xxxxx. I do not know what type of software they
use, but I will know by the next issue exactly what they place on the bills.
This could be the answer to a lot of people's problems with fear of Sprint
and ITT, especially AllNets. Just remember, Tracker is the one who found
this, and all information about it. If someone is seen saying they found
this, then they will be listed in the next issue which will contain an
article on leeches. Mailbox Systems Mailbox systems are the link between
information and the underworld. If you have ever called one, then you will
know the advantages of having one, especially the ones that are open to
whole underworld, rather than just a select few. There are two types of
mailbox systems that are widely used. The first type we will talk about
is the multiple mailbox systems, or commonly referred to as message systems.
These systems have several mailboxes set up on one number. Usually, you
can access other mailboxes from that number by pressing '*' or '#'. Sometimes
you just enter the mailbox number and you are connected. These are the
safest systems to use to protect information from US Sprint and other long
distance companies. Since US Sprint and other companies call the destination
numbers, it is safer to have 800 mailbox systems, and most of the time,
the multiple mailbox systems are on 800 numbers. The passcode on these
systems can vary in length and can be accessed by several different methods,
so it is impossible to explain exactly how to hack these systems. The other
type is the single mailbox system. These are usually set up in a reserved
prefix in an area code. (Ex: 713-684-6xxx) These systems are usually controlled
by the same type of hardware/software. To access the area where you enter
the passcode, just hit '0' for a second or so. The passcodes are four (4)
digits long. The only way to hack these is manually. The best thing you
could do is to find one that does not have a recording from a person, but
just the digitized voice. If you hack one that someone already owns, they
will report it and it will not last as long. Here is a list mailboxes or
prefixes to help you get started --------------------------------------------------------------------------
SingleMultipleNameDigits213-281-8xxx212-714-2770 3213-285-8xxx216-586-5000
4213-515-2xxx415-338-7000Aspen Message System3214-733-5xxx714-474-2033Western
Digital 214-855-6xxx800-222-0651Vincent and Elkins4214-978-2xxx800-233-8488
3215-949-2xxx800-447-8477Fairylink7312-450-8xxx800-521-5344 3313-768-1xxx800-524-2133RCA4405-557-8xxx800-527-0027TTE
TeleMessager6602-230-4xxx800-632-7777Asynk6619-492-8xxx800-645-7778SoftCell
Computers4713-684-6xxx800-648-9675Zoykon4 800-847-0003Communications
World3
90. Remote Informer
Issue #3 by Tracker, Ye Cap'n, Norman Bates
Introduction It's been a month now,
and A LOT has happened. So much, in fact, that the information will be
split into several issues. This should be no shock since I mentioned in
the first issue that we may put several issues out sometimes. I want to
congratulate the readers for finally contributing to the newsletter. This
first two issues were all on information that I, myself, obtained. Several
people gave me information for these issues, and their handle and information
is included in the articles. ITT has 9 digits! For those of you who did
not know this, ITT has nine digit codes. They are said to give better connections
to some extent. This info was originally given to us by Party Beast. Phreaky
Phones Go Down! The famed Phreaky Phones are down again. Modem Man, the
original person that started them, has said that they will be down until
further notice. In the meantime, other independent boxes are being started.
A listing can be made of current ones on request. Magnus Adept Gets Busted
Fellow Atarian and well-known phreak Magnus Adept got caught by MCI. Details
of the how, when, and where are not known at this time. He got caught with
150 codes and may have to pay up to 50 dollars for each code. Sprint Codes
Are Dying Fast! Sprint codes are hard to get and when they are obtained,
they tend to die rather quickly. Phreakers have been saying that the 950-0777
port is dead, but on the contrary, it is still available in states that
are not highly abused by phreaks. Here again, rumors are being spread.
The Best BBS of the Month Starting from now on, we will have a BBS of the
month. We will choose a BBS, regardless of computer type, and look at the
user participation in phreak related matters, as well as quality discussions
on the various illegal topics. A BBS can remain the BBS of the month as
long as they reside above the rest of the BBS systems. Even though we will
sometimes bring out more than one issue in a month, the board will remain
BBS of the month until the first issue in the next month comes out. This
month's BBS of the month is FBI PirateNet. We chose this board because
of the large numbers of posts in the bases, and not only information, but
discussions as well, with a minimum number of posts from raggers and braggers.
The number for it is 516-661-7360. The Sysop of FBI PirateNet is The Phantom,
not to be confused with an earlier NARC. US Sprint Expected to Trim Staff,
Consolidate Divisions New York -- US Sprint Communications Corp., the troubled
long distance carrier, is expected to announce soon that it will cut its
work force by several hundred people and reduce its seven regional divisions
to 3 operating groups, sources familiar with the company said. The company's
Pacific division is based in Burlingame, CA. The layoffs and reorganization
are part of a plan by US Sprint's new president, Robert H. Snedaker, to
reduce heavy operating losses, which analysts expect to reach more than
$800 million this year. Snedaker replaced Charles M. Slibo, who was forced
to resign in July because losses were running much higher than the parent
companies had expected. Problems with the company's computerized billing
system also contributed to Skibo's ouster. US Sprint is owned and operated
by the GTE Corp. and United TeleCom. According to sources close to Snedaker,
who was vice chairman and chief operating officer of United TeleCom, he
is planning to consolidate the company's 7 divisions, which operate in
the same geographical regions as the seven regional Bell operating companies,
into 3 divisions. The rationale for the move, according to industry analysts,
is that the company will need a much smaller work force once it begins
handling all it's phone traffic on it's new fiber optic network, which
can carry a greater number of telephone calls at less cost. Company officials
have said that they expect to have most of the traffic on the network by
early next year. One source said that there would be more than one round
of layoffs in the coming months and that the company ultimately plans to
reduce its 14,000 member work force by 15 percent. Several top managers
are expected to resign as soon as US Sprint centralizes its marketing and
support operations as its headquarters in Kansas City, MO., according to
a report in the latest issue of Business Week magazine. A spokesman for
US Sprint said on Friday that the company would not comment on the rumors.
The company is the nation's third largest long distance company, after
the American Telephone and Telegraph Co. (AT&T) and MCI Communications
Co. Last year, Washington based MCI undertook a similar reorganization
in which it posted a $502« million loss to write down old inventory
and restructure operations. Analysts said that is US Sprint is to turn
a profit, the company must increase its market share. "To do this, US Sprint
must gain more large business customers, which account for about 80 percent
of industry revenues," said Robert B. Morris III, Securities in San Francisco.
Morris said that by using a slick marketing campaign to differentiate its
all-fiber telephone network from those of competitors, US Sprint more than
doubled its customer base last year. But "most of these customers were
residential and small business users that added little to Sprint's bottom
line," he added. "If the company expects to be profitable, it will have
to concentrate on providing the best service to volume users." Secret Service
Cracks Down on Teen Hackers Mount Lebanon, PA -- The US Secret Service
and local police departments have put a scare into the hacker community
with a nationwide crackdown on computer crime that has resulted in the
arrests of teenage hackers in at least three cities. "People who monitor
the bulletin boards say there are a lot of nervous hackers out there, wondering
who will be arrested next," says Ronald E. Freedman, vice-president of
Advanced Information Management, a Woodbridge, VA base computer security
firm. Nine teenagers from Mount Lebanon Junior-Senior High School near
Pittsburg, PA, were arrested recently and charged with computer fraud.
The juveniles allegedly used home computers to gain illegal access to a
credit card authorization center. They obtained valid credit card numbers
and used them to purchase thousands of dollars worth of mail order merchandise,
the police said. Freedman says it appears the hackers used some relatively
sophisticated techniques in the scheme, including specially written software
that enabled them to bypass security controls and navigate through credit
records to obtain key information. Police officials say that the hackers
also obtained access codes from pirate bulletin board systems to make free
long distance calls and gain access to various business and government
computers. The arrests were the result of a 6 week investigation by the
Secret Service and the Mount Lebanon police. The police were tipped off
by parents who were suspicious about how their son managed to obtain a
skateboard valued at $140. The Secret Service was also involved in investigations
that led to the arrests of several hackers in San Francisco and New York
last July. Secret Service spokesman William Corbett says that although
some reports have portrayed the hackers as part of a national crime ring,
the cases are unrelated. "It's just that a few of these computers hacking
cases came to a head at about the same time," he says. Federal Legislation
enacted in 1984 gives the Secret Service, part of the Department of the
Treasury, a major role in investigating computer crimes. Under the federal
Computer Fraud and Abuse Act of 1986, computer fraud is a felony that carries
a maximum penalty of 5 years for the first offense, and 10 years for the
second. Displaying unauthorized passwords on hacking bulletin boards carries
a maximum penalty of 1 year in prison for the first offense, and 10 years
for the second. German Teens Crack NASA Washington, D.C. -- A group of
West German teenagers from the Chaos Computer Club penetrated a NASA network
recently, saying they were doing it to "test the security." What they got
into was SPAN Net, a computer network with about 700 notes, which is actually
based at the Goddard Space Center in Maryland. All that's in there is unclassified
data, space science information, and post-flight data analysis. "Anyone
with NASA related research can apply for access to SPAN" says a spokesman,
who adds that the network runs on DEC VAX hardware. "We picked up three
attempts to gain access and put in security precautions so it wouldn't
happen." His personal opinion is, "We're happy that they couldn't get back
in, and decided to go public." He also added that NASA has many other networks,
many of the classified and "probably impenetrable. But I do not want to
challenge anybody." How'd they get in? Probably they got a West German
NASA licensee, which gave them a visitor's pass, then they created new
passwords with unlimited security for themselves, after which getting around
the network was easy.
91. Remote Informer
Issue #4 by Tracker, Norman Bates, Ye Cap'n Switching Systems
There are currently three different
forms of switching systems that are present in the United States today.
Step by Step (SxS), Crossbar, and the Electronic Switching System (ESS)
make up the group. Phreaks have always been a little tentative when it
comes to "doing their work" once they have heard about effects of switching
systems on their hobby. After researching this topic, I have found that
there really is not that much to be worried about. Read on, while I share
with you information which I have compiled about all of these switching
systems and their distinct features. The first switching system that was
used in the country was called Step by Step. This was adopted in 1918 by
Bell, and until 1978, they had over 53% of all their exchanges using Step
by Step (SxS). This system is known for it's long, confusing train of switches
that are used for its step by step switching. Step by Step has many disadvantages
to phone users. The switch train becomes jammed fairly often, and it causes
calls to be blocked. Also, SxS does not allow the use of DTMF dialing.
This accounts for some of the areas in the United States that cannot have
touch tone dialing abilities. A tremendous amount of electricity and maintenance
needs to accompany the SxS switching system, which makes it even more impratical.
All in all, this is probably the most archaic switching system around.
There are a number of ways to see if you are on SxS. You will notice that
there are no pulsing digits after dialing. Most sources say that the phone
company will sound like many typewriters. SxS does not offer features such
as speed calling, call forwarding, three-way calling, call waiting, and
other such services. Pay phones on SxS also will want your money before
you receive a dial tone. This adds to the list of disadvantages labeled
to that of the Step by Step switching systems. Another type of switching
system that is prevalent in the United States is Crossbar. Crossbar has
been Bell's primary switcher after 1960, and three types of it exists.
Number 1 Crossbar (1xB), Number 4 Crossbar (4xB), and the Number 5 Crossbar
(5xB). In Crossbar, a switching matrix is used for all the phones in an
area, and when someone calls, the route is determined and is met up with
the other phone. This matrix is set-up in horizontal and vertical paths.
Unlike other switching systems, in my research, I could not come up with
any true and definite distinguishing features of the Crossbar switching
systems. The Electronic Switching System (ESS) is yet another switching
system used in the United States and the most used of all three switching
systems. ESS is an extremely advanced and multi-faced type of switching
system, and is feared by marauders of the phone company everywhere. With
ESS, your phone company is able to know every digit dialed (including mistakes),
who you call, when you called, and how long you were connected. ESS is
also programmed to print out the numbers of people who make excessive calls
to WATS numbers (800 services) or directory assistance. This feature of
ESS is called 800 Exceptional Calling Report, and has spelled the end of
some forms of continuous code hacks to certain extenders. ESS can also
be programmed to print logs of who called and abused certain numbers as
well. Everything is kept track of in its records. The aforementioned facts
show that ESS has made the jobs of organizations such as the FBI, NSA,
and other phone company security forces easier. Tracing can be done in
a matter of microseconds, and the result will be conveniently printed out
on the monitor of a phone company officer. ESS is also programmed to pick
up any "foreign tones" on the phone line such as the many varied tones
emulated by boxes. ESS can be identified by a few features common in it.
The 911 emergency service is covered in the later versions of ESS. Also,
you are given the dial tone first when using a pay phone unlike that of
SxS. Calling services like call forwarding, speed calling, and call waiting
are also common to ESS. One other feature common to ESS is ANI (Automatic
Number Identification) for long distance calls. As you can see, ESS is
basically the zenith of all switching systems, and it will probably plague
the entire country by the early 1990's. Soon after, we should be looking
forward to a system called CLASS. This switching system will contain the
feature of having the number of the person that is calling you printed
out on your phone. What have I concluded about these switching systems?
Well, they are not good enough. I know a few people employed by the phone
company, and I know for a fact that they do not have enough time these
days to worry about code users, especially in large, metropolitan areas.
So, I will go out on a limb here, and say that a large portion of people
will never have to worry about the horrors of ESS. New Gizmo Can Change
Voice Gender The most amazing device has turned up in the new Hammacher
Schlemmer catalog: the telephone voice gender changer. What it does is
change the pitch of your voice from, say, soprano to bass -- a most efficient
way to dissuade an obscene phone caller just as he's getting warmed up.
That is not the same as running a 45 rpm. record at 33. In digital conversion,
the pitch can be changed without altering the speed. The device runs on
a 9-volt batter and attaches to the telephone mouth piece with a rubber
coupler that takes but a moment to slip on and off. With the changer switched
on, says Lloyd Gray, a Hammacher Schlemmer technical expert, "the effect
is similar to what you hear when they interview an anonymous woman on television
and disguise her voice by deepening it." "It's better for changing a woman's
voice to a man's than the other way around," Gray said. A man can use it
to raise the pitch of his voice, but he still won't sound like a woman."
A man could, however, use the changer to disguise his voice. But with the
device set on high, Gray's voice still could be identified as his own.
On low, his normal tenor became so gravel like that the words were unintelligible.
92. Remote Informer
Issue #5 by Tracker, Norman Bates, and Ye Cap'n AT&T Rates
WASHINGTON -- American Telephone &
Telegraph Co. proposed Tuesday to lower its interstate long-distance rates
by an average of 3.6% to reflect reduced costs in connecting to the local
telephone network. The largest decrease -- 6.3% -- would be seen in day
time prices "Because of the need to make those rates more competitive,"
AT&T said. Rates for calls made during evening hours would drop 2.2%
and calls made during the late night and weekends would be cut by 0.8%,
the company said. The rate reductions would take effect Jan. 1, if they
are approved by the Federal Communications Commission. Reacting to the
proposed price cuts, MCI Communications Corp. and US Sprint Communications
Co., the nation's second-largest and third-largest long distance companies
respectively, said their response would depend on what the FCC finally
approves but both said they intended to remain competitive with AT&T.
AT&T, the nation's largest long-distance company, proposed to the FCC
that its rates drop as much as $800 million, but AT&T said the exact
amount will depend on the access charges the FCC allows the local telephone
companies to collect from long distance carriers, which must pay the fees
to hook into the phone local network. AT&T has challenged the new access
rates filed by the regional Bell operating companies, contending they are
more than $1 billion too high. In proposing its new rates, the long-distance
leader told the FCC it expects local companies' access fees to fall by
at least $200 million -- which would amount to an average rate reduction
of less than 1%. But the company said it believes the FCC will order an
additional $600 million in reductions based on AT&T's challenge. "We're
confident the FCC will recognize that access charges filed by the local
telephone companies need to be substantially reduced, which would mean
more savings for our customers," said Larry Garfinkel, AT&T vice president
for marketing. He said the company filed its proposed rates based on disputed
charges because "we wanted to let the public react ... and further to let
the FCC have full knowledge of where we were heading given our expectation
that we had a valid basis for our dispute." AT&T's long-distance rates
have fallen by about 34% since the company was stripped of its local operating
companies by an antitrust decree nearly four years ago. Since then, phone
rate payers have been paying a larger share of the costs of maintaining
the local network through monthly subscriber line charges, now $2.60 for
residential customers. That has reduced the long-distance companies' share
of local network expenses, which they pay in the form of access charges.
Jack Grubman, a telephone analyst with PaineWebber Inc., said AT&T's
proposal targets business customers because "that's where the competition
is and where the better (profit) margins are." In addition, it aims to
keep the pressure on competition in international calling by extending
discounts to more customers. Grubman added that, if the company's rate
proposal is approved by the FCC, he would expect no further cuts in AT&T
rates in 1988. Wendell Lind, AT&T administrator of rates and tariffs,
said the cuts for business and residential customers are about the same
because business cuts are offset by a proposed $128 million increase in
AT&T's private line rates. AT&T is the only long-distance company
whose rates are regulated by the FCC, but its prices set the pace for the
industry. Though AT&T is far larger than any of its competitors, its
market share has been declining since divestiture and the company now says
it serves about 75 percent of the market. In addition to the reductions
in basic long-distance rates, AT&T proposed cutting prices by 5% and
5.7% for its Pro-America calling plans. The company also proposed to reduce
prices by 2.9 percent for its 800 Service customers and 4.4 percent for
WATS customers, although it would increase the monthly access line charges
for those plans by $3.20 to reflect higher special access charges filed
by the local phone companies. US Sprint Operator Service Traffic Increases
40% ORLANDO, Fla. -- US Sprint Wednesday announced its long distance operators
who began saying, "May I help you?" just five months ago, are now handling
3« million calls a month. The fiber-optic long-distance carrier,
offering the only operator service alternative to AT&T has experienced
a 40 percent growth in operator service calls since it announced its service
July 1. Amanda Weathersby, US Sprint vice president of product marketing,
said Tuesday, "More and more people are taking advantage of our call completion
assistance and alternative billing arrangements. "Customer surcharges are
the same as AT&T with the added benefit of US Sprint's fiber-optic
quality and lower long-distance rates." US Sprint currently offers person-to-person,
station-to-station, call completion and collect calling. US Sprint has
announced an agreement with US WEST Service Link that will allow anyone
to call on US Sprint and charge their calls to a Regional Bell Operating
Co. calling card beginning in first quarter 1988. "Previously, our operator
service was available only on pre-subscribed US Sprint phones and recently
we added operator assistance for US Sprint FON CARD customers," Weathersby
said. "With this new agreement, we'll be able to expand our operator service
to markets such as pay phones, hospitals, and hotels/motels." The newest
24-hour operator service center in Dallas began operations on Oct. 5. US
Sprint's other operator service centers are in: Cherry Hill, NJ; Atlanta;
Lombard, IL and Reno, NV. US Sprint is a joint venture of United Telecommunications
Inc. of Kansas City, MO and GTE Corp. of Stamford, Conn. Pacific Bell Pursuing
Calling Card Thief SAN FRANCISCO--(BW)--Pacific Bell is warning consumers
to protect their telephone calling cards like any other credit card in
the wake of a series of frauds by people posing as phone company employees.
A Pacific Bell spokesman says customers in the 213, 805 and 916 area codes
are being victimized by someone who says he is a telephone company employee
investigating calling card fraud. The individual calls people at home at
odd hours, asking for their calling card numbers. He then sells the numbers
to people who use the numbers to make long distance phone calls. As recently
as Monday of this week, 180 long distance calls were billed to a Sacramento
area resident who had given his number to the thief just three hours earlier.
According to Pacific Bell, this kind of scheme and other forms of calling
card fraud cost telephone customers nationwide half a billion dollars a
year. The company offered these tips to consumers to avoid becoming a victim
of calling card fraud: Never give your calling card number or personal
identification number to anyone. Any telephone company employee with a
legitimate need to know the number has access to it. Treat your calling
card like any other credit card. Report its loss immediately by calling
the 800 number on the back of the card 800-621-0430. If you receive a suspicious
call regarding your telephone calling card, report it by calling the 800
number on the back of the card. If you receive a call from someone claiming
to be a telephone company employee and asking for your calling card number,
ask for a name and number to call back. Then call the local Pacific Bell
business office to report the incident. One suspect was arrested in Southern
California last week by a quick thinking customer who did just that. Pacific
Bell immediately contacted the local police department. A suspect holding
seven stolen calling card numbers was arrested minutes later. Pacific Bell
and long-distance telephone companies will credit customers for calling
card charges determined to be fraudulent. Pacific Bell is a subsidiary
of Pacific Telesis Group, a diversified telecommunications corporation
based in San Francisco.
93. The Phreaker's
Guide to Loop Lines by The Jolly Roger
A loop is a wondrous device which the
telephone company created as test numbers for telephone repairmen when
testing equipment. By matching the tone of the equipment with the tone
of the loop, repairmen can adjust and test the settings of their telephone
equipment. A loop, basically, consists of two different telephone numbers.
Let's use A and B as an example. Normally if you call A, you will hear
a loud tone (this is a 1004 hz tone), and if you call B, the line will
connect, and will be followed by silence. This is the format of a loop
line. Now, if somebody calls A and someone else calls B--Viola!--A and
B loop together, and one connection is made. Ma Bell did this so repairmen
can communicate with each other without having to call their own repair
office. They can also use them to exchange programs, like for ANA or Ringback.
Also, many CO's have a "Loop Assignment Center". If anyone has any information
on these centers please tell me. Anyway, that is how a loop is constructed.
From this information, anyone can find an actual loop line. Going back
to the A and B example, Note: the tone side and the silent side can be
either A or B. Don't be fooled if the phone company decides to scramble
them around to be cute. As you now know, loops come in pairs of numbers.
Usually, right after each other. For example: 817-972-1890 and 817-972-1891
Or, to save space, one loop line can be written as 817-972-1890/1. This
is not always true. Sometimes, the pattern is in the tens or hundreds,
and, occasionally, the numbers are random. In cities, usually the phone
company has set aside a phone number suffix that loops will be used for.
Many different prefixes will correspond with that one suffix. In Arlington,
Texas, a popular suffix for loops is 1893 and 1894, and a lot of prefixes
match with them to make the number. For Example: 817-460-1893/4 817-461-1893/4
817-465-1893/4 817-467-1893/4 817-469-1893/4 ...are all loops... or a shorter
way to write this is: 817-xxx-1893/4 xxx= 460, 461, 465, 467, 469 Note:
You can mix-and-match a popular suffix with other prefixes in a city, and
almost always find other loops or test numbers. Note: For Houston, the
loop suffixes are 1499 and 1799. And for Detroit it's 9996 and 9997. When
there are a large number of loops with the same prefix format, chances
are that many loops will be inter-locked. Using the above example of Arlington
loops again, (I will write the prefixes to save space) 460, 461, and 469
are interlocked loops. This means that only one side can be used at a given
time. This is because they are all on the same circuit. To clarify, if
817-461-1893 is called, 817-460 and 469-1893 cannot be called because that
circuit is being used. Essentially, interlocked loops are all the same
line, but there are a variety of telephone numbers to access the line.
Also, if the operator is asked to break in on a busy loop line he/she will
say that the circuit is overloaded, or something along those lines. This
is because Ma Bell has taken the checking equipment off the line. However,
there are still many rarely used loops which can be verified and can have
emergency calls taken on them. As you have found out, loops come in many
types. Another type of loop is a filtered loop. These are loop lines that
the tel co has put a filter on, so that normal human voices cannot be heard
on either line. However, other frequencies may be heard. It all depends
on what the tel co wants the loop to be used for. If a loop has gotten
to be very popular with the local population or used frequently for conferences,
etc. the tel co may filter the loop to stop the unwanted "traffic". Usually,
the filter will be removed after a few months, though.
94. How Ma Bell
Works by The Jolly Roger
In this article, I will first describe
the termination, wiring, and terminal hardware most commonly used in the
Bell system, and I will include section on methods of using them. LOCAL
NETWORK The local telephone network between the central office/exchange
and the telephone subscribers can be briefly described as follows: From
the central office (or local exchange) of a certain prefix(es), underground
area trunks go to each area that has that prefix (Usually more than one
prefix per area.) At every few streets or tract areas, the underground
cables surface. They then go to the telephone pole (or back underground,
depending on the area) and then to the subscribers house (or in the case
of an apartment building or mutli-line business, to a splitter or distribution
box/panel). Now that we have the basics, I'll try and go in-depth on the
subject. UNDERGROUND CABLES These are sometimes inter-office trunks, but
usually in a residential area they are trunk lines that go to bridging
heads or distribution cases. The cables are about 2-3 inches thick (varies),
and are either in a metal or pvc-type pipe (or similar). Rarely (maybe
not in some remote rural areas) are the cables just 'alone' in the ground.
Instead they are usually in an underground cement tunnel (resembles a small
sewer or storm drain.) The manholes are heavy and will say 'Bell system'
on them. They can be opened with a « inch wide crowbar (Hookside)
inserted in the top rectangular hole. There are ladder rungs to help you
climb down. You will see the cable pipes on the wall, with the blue and
white striped one being the inter-office trunk (at least in my area). The
others are local lines, and are usually marked or color coded. There is
almost always a posted color code chart on the wall, not to mention Telco
manuals describing the cables and terminals, so I need not get into detail.
Also, there is usually some kind of test equipment, and often Bell test
sets are left in there. BRIDGING HEADS The innocent-looking grayish-green
boxes. These can be either trunk bridges or bridging for residences. The
major trunk bridging heads are usually larger, and they have the 'Western
Electric' logo at the bottom, whereas the normal bridging heads (which
may be different in some areas-depending on the company you are served
by. GTE B.H.'s look slightly different. Also, do not be fooled by sprinkler
boxes!) They can be found in just about every city. To open a bridging
head: if it is locked (and you're feeling destructive), put a hammer or
crowbar (the same one you used on the manhole) in the slot above the top
hinge of the right door. Pull hard, and the door will rip off. Very effective!
If it isn't locked (as usual), take a 7/8 inch hex socket and with it,
turn the bolt about 1/8 of a turn to the right (you should hear a spring
release inside). Holding the bolt, turn the handle all the way to the left
and pull out. To Check for a test-set (which are often left by Bell employees),
go inside - First check for the 'bridging log' (or whatever), which is
on the left door. If that doesn't work, you can use the following: ANI
# (Automatic Number ID) This is a Telco test number that reports to you
the number that you're calling from (It's the same, choppy 'Bell bitch'
voice that you get when you reach a disconnected number) For the: 213 NPA
- Dial 1223 408 NPA - Dial 760 914 NPA - Dial 990 These are extremely useful
when messing with any kind of line terminals, house boxes, etc. Now that
we have bridging heads wired, we can go on... (don't forget to close and
latch the box after all... Wouldn't want GE and Telco people mad, now,
would we?) "CANS" - Telephone Distribution Boxes Basically, two types:
Large, rectangular silver box at the end of each street. Black, round,
or rectangular thing at every telephone pole. Type 1 - This is the case
that takes the underground cable from the bridge and runs it to the telephone
pole cable (The lowest, largest one on the telephone pole.) The box is
always on the pole nearest the bridging head, where the line comes up.
Look for the 'Call before you Dig - Underground cable' stickers.. The case
box is hinged, so if you want to climb the pole, you can open it with no
problems. These usually have 2 rows of terminal sets. You could try to
impersonate a Telco technician and report the number as 'new active' (giving
a fake name and fake report, etc.) I don't recommend this, and it probably
won't (almost positively won't) work, but this is basically what Telco
linemen do.) Type 2 - This is the splitter box for the group of houses
around the pole (Usually 4 or 5 houses). Use it like I mentioned before.
The terminals (8 or so) will be in 2 horizontal rows of sets. The extra
wires that are just 'hanging there' are provisions for extra lines to residences
(1 extra line per house, that's why the insane charge for line #3!) If
its the box for your house also, have fun and swap lines with your neighbor!
'Piggyback' them and wreak havoc on the neighborhood (It's eavesdropping
time...) Again, I don't recommend this, and its difficult to do it correctly.
Moving right along... APARTMENT / BUSINESS MULTI-LINE DISTRIBUTION BOXES
Found outside the building (most often on the right side, but not always...
Just follow the wire from the telephone pole) or in the basement. It has
a terminal for all the lines in the building. Use it just like any other
termination box as before. Usually says 'Bell system' or similar. Has up
to 20 terminals on it (usually.) the middle ones are grounds (forget these).
The wires come from the cable to one row (usually the left one), with the
other row of terminals for the other row of terminals for the building
fone wire pairs. The ring (-) wire is usually the top terminal if the set
in the row (1 of 10 or more), and the tip is in the clamp/screw below it.
This can be reversed, but the cable pair is always terminated one-on-top-of-each-
other, not on the one next to it. (I'm not sure why the other one is there,
probably as a provision for extra lines) Don't use it though, it is usually
to close to the other terminals, and in my experiences you get a noisy
connection. Final note: Almost every apartment, business, hotel, or anywhere
there is more than 2 lines this termination lines this termination method
is used. If you can master this type, you can be in control of many things...
Look around in your area for a building that uses this type, and practice
hooking up to the line, etc. As an added help, here is the basic 'standard'
color-code for multi-line terminals/wiring/etc... Single line: Red = Ring
Green = Tip Yellow = Ground * *Connected to the ringer coil in individual
and bridged ringer phones (Bell only) Usually connected to the green (Tip)
Ring (-) = Red White/Red Stripe Brown White/Orange Stripe Black/Yellow
Stripe Tip (+) = Green (Sometimes yellow, see above.) White/Green Stripe
White/Blue Stripe Blue Black/White Stripe Ground = Black Yellow RESIDENCE
TERMINAL BOX Small, gray (can be either a rubber (Pacific Telephone) or
hard plastic (AT&T) housing deal that connects the cable pair from
the splitter box (See type 2, above) on the pole to your house wiring.
Only 2 (or 4, the 2 top terminals are hooked in parallel with the same
line) terminals, and is very easy to use. This can be used to add more
lines to your house or add an external line outside the house. TEST SETS
Well, now you can consider yourself a minor expert on the terminals and
wiring of the local telephone network. Now you can apply it to whatever
you want to do.. Here's another helpful item: How to make a Basic Test-Set
and how to use it to dial out, eavesdrop, or seriously tap and record line
activity. These are the (usually) orange hand set fones used by Telco technicians
to test lines. To make a very simple one, take any Bell (or other, but
I recommend a good Bell fone like a princess or a trimline. GTE flip fones
work excellently, though..) fone and follow the instructions below. Note:
A 'black box' type fone mod will let you tap into their line, and with
the box o, it's as if you weren't there. They can receive calls and dial
out, and you can be listening the whole time! Very useful. With the box
off, you have a normal fone test set. Instructions: A basic black box works
well with good results. Take the cover off the fone to expose the network
box (Bell type fones only). The
98. Pearl Box
Plans by The Jolly Roger
The Pearl Box: Definition - This is
a box that may substitute for many boxes which produce tones in hertz.
The Pearl Box when operated correctly can produce tones from 1-9999hz.
As you can see, 2600, 1633, 1336 and other crucial tones are obviously
in its sound spectrum. Materials you will need: C1, C2:«mf or «uf
ceramic disk capacitors Q1.....NPN transistor (2N2222 works best) S1.....Normally
open momentary SPST switch S2.....SPST toggle switch B1.....Standard 9-Volt
battery R1.....Single turn, 50k potentiometer R2.....Single turn, 100k
potentiometer R3.....Single turn, 500k potentiometer R4.....Single turn,
1Meg potentiometer SPKR...Standard 8-ohm speaker T1.....Mini transformer
(8-ohm works best) Misc...Wire, solder, soldering iron, PC board or perfboard,
box to contain the completed unit, battery clip Instructions for building
Pearl Box: Since the instruction are EXTREMELY difficult to explain in
words, you will be given a schematic instead. It will be quite difficult
to follow but try it any way. (Schematic for The Pearl Box) +---+------------+---------+
! ! \ C1 C2 \ ! ! + + + -----+T1 !\ +------------+-+ ! b c-------! + !
Q1 ! +-S1- ! e-----S2---+ ! SPKR ! ! ! +---- ! B1 ! ! ! ! ! +-------+ !R1
R2 R3 R4! /\/\ /\/\ /\/\ /\/\ +--+ +--+ +--+ Now that you are probably
thoroughly confused, let me explain a few minor details. The potentiometer
area is rigged so that the left pole is connected to the center pole of
the potentiometer next to it. The middle terminal of T1 is connected to
the piece of wire that runs down to the end of the battery. Correct operation
of The Pearl Box: You may want to get some dry-transfer decals at Radio
Shack to make this job a lot easier. Also, some knobs for the tops of the
potentiometers may be useful too. Use the decals to calibrate the knobs.
R1 is the knob for the ones place, R2 is for the tens place, R3 if for
the hundreds place and R4 is for the thousands place. S1 is for producing
the all the tones and S2 is for power. Turn on the power and adjust the
knobs for the desired tone. (Example: For 2600 hz-R1=0:R2=0:R3=6:R4=2)
Hit the push-button switch and VIOLA! You have the tone. If you don't have
a tone recheck all connections and schematic.
99. The Phreak
file by The Jolly Roger
202 282 3010 UNIV. OF D.C. 202 553
0229 PENTAGON T.A.C. 202 635 5710 CATHOLIC UNIV. OF AMERICA 202 893 0330
DEFENSE DATA NETWORK 202 893 0331 DEFENSE DATA NETWORK 202 965 2900 WATERGATE
203 771 4930 TELEPHONE PIONEERS 206 641 2381 VOICE OF CHESTER 212 526 1111
NEW YORK FEED LINE 212 557 4455 SEX HOT LINE 212 799 5017 ABC NY FEED LINE
212 934 9090 DIAL-AN-IDIOT 212 976 2727 P.D.A. 212 986 1660 STOCK QUOTES
213 541 2462 STOCK MARKET REPORTS 213 547 6801 NAVY SHIPS INFO 213 576
6061 " " 213 664 3321 NEWS FOR THE BLIND 301 393 1000 " " 301 667 4280
LOTTERY INFO 312 939 1600 " " 404 221 5519 NUCLEAR COMMISSION 408 248 8818
1ST NATIONAL BANK 415 642 2160 EARTHQUAKE REPORT 505 883 6828 " " 512 472
2181 " " 512 472 4263 WEIRD RECORDING 512 472 9833 " " 512 472 9941 INSERT
25 CENTS 512 472 9941 SPECIAL RECORDING 512 870 2345 " " 516 794 1707 "
" 619 748 0002 LOOP LINE 619 748 0003 " " 703 331 0057 MCI (5 DIGITS) 703
334 6831 WASH. POST 703 354 8723 COMPEL INC. 703 737 2051 METROPHONE (6
DIGITS) 703 835 0500 VALNET (5 DIGITS) 703 861 7000 SPRINT (6/8 DIGITS)
703 861 9181 SPRINT (6/8 DIGITS) 714 974 4020 CA. MAINFRAME 716 475 1072
N.Y. DEC-SYSTEM 800 222 0555 RESEARCH INSTITUTE 800 223 3312 CITIBANK 800
227 5576 EASTERN AIRLINES 800 248 0151 WHITE HOUSE PRESS 800 321 1424 FLIGHT
PLANES 800 323 3026 TEL-TEC (6 GIGITS) 800 323 4756 MOTOROLA DITELL 800
323 7751 MCI MAINFRAME 800 325 4112 EAsYLINK 800 325 6397 FYI 800 344 4000
MSG SYSTEM 800 368 6900 SKYLINE ORDER LINE 800 424 9090 RONALD REAGAN'S
PRESS 800 424 9096 WHITE HOUSE SWITCH 800 438 9428 ITT CITY CALL SWITCHING
800 521 2255 AUTONET 800 521 8400 TRAVELNET (8 DIGITS) 800 526 3714 RCA
MAINFRAME 800 527 1800 TYMNET 800 621 3026 SPECIAL OPERATOR 800 621 3028
" " 800 621 3030 " " 800 621 3035 " " 800 631 1146 VOICE STAT 800 821 2121
BELL TELEMARKETING 800 828 6321 XEROX $ 800 858 9313 RECORD-A-VOICE 800
882 1061 AT&T STOCK PRICES 914 997 1277 " " 916 445 2864 JERRY BROWN
N/A 950 1000 SPRINT N/A 950 1022 MCI EXECUNET N/A 950 1033 US TELEPHONE
N/A 950 1044 ALLNET (6 DIGITS) N/A 950 1066 LEXITEL N/A 950 1088 SKYLINE
(6 DIGITS) ----------------------------------- PHONE # | DESCRIPTION/CODE
----------------------------------- 201-643-2227 | CODES:235199, 235022
AND 121270 | 800-325-4112 | WESTERN UNION | 800-547-1784 | CODES:101111,
350009 AND 350008 | 800-424-9098 | TOLL FREE WHITE HS. | 800-424-9099 |
DEFENSE HOT LINE | 202-965-2900 | WATERGATE | 800-368-5693 | HOWARD BAKER
HOTLINE | 202-456-7639 | REAGANS SECRETARY | 202-545-6706 | PENTAGON |
202-694-0004 | PENTAGON MODEM | 201-932-3371 | REUTERS | 800-325-2091 |
PASSWORD: GAMES | 800-228-1111 | AMERICAN EXPRESS | 617-258-8313 | AFTER
CONNECT PRESS CTRL-C | 800-323-7751 | PASSWORD:REGISTER | 800-322-1415
| CODES:266891, 411266 AND 836566 (USED BY SYSOP) The following 800 #'s
have been collected however no codes have been found yet! if you hack any
please let me know... ----------------------------------- phone # | codes:
----------------------------------- 800-321-3344 | ??????????? 800-323-3027
| ??????????? 800-323-3208 | ??????????? 800-323-3209 | ??????????? 800-325-7222
| ??????????? 800-327-9895 | ??????????? 800-327-9136 | ??????????? 800-343-1844
| ??????????? 800-547-1784 | ??????????? 800-547-6754 | ??????????? 800-654-8494
| ??????????? 800-682-4000 | ??????????? 800-858-9000 | ??????????? 800
numbers with carriers. 800-323-9007 800-323-9066 800-323-9073 800-321-4600
800-547-1784 1-800 numbers of the government. 800-321-1082:NAVY FINANCE
CENTER. 800-424-5201:EXPORT IMPORT BANK. 800-523-0677:ALCOHOL TOBACCO AND.
800-532-1556:FED INFORMATION CNTR1-1082:NAVY FINANCE CENTER. 800-424-5201:EXPORT
IMPORT BANK. 800-523-0677:ALCOHOL TOBACCO AND. 800-532-1556:FED INFORMATION
CNTR. 800-325-4072:COMBAT & ARMS SERVICE. 800-325-4095:COMBAT SUPPORT
BRANCH. 800-325-4890:ROPD USAR COMBAT ARMS. 800-432-3960:SOCIAL SECURITY.
800-426-5996:PUGET NAVAL SHIPYARD. Directory of toll free numbers. 800-432-3960:SOCIAL
SECURITY. 800-426-5996:PUGET NAVAL SHIPYARD. Directory of toll free numbers.
301-234-0100:BALTIMORE ELECTRIC. 202-456-1414:WHITE HOUSE. 202-545-6706:PENTAGON.
202-343-1100:EPA. 714-891-1267:DIAL-A-GEEK. 714-897-5511:TIMELY. 213-571-6523:SATANIC
MESSAGES. 213-664-7664:DIAL-A-SONG. 405-843-7396:SYNTHACER MUSIC. 213-765-1000:LIST
OF MANY NUMBERS. 512-472-4263:WIERD. 512-472-9941:INSERT 25. 203-771-3930:PIONEERS.
213-254-4914:DIAL-A-ATHIEST. 212-586-0897:DIRTY. 213-840-3971:HOROWIERD
203-771-3930:PIONEERS 471-9420,345-9721,836-8962 836-3298,323-4139,836-5698
471-9440,471-9440,471-6952 476-6040,327-9772,471-9480 800-325-1693,800-325-4113
800-521-8400:VOICE ACTIVATED 213-992-8282:METROFONE ACCESS NUMBER 617-738-5051:PIRATE
HARBOR 617-720-3600:TIMECOR #2 301-344-9156:N.A.S.A PASSWORD:GASET 318-233-6289:UNIVERSITY
LOUISIANA 213-822-2112:213-822-3356 213-822-1924:213-822 3127 213-449-4040:TECH
CENTER 213-937-3580:TELENET 1-800-842-8781 1-800-368-5676 1-800-345-3878
212-331-1433 213-892-7211 213-626-2400 713-237-1822 713-224-6098 713-225-1053
713-224-9417 818-992-8282 1-800-521-8400 After entering the sprint code,
and, C+Destination number. Then enter this number: 205#977#22", And the
main tracer for sprint will be disabled. 215-561-3199/SPRINT LONG DISTANCE
202-456-1414/WHITE HOUSE 011-441-930-4832/QUEEN ELIZABETH 916-445-2864/JERRY
BROWN 800-424-9090/RONALD REAGAN'S PRESS 212-799-5017/ABC NEW YORK FEED
LINE 800-882-1061/AT & T STOCK PRICES 212-986-1660/STOCK QUOTES 213-935-1111/WIERD
EFFECTS! 512-472-4263/WIERD RECORDING 212-976-2727/P.D.A. 619-748-0002/FONE
CO. TESTING LINES 900-410-6272/SPACE SHUTTLE COMM. 201-221-6397/AMERICAN
TELEPHONE 215-466-6680/BELL OF PENNSYLVANIA 202-347-0999/CHESAPEAKE TELEPHONE
213-829-0111/GENERAL TELEPHONE 808-533-4426/HAWAIIAN TELEPHONE 312-368-8000/ILLINOIS
BELL TELEPHONE 317-265-8611/INDIANA BELL 313-223-7233/MICHIGAN BELL 313-223-7223/NEVADA
BELL 207-955-1111/NEW ENGLAND TELEPHONE 201-483-3800/NEW JERSEY BELL 212-395-2200/NEW
YORK TELEPHONE 515-243-0890/NORTHWESTERN BELL 216-822-6980/OHIO BELL 206-345-2900/PACIFIC
NORTHWEST BELL 213-621-4141/PACIFIC TELEPHONE 205-321-2222/SOUTH CENTRAL
BELL 404-391-2490/SOUTHERN BELL 203-771-4920/SOUTHERN NEW ENGLAND 314-247-5511/SOUTHWESTERN
BELL 414-678-3511/WISCONSIN TELEPHONE 800-327-6713/UNKNOWN ORIGIN 303-232-8555/HP3000
315-423-1313/DEC-10 313-577-0260/WAYNE STATE 512-474-5011/AUSTIN COMPUTERS
516-567-8013/LYRICS TIMESHARING 212-369-5114/RSTS/E 415-327-5220/NEC 713-795-1200/SHELL
COMPUTERS 518-471-8111/CNA OF NY 800-327-6761/AUTONET 800-228-1111/VISA
CREDIT CHECK 713-483-2700/NASUA 213-383-1115/COSMOS 408-280-1901/TRW 404-885-3460/SEARS
CREDIT CHECK 414-289-9988/AARDVARK SOFTWARE 919-852-1482/ANDROMEDA INCORPORATED
213-985-2922/ARTSCI 714-627-9887/ASTAR INTERNATIONAL 415-964-8021/AUTOMATED
SIMULATIONS 503-345-3043/AVANT GARDE CREATIONS 415-456-6424/BRODERBUND
SOFTWARE 415-658-8141/BUDGE COMPANY 714-755-5392/CAVALIER COMPUTER 801-753-6990/COMPUTER
DATA SYSTEMS 213-701-5161/DATASOFT INC. 213-366-7160/DATAMOST 716-442-8960/DYNACOMP
213-346-6783/EDU-WARE 800-631-0856/HAYDEN 919-983-1990/MED SYSTEMS SOFTWARE
312-433-7550/MICRO LAB 206-454-1315/MICROSOFT 301-659-7212/MUSE SOFTWARE
209-683-6858/ON-LINE SYSTEMS 203-661-8799/PROGRAM DESIGN (PDI) 213-344-6599/QUALITY
SOFTWARE 303-925-9293/SENTIENT SOFTWARE 702-647-2673/SIERRA SOFTWARE 916-920-1939/SIRIUS
SOFTWARE 215-393-2640/SIR-TECH 415-962-8911/SOFTWARE PUBLISHERS 415-964-1353/STRATEGIC
SIMULATIONS 217-359-8482/SUBLOGIC COM. 206-226-3216/SYNERGISTIC SOFTWARE
Here are a few tips on how not to get caught when using MCI or other such
services: Try not to use them for voice to voice personal calls. Try to
use them for computer calls only. Here is why: MCI and those other services
can't really trace the calls that come through the lines, they can just
monitor them. They can listen in on your calls and from that, they can
get your name and other information from the conversation. They can also
call the number you called and ask your friend some questions. If you call
terminals and BBS'S then it is much harder to get information. For one
thing, most sysops won't give these dudes that call any info at all or
they will act dumb because they PHREAK themselves! Beware when using colored
boxes! They are easy to find!!!!! Try to find a sine-wave number. Then
use an MCI or other service to call it. You will hear a tone that goes
higher and lower. If the tone just stops, then that code is being monitored
and you should beware when using it. If you do get caught, then if you
think you can, try to weasel out of it. I have heard many stories about
people that have pleaded with the MCI guys and have been let off. You will
get a call from a guy that has been monitoring you. Act nice. Act like
you know it is now wrong to do this kind of thing.....just sound like you
are sorry for what you did. (If you get a call, you probably will be a
little sorry!) Otherwise, it is very dangerous!!!!!!! (Very with a capital
V!)
100.Red Box Plans
by The Jolly Roger
Red boxing is simulating the tones
produced by public payphones when you drop your money in. The tones are
beeps of 2200Hz + 1700Hz a nickle is 1 beep for 66 milliseconds. A dime
is 2 beeps, each 66 milliseconds with a 66 millisecond pause between beeps.
A quarter is 5 beeps, each 33 milliseconds with a 33 millisecond pause
between beeps. There are two commonly used methods being used by Phreaks
to make free calls. An electronic hand-held device that is made from a
pair of Wien-bridge oscillators with the timing controlled by 555 timing
chips. A tape recording of the tones produced by a home computer. One of
the best computers to use would be an Atari ST. It is one of the easier
computers to use because the red box tones can be produced in basic with
only about 5 statements.
101.RemObS by
The Jolly Roger
Some of you may have heard of devices
called Remobs which stands for Remote Observation System. These Devices
allow supposedly authorized telephone employees to dial into them from
anywhere, and then using an ordinary touch tone fone, tap into a customer's
line in a special receive only mode. [The mouthpiece circuit is deactivated,
allowing totally silent observation from any fone in the world (Wire tapping
without a court order is against the law)] How Remobs Work Dial the number
of a Remob unit. Bell is rumored to put them in the 555 information exchanges,
oron special access trunks [Unreachable except via blue box]. A tone will
then be heard for approximately 2 seconds and then silence. You must key
in (In DTMF) a 2 to 5 digit access code while holding each digit down at
least 1 second. If the code is not entered within 5 or 6 seconds, the Remob
will release and must be dialed again. If the code is supposedly another
tone will be heard. A seven digit subscriber fone number can then be entered
[The Remob can only handle certain 'exchanges' which are prewired, so usually
one machine cannot monitor an entire NPA]. The Remob will then connect
to the subscribers line. The listener will hear the low level idle tone
as long as the monitored party is on hook. As the monitored party dials
[rotary or DTMF], the listener would hear [And Record] the number being
dialed. Then the ENTIRE conversation, datalink, whatever is taking place,
all without detection. There is no current box which can detect Remob observation,
since it is being done with the telephone equipment that makes the connection.
When the listener is finished monitoring of that particular customer, he
keys the last digit of the access code to disconnects him from the monitored
line and return to the tone so that he can key in another 7 digit fone
number. When the listener is totally finished with the Remob, he keys a
single 'disconnect digit' which disconnects him from the Remob so that
the device can reset and be ready for another caller. History of Remobs
Bell has kept the existence of Remobs very low key. Only in 1974, Bell
acknowledged that Remobs existed. The device was first made public during
hearings on "Telephone Monitoring Practices by Federal Agencies" before
a subcommittee on government operations. House of Representatives, Ninety-Third
Congress, June 1974. It has since been stated by Bell that the Remob devices
are used exclusively for monitoring Bell employees such as operators, information
operators, etc., to keep tabs on their performance. [Suuureee, were stupid]
Possible Uses for Remobs The possible uses of Remobs are almost as endless
as the uses of self created fone line. Imagine the ability to monitor bank
lines etc, just off the top of my head I can think of these applications:
Data Monitoring of: TRW National Credit Bureau. AT&T Cosmos. Bank Institutions.
CompuServe and other Networks. Voice Monitoring of: Bank Institutions.
Mail Order businesses. Bell Telephone themselves. Any place handling sensitive
or important information. Anyone that you may not like. With just one Remob,
someone could get hundreds of credit cards, find out who was on vacation,
get CompuServe passwords by the dozens, disconnect peoples fones, do credit
checks, find out about anything that they may want to find out about. I'm
sure you brilliant can see the value of a telephone hobbyist and a telecommunications
enthusiast getting his hands on a few choice Remobs.
102.Scarlet Box
Plans by The Jolly Roger
The purpose of a Scarlet box is to
create a very bad connection, it can be used to crash a BBS or just make
life miserable for those you seek to avenge. Materials: 2 alligator clips
3 inch wire, or a resister (plain wire will create greatest amount of static)
(Resister will decrease the amount of static in proportion to the resister
you are using) Find the phone box at your victims house, and pop the cover
off. Find the two prongs that the phone line you wish to box are connected
to. Hook your alligator clips to your (wire/resister). Find the lower middle
prong and take off all wires connected to it, I think this disables the
ground and call waiting and shit like that. Now take one of the alligator
clips and attach it to the upper most prong, and take the other and attach
it to the lower middle prong. Now put the cover back on the box and take
off!! ** ######## ** ** # #### # ** ######## / # #### # / ######## / /
/ / / / / / **/ ** ** ** ** ** (**)= prongs ** (/) = (wire/resister) (##)=
some phone bullshit
103.Silver Box
Plans by The Jolly Roger
Introduction: First a bit of Phone
Trivia. A standard telephone keypad has 12 buttons. These buttons, when
pushed, produce a combination of two tones. These tones represent the row
and column of the button you are pushing. 1 1 1 2 3 4 0 3 7 9 6 7 697 (1)
(2) (3) 770 (4) (5) (6) 851 (7) (8) (9) 941 (*) (0) (#) So (1) produces
a tone of 697+1209, (2) produces a tone of 697+1336, etc. Function: What
the Silver Box does is just creates another column of buttons, with the
new tone of 1633. These buttons are called A, B, C, and D. Usefulness:
Anyone who knows anything about phreaking should know that in the old days
of phreaking, phreaks used hardware to have fun instead of other people's
Sprint and MCI codes. The most famous (and useful) was the good ol' Blue
Box. However, Ma Bell decided to fight back and now most phone systems
have protections against tone-emitting boxes. This makes boxing just about
futile in most areas of the United States (i.e. those areas with Crossbar
or Step-By-Step). If you live in or near a good-sized city, then your phone
system is probably up-to-date (ESS) and this box (and most others) will
be useless. However, if you live in the middle of nowhere (no offense intended),
you may find a use for this and other boxes. Materials: 1 Foot of Blue
Wire 1 Foot of Gray Wire 1 Foot of Brown Wire 1 Small SPDT Switch (*) 1
Standard Ma Bell Phone (*)SPDT = Single Pole/Double Throw Tools: 1 Soldering
Iron 1 Flat-Tip Screwdriver Procedure: Loosen the two screws on the bottom
of the phone and take the casing off. Loosen the screws on the side of
the keypad and remove the keypad from the mounting bracket. Remove the
plastic cover from the keypad. Turn the keypad so that *0# is facing you.
Turn the keypad over. You'll see a bunch of wires, contacts, two Black
Coils, etc. Look at the Coil on the left. It will have five (5) Solder
Contacts facing you. Solder the Gray Wire to the fourth Contact Pole from
the left. Solder the other end of the Gray Wire to the Left Pole of the
SPDT Switch. Find the Three (3) Gold-Plated Contacts on the bottom edge
of the keypad. On the Left Contact, gently separate the two touching Connectors
(they're soldered together) and spread them apart. Solder the Brown Wire
to the Contact farthest from you, and solder the other end to the Right
Pole of the SPDT Switch. Solder the Blue Wire to the Closest Contact, and
the other end to the Center Pole of the SPDT Switch. Put the phone back
together. Using The Silver Box: What you have just done was installed a
switch that will change the 369# column into an ABCD column. For example,
to dial a 'B', switch to Silver Box Tones and hit '6'. No one is sure of
the A, B, and C uses. However, in an area with an old phone system, the
'D' button has an interesting effect. Dial Directory Assistance and hold
down 'D'. The phone will ring, and you should get a pulsing tone. If you
get a pissed-off operator, you have a newer phone system with defenses
against Silver Boxes. At the pulsing tone, dial a 6 or 7. These are loop
ends.
104.Bell Trashing
by The Jolly Roger
The Phone Co. will go to extremes on
occasions. In fact, unless you really know what to expect from them, they
will surprise the heck out of you with their "unpublished tariffs". Recently,
a situation was brought to my attention that up till then I had been totally
unaware of, least to mention, had any concern about. It involved garbage!
The phone co. will go as far as to prosecute anyone who rummages through
their garbage and helps himself to some Of course, they have their reasons
for this, and no doubt benefit from such action. But, why should they be
so picky about garbage? The answer soon became clear to me: those huge
metal bins are filled up with more than waste old food and refuse... Although
it is Pacific Tele. policy to recycle paper waste products, sometimes employees
do overlook this sacred operation when sorting the garbage. Thus top-secret
confidential Phone Co. records go to the garbage bins instead of the paper
shredders. Since it is constantly being updated with "company memorandums,
and supplied with extensive reference material, the Phone co. must continually
dispose of the outdated materials. Some phone companies are supplied each
year with the complete "System Practices" guide. This publication is an
over 40 foot long library of reference material about everything to do
with telephones. As the new edition arrives each year, the old version
of "System Practices" must also be thrown out. I very quickly figured out
where some local phone phreaks were getting their material. They crawl
into the garbage bins and remove selected items that are of particular
interest to them and their fellow phreaks. One phone phreak in the Los
Angeles area has salvaged the complete 1972 edition of "Bell System Practices".
It is so large and was out of order (the binders had been removed) that
it took him over a year to sort it out and create enough shelving for it
in his garage. Much of this "Top Secret" information is so secret that
most phone companies have no idea what is in their files. They have their
hands full simply replacing everything each time a change in wording requires
a new revision. It seems they waste more paper than they can read! It took
quite a while for Hollywood Cal traffic manager to figure out how all of
the local phone phreaks constantly discovered the switchroom test numbers.
Whenever someone wanted to use the testboard, they found the local phone
phreaks on the lines talking to all points all over the world. It got to
the point where the local garbage buffs knew more about the office operations
than the employees themselves. One phreak went so far as to call in and
tell a switchman what his next daily assignment would be. This, however,
proved to be too much. The switchman traced the call and one phone phreak
was denied the tool of his trade. In another rather humorous incident,
a fellow phreak was rummaging through the trash bin when he heard someone
approaching. He pressed up against the side of the bin and silently waited
for the goodies to come. You can imagine his surprise when the garbage
from the lunchroom landed on his head. Most people find evenings best for
checking out their local Telco trash piles. The only thing necessary is
a flashlight and, in the case mentioned above, possibly a rain coat. A
word of warning though, before you rush out and dive into the trash heap.
It is probably illegal, but no matter where you live, you certainly won't
get the local policeman to hold your flashlight for you.
105.Canadian WATS
Phonebook by The Jolly Roger
800-227-4004 ROLM Collagen Corp. 800-227-8933
ROLM Collagen Corp. 800-268-4500 Voice Mail 800-268-4501 ROLM Texaco 800-268-4505
Voice Mail 800-268-6364 National Data Credit 800-268-7800 Voice Mail 800-268-7808
Voice Mail 800-328-9632 Voice Mail 800-387-2097 Voice Mail 800-387-2098
Voice Mail 800-387-8803 ROLM Canadian Tire 800-387-8861 ROLM Canadian Tire
800-387-8862 ROLM Canadian Tire 800-387-8863 ROLM Canadian Tire 800-387-8864
ROLM Canadian Tire 800-387-8870 ROLM Halifax Life 800-387-8871 ROLM Halifax
Life 800-387-9115 ASPEN Sunsweep 800-387-9116 ASPEN Sunsweep 800-387-9175
PBX [Hold Music = CHUM FM] 800-387-9218 Voice Messenger 800-387-9644 Carrier
800-426-2638 Carrier 800-524-2133 Aspen 800-663-5000 PBX/Voice Mail [Hold
Music = CFMI FM] 800-663-5996 Voice Mail (5 rings) 800-847-6181 Voice Mail
NOTES: Each and every one of these numbers is available to the 604 (British
Columbia) Area Code. Most are available Canada Wide and some are located
in the United States. Numbers designated ROLM have been identified as being
connected to a ROLM Phonemail system. Numbers designated ASPEN are connected
to an ASPEN voice message system. Numbers designated VOICE MAIL have not
been identified as to equipment in use on that line. Numbers designated
carrier are answered by a modem or data set. Most Voice Message systems,
and ALL Rolms, sound like an answering machine. Press 0 during the recording
when in a rolm, * or # or other DTMF in other systems, and be propelled
into another world...
106.Hacking TRW
by The Jolly Roger
When you call TRW, the dial up will
identify itself with the message "TRW". It will then wait for you to type
the appropriate answer back (such as CTRL-G) Once This has been done, the
system will say "CIRCUIT BUILDING IN PROGRESS" Along with a few numbers.
After this, it clears the screen (CTRL L) followed by a CTRL-Q. After the
system sends the CTRL-Q, It is ready for the request. You first type the
4 character identifier for the geographical area of the account.. (For
Example) TCA1 - for certain Calif. & Vicinity subscribers. TCA2 - A
second CALF. TRW System. TNJ1 - Their NJ Database. TGA1 - Their Georgia
Database. The user then types A
107.Hacking Vax's
& Unix by The Jolly Roger
Unix is a trademark of AT&T (and
you know what that means) In this article, we discuss the unix system that
runs on the various vax systems. If you are on another unix-type system,
some commands may differ, but since it is licensed to bell, they can't
make many changes. Hacking onto a unix system is very difficult, and in
this case, we advise having an inside source, if possible. The reason it
is difficult to hack a vax is this: Many vax, after you get a carrier from
them, respond=> Login: They give you no chance to see what the login name
format is. Most commonly used are single words, under 8 digits, usually
the person's name. There is a way around this: Most vax have an acct. called
'suggest' for people to use to make a suggestion to the system root terminal.
This is usually watched by the system operator, but at late he is probably
at home sleeping or screwing someone's brains out. So we can write a program
to send at the vax this type of a message: A screen freeze (Cntl-S), screen
clear (system dependant), about 255 garbage characters, and then a command
to create a login acct., after which you clear the screen again, then unfreeze
the terminal. What this does: When the terminal is frozen, it keeps a buffer
of what is sent. Well, the buffer is about 127 characters long. so you
overflow it with trash, and then you send a command line to create an acct.
(System dependant). After this you clear the buffer and screen again, then
unfreeze the terminal. This is a bad way to do it, and it is much nicer
if you just send a command to the terminal to shut the system down, or
whatever you are after... There is always, *Always* an acct. called root,
the most powerful acct. to be on, since it has all of the system files
on it. If you hack your way onto this one, then everything is easy from
here on... On the unix system, the abort key is the Cntl-D key. Watch how
many times you hit this, since it is also a way to log off the system!
A little about unix architecture: The root directory, called root, is where
the system resides. After this come a few 'sub' root directories, usually
to group things (stats here, priv stuff here, the user log here...). Under
this comes the superuser (the operator of the system), and then finally
the normal users. In the unix 'Shell' everything is treated the same. By
this we mean: You can access a program the same way you access a user directory,
and so on. The way the unix system was written, everything, users included,
are just programs belonging to the root directory. Those of you who hacked
onto the root, smile, since you can screw everything...the main level (exec
level) prompt on the unix system is the $, and if you are on the root,
you have a # (superuser prompt). Ok, a few basics for the system... To
see where you are, and what paths are active in regards to your user account,
then type => pwd This shows your acct. separated by a slash with another
pathname (acct.), possibly many times. To connect through to another path,
or many paths, you would type: You=> path1/path2/path3 And then you are
connected all the way from path1 to path3. You can run the programs on
all the paths you are connected to. If it does not allow you to connect
to a path, then you have insufficient privs, or the path is closed and
archived onto tape. You can run programs this way also: you=> path1/path2/path3/program-name
Unix treats everything as a program, and thus there a few commands to learn...
To see what you have access to in the end path, type: ls for list. This
show the programs you can run. You can connect to the root directory and
run it's programs with=> /root By the way, most unix systems have their
log file on the root, so you can set up a watch on the file, waiting for
people to log in and snatch their password as it passes thru the file.
To connect to a directory, use the command: => cd pathname This allows
you to do what you want with that directory. You may be asked for a password,
but this is a good way of finding other user names to hack onto. The wildcard
character in unix, if you want to search down a path for a game or such,
is the *. => ls /* Should show you what you can access. The file types
are the same as they are on a dec, so refer to that section when examining
file. To see what is in a file, use the => pr filename command, for print
file. We advise playing with pathnames to get the hang of the concept.
There is on-line help available on most systems with a 'help' or a '?'.
We advise you look thru the help files and pay attention to anything they
give you on pathnames, or the commands for the system. You can, as a user,
create or destroy directories on the tree beneath you. This means that
root can kill everything but root, and you can kill any that are below
you. These are the => mkdir pathname => rmdir pathname commands. Once again,
you are not alone on the system... type=> who to see what other users are
logged in to the system at the time. If you want to talk to them=> write
username Will allow you to chat at the same time, without having to worry
about the parser. To send mail to a user, say => mail And enter the mail
sub-system. To send a message to all the users on the system, say => wall
Which stands for 'write all'. By the way, on a few systems, all you have
to do is hit the
108.Verification
Circuits by The Jolly Roger
One busy verification conference circuit
is always provided. The circuit is a three-way conference bridge that enables
an operator to verify the busy/idle condition of a subscriber line. Upon
request of a party attempting to reach a specified directory number, the
operator dials the called line number to determine if the line is in use,
if the receiver is off the hook, or if the line is in lockout due to a
fault condition. The operator then returns to the party trying to reach
the directory number and states the condition of the line. Lines with data
security can not be accessed for busy verification when the line is in
use.(Refer also to data security.) Three ports are assigned to each busy
verification conference circuit. One port is for operator access and two
ports are used to split an existing connection. To verify the busy/idle
condition of a line, the operator established a connection to the operator
access port and dials the directory number of the line to be verified.
If the line is in use, the existing connection is broken and immediately
re-established through the other two ports of the busy verification circuit
without interruption. Busy verification circuit is controlled by access
code. A dedicated trunk can be used but is not necessary. The busy verification
circuit also can be used for test verify from the wire chiefs test panel
B. Additional busy verification conference circuits (002749) there it is
right out of an ESS manual word for word! And I'm getting 25 linear feet
of ESS manuals!!! Not counting the stack received so far!
109.White Box
Plans by The Jolly Roger
Introduction: The White Box is simply
a portable touch-tone keypad. For more information on touch-tone, see my
Silver Box Plans. Materials: 1 Touch-Tone Keypad 1 Miniature 1000 to 8
Ohm Transformer (Radio Shack # 273-1380) 1 Standard 8 Ohm Speaker 2 9V
Batteries 2 9V Battery Clips Procedure: Connect the Red Wire from the Transformer
to either terminal on the speaker. Connect the White Wire from the transformer
to the other terminal on the speaker. Connect the Red Wire from one Battery
Clip to the Black Wire from the other Battery Clip. Connect the Red Wire
from the second Battery Clip to the Green Wire from the Keypad. Connect
the Blue Wire from the Keypad to the Orange/Black Wire from the Keypad.
Connect the Black Wire from the first Battery Clip to the two above wires
(Blue and Black/Orange). Connect the Black Wire from the Keypad to the
Blue Wire from the Transformer. Connect the Red/Green Wire from the Keypad
to the Green Wire from the Transformer. Make sure the Black Wire from the
Transformer and the remaining wires from the Keypad are free. Hook up the
Batteries. Optional: Put it all in a case. Add a Silver Box to it. Use:
Just use it like a normal keypad, except put the speaker next to the receiver
of the phone you're using.
110.The BLAST
Box by The Jolly Roger
Ever want to really make yourself be
heard? Ever talk to someone on the phone who just doesn't shut up? Or just
call the operator and pop her eardrum? Well, up until recently it has been
impossible for you to do these things. That is, unless of course you've
got a blast box. All a blast box is, is a really cheap amplifier, (around
5 watts or so) connected in place of the microphone on your telephone.
It works best on model 500 AT&T Phones, and if constructed small enough,
can be placed inside the phone. Construction: Construction is not really
important. Well it is, but since I'm letting you make your own amp, I really
don't have to include this. Usage: Once you've built your blast box, simply
connect a microphone (or use the microphone from the phone) to the input
of the amplifier, and presto. There it is. Now, believe it or not, this
device actually works. (At least on crossbar.) It seems that Illinois bell
switching systems allow quite a lot of current to pass right through the
switching office, and out to whoever you're calling. When you talk in the
phone, it comes out of the other phone (again it works best if the phone
that you're calling has the standard western electric earpiece) incredibly
loud. This device is especially good for PBS Subscription drives. Have
"Phun", and don't get caught!
111.Dealing with
the Rate & Route Operator by The Jolly Roger
It seems that fewer and fewer people
have blue boxes these days, and that is really too bad. Blue boxes, while
not all that great for making free calls (since the TPC can tell when the
call was made, as well as where it was too and from), are really a lot
of fun to play with. Short of becoming a real live TSPS operator, they
are about the only way you can really play with the network. For the few
of you with blue boxes, here are some phrases which may make life easier
when dealing with the rate & route (R&R) operators. To get the
R&R op, you send a KP + 141 + ST. In some areas you may need to put
another NPA before the 141 (i.e., KP + 213 + 141 + ST), if you have no
local R&R ops. The R&R operator has a myriad of information, and
all it takes to get this data is mumbling cryptic phrases. There are basically
four special phrases to give the R&R ops. They are NUMBERS route, DIRECTORY
route, OPERATOR route, and PLACE NAME. To get an R&R an area code for
a city, one can call the R&R operator and ask for the numbers route.
For example, to find the area code for Carson City, Nevada, we'd ask the
R&R op for "Carson City, Nevada, numbers route, please." and get the
answer, "Right... 702 plus." meaning that 702 plus 7 digits gets us there.
Sometimes directory assistance isn't just NPA+131. The way to get these
routings is to call R&R and ask for "Anaheim, California, directory
route, please." Of course, she'd tell us it was 714 plus, which means 714
+ 131 gets us the D.A. op there. This is sort of pointless example, but
I couldn't come up with a better one on short notice. Let's say you wanted
to find out how to get to the inward operator for Sacremento, California.
The first six digits of a number in that city will be required (the NPA
and an NXX). For example, let us use 916 756. We would call R&R, and
when the operator answered, say, "916 756, operator route, please." The
operator would say, "916 plus 001 plus." This means that 916 + 001 + 121
will get you the inward operator for Sacramento. Do you know the city which
corresponds to 503 640? The R&R operator does, and will tell you that
it is Hillsboro, Oregon, if you sweetly ask for "Place name, 503 640, please."
For example, let's say you need the directory route for Sveg, Sweden. Simply
call R&R, and ask for, "International, Baden, Switzerland. TSPS directory
route, please." In response to this, you'd get, "Right... Directory to
Sveg, Sweden. Country code 46 plus 1170." So you'd route yourself to an
international sender, and send 46 + 1170 to get the D.A. operator in Sweden.
Inward operator routings to various countries are obtained the same way
"International, London, England, TSPS inward route, please." and get "Country
code 44 plus 121." Therefore, 44 plus 121 gets you inward for London. Inwards
can get you language assistance if you don't speak the language. Tell the
foreign inward, "United States calling. Language assistance in completing
a call to (called party) at (called number)." R&R operators are people
are people too, y'know. So always be polite, make sure use of 'em, and
dial with care.
112.Cellular Phreaking
by The Jolly Roger
The cellular/mobile phone system is
one that is perfectly set up to be exploited by phreaks with the proper
knowledge and equipment. Thanks to deregulation, the regional BOC's (Bell
Operating Companies) are scattered and do not communicate much with each
other. Phreaks can take advantage of this by pretending to be mobile phone
customers whose "home base" is a city served by a different BOC, known
as a "roamer". Since it is impractical for each BOC to keep track of the
customers of all the other BOC's, they will usually allow the customer
to make the calls he wishes, often with a surcharge of some sort. The bill
is then forwarded to the roamer's home BOC for collection. However, it
is fairly simple (with the correct tools) to create a bogus ID number for
your mobile phone, and pretend to be a roamer from some other city and
state, that's "just visiting". When your BOC tries to collect for the calls
from your alleged "home BOC", they will discover you are not a real customer;
but by then, you can create an entirely new electronic identity, and use
that instead. How does the cellular system know who is calling, and where
they are? When a mobile phone enters a cell's area of transmission, it
transmits its phone number and its 8 digit ID number to that cell, who
will keep track of it until it gets far enough away that the sound quality
is sufficiently diminished, and then the phone is "handed off" to the cell
that the customer has walked or driven into. This process continues as
long as the phone has power and is turned on. If the phone is turned off
(or the car is), someone attempting to call the mobile phone will receive
a recording along the lines of "The mobile phone customer you have dialed
has left the vehicle or driven out of the service area." When a call is
made to a mobile phone, the switching equipment will check to see if the
mobile phone being called is "logged in", so to speak, or present in one
of the cells. If it is, the call will then act (to the speaking parties)
just like a normal call - the caller may hear a busy tone, the phone may
just ring, or the call may be answered. How does the switching equipment
know whether or not a particular phone is authorized to use the network?
Many times, it doesn't. When a dealer installs a mobile phone, he gives
the phone's ID number (an 8 digit hexadecimal number) to the local BOC,
as well as the phone number the BOC assigned to the customer. Thereafter,
whenever a phone is present in one of the cells, the two numbers are checked
- they should be registered to the same person. If they don't match, the
telco knows that an attempted fraud is taking place (or at best, some transmission
error) and will not allow calls to be placed or received at that phone.
However, it is impractical (especially given the present state of deregulation)
for the telco to have records of every cellular customer of every BOC.
Therefore, if you're going to create a fake ID/phone number combination,
it will need to be "based" in an area that has a cellular system (obviously),
has a different BOC than your local area does, and has some sort of a "roamer"
agreement with your local BOC. How can one "phreak" a cellular phone? There
are three general areas when phreaking cellular phones; using one you found
in an unlocked car (or an unattended walk-about model), modifying your
own chip set to look like a different phone, or recording the phone number/ID
number combinations sent by other local cellular phones, and using those
as your own. Most cellular phones include a crude "password" system to
keep unauthorized users from using the phone - however, dealers often set
the password (usually a 3 to 5 digit code) to the last four digits of the
customer's mobile phone number. If you can find that somewhere on the phone,
you're in luck. If not, it shouldn't be TOO hard to hack, since most people
aren't smart enough to use something besides "1111", "1234", or whatever.
If you want to modify the chip set in a cellular phone you bought (or stole),
there are two chips (of course, this depends on the model and manufacturer,
yours may be different) that will need to be changed - one installed at
the manufacturer (often epoxied in) with the phone's ID number, and one
installed by the dealer with the phone number, and possible the security
code. To do this, you'll obviously need an EPROM burner as well as the
same sort of chips used in the phone (or a friendly and unscrupulous dealer!).
As to recording the numbers of other mobile phone customers and using them;
as far as I know, this is just theory... but it seems quite possible, if
you've got the equipment to record and decode it. The cellular system would
probably freak out if two phones (with valid ID/phone number combinations)
were both present in the network at once, but it remains to be seen what
will happen.
113.Cheesebox
Plans by The Jolly Roger
A Cheesebox (named for the type of
box the first one was found in) is a type of box which will, in effect,
make your telephone a Pay-Phone.....This is a simple, modernized, and easy
way of doing it.... Inside Info: These were first used by bookies many
years ago as a way of making calls to people without being called by the
cops or having their numbers traced and/or tapped...... How To Make A Modern
Cheese Box Ingredients: 1 Call Forwarding service on the line 1 Set of
Red Box Tones The number to your prefix's Intercept operator (do some scanning
for this one) How To: After you find the number to the intercept operator
in your prefix, use your call-forwarding and forward all calls to her...this
will make your phone stay off the hook(actually, now it waits for a quarter
to be dropped in)...you now have a cheese box... In Order To Call Out On
This Line: You must use your Red Box tones and generate the quarter dropping
in...then, you can make phone calls to people...as far as I know, this
is fairly safe, and they do not check much...Although I am not sure, I
think you can even make credit-card calls from a cheesebox phone and not
get traced...
114.How to start
your own conferences! by The Jolly Roger
Black Bart showed how to start a conference
call thru an 800 exchange, and I will now explain how to start a conference
call in a more orthodox fashion, the 2600Hz. Tone. Firstly, the fone company
has what is called switching systems. There are several types, but the
one we will concern ourselves with, is ESS (electronic switching system).
If your area is zoned for ESS, do not start a conference call via the 2600Hz.
Tone, or bell security will nail your ass! To find out if you are under
ESS, call your local business office, and ask them if you can get call
waiting/forwarding, and if you can, that means that you are in ESS country,
and conference calling is very, very dangerous!!! Now, if you are not in
ESS, you will need the following equipment: An Apple CAT II modem A copy
of TSPS 2 or CAT'S Meow A touch tone fone line A touch tone fone. (True
tone) Now, with TSPS 2, do the following: Run tsps 2 Chose option 1 Chose
option 6 Chose sub-option 9 Now type: 1-514-555-1212 (dashes are not needed)
Listen with your handset, and as soon as you hear a loud click, then type:
$ To generate the 2600 hz. Tone. This obnoxious tone will continue for
a few Seconds, then listen again and you should hear another loud 'click'.
Now type: km2130801050s 'K' = kp tone 'M' = multi frequency mode 'S' =
s tone Now listen to the handset again, and wait until you hear the 'click'
again. Then type: km2139752975s 2139751975 is the number to bill the conference
call to. Note: 213-975-1975 is a disconnected number, and I strongly advise
that you only bill the call to this number, or the fone company will find
out, and then.. remember, conference calls are itemized, so if you do bill
it to an enemy's number, he can easily find out who did it and he can bust
you! You should now hear 3 beeps, and a short pre-recorded message. From
here on, everything is all menu driven. Conference call commands From the
'#' mode: 1 = call a number 6 = transfer control 7 = hangs up the conference
call 9 = will call a conference operator Stay away from 7 and 9! If for
some reason an operator gets on-line, hang up! If you get a busy signal
after km2130801050s, that means that the teleconference line is temporarily
down. Try later, preferably from 9am to 5pm week days, since conference
calls are primarily designed for business people.
115.Gold Box Plans
by The Jolly Roger
HOW TO BUILD IT You will need the following:
Two 10K OHM and three 1.4K OHM resistors Two 2N3904 transistors Two Photo
Cells Two Red LED'S (The more light produced the better) A box that will
not let light in Red and Green Wire Light from the #1 LED must shine directly
on the photocell #1. The gold box I made needed the top of the LED's to
touch the photo cell for it to work. The same applies to the #2 photo cell
and LED. 1 :-PHOTOCELL--: : : : :BASE : 1 TTTTT : +LED- TRANSISTOR : TTTTT
: : : : -I(-- : :COLLECTOR RED1--< >:--: :-------:-----GREEN2 -I(--
: ----------: : : 2 :-/+/+/-/+/+/-/+/+/-/+/+/ LED 10K 10K 1.4K 1.4K RESISTORES
2 -PHOTOCELL----------------- : : :BASE : TTTTT : TRANSISTOR : TTTTT :
: :EMITTER : GREEN1- --------------------------RED2 : : /+/+/ 1.4K The
1.4K resistor is variable and if the second part of the gold box is skipped
it will still work but when someone picks up the phone they will hear a
faint dial tone in the background and might report it to the Gestapo er...(AT&T).
1.4K will give you good reception with little risk of a Gestapo agent at
your door. Now that you have built it take two green wires of the same
length and strip the ends, twist two ends together and connect them to
green1 and place a piece of tape on it with "line #1" writing on it. Continue
the process with red1 only use red wire. Repeat with red2 and green2 but
change to line #2. HOW TO INSTALL You will need to find two phone lines
that are close together. Label one of the phone lines "Line #1". Cut the
phone lines and take the outer coating off it. There should be 4 wires.
Cut the yellow and black wires off and strip the red and green wires for
both lines. Line #1 should be in two pieces. Take the green wire of one
end and connect it to one of the green wires on the gold box. Take the
other half of line #1 and hook the free green wire to the green wire on
the phone line. Repeat the process with red1 and the other line. All you
need to do now is to write down the phone numbers of the place you hooked
it up at and go home and call it. You should get a dial tone!!! If not,
try changing the emitter with the collector.
116.The History
of ESS by The Jolly Roger
Of all the new 1960s wonders of telephone
technology - satellites, ultra modern Traffic Service Positions (TSPS)
for operators, the picturephone, and so on - the one that gave Bell Labs
the most trouble, and unexpectedly became the greatest development effort
in Bell System's history, was the perfection of an electronic switching
system, or ESS. It may be recalled that such a system was the specific
end in view when the project that had culminated in the invention of the
transistor had been launched back in the 1930s. After successful accomplishment
of that planned miracle in 1947-48, further delays were brought about by
financial stringency and the need for further development of the transistor
itself. In the early 1950s, a Labs team began serious work on electronic
switching. As early as 1955, Western Electric became involved when five
engineers from the Hawthorne works were assigned to collaborate with the
Labs on the project. The president of AT&T in 1956, wrote confidently,
"At Bell Labs, development of the new electronic switching system is going
full speed ahead. We are sure this will lead to many improvements in service
and also to greater efficiency. The first service trial will start in Morris,
Ill., in 1959." Shortly thereafter, Kappel said that the cost of the whole
project would probably be $45 million. But it gradually became apparent
that the development of a commercially usable electronic switching system
- in effect, a computerized telephone exchange - presented vastly greater
technical problems than had been anticipated, and that, accordingly, Bell
Labs had vastly underestimated both the time and the investment needed
to do the job. The year 1959 passed without the promised first trial at
Morris, Illinois; it was finally made in November 1960, and quickly showed
how much more work remained to be done. As time dragged on and costs mounted,
there was a concern at AT&T and something approaching panic at Bell
Labs. But the project had to go forward; by this time the investment was
too great to be sacrificed, and in any case, forward projections of increased
demand for telephone service indicated that within a few years a time would
come when, without the quantum leap in speed and flexibility that electronic
switching would provide, the national network would be unable to meet the
demand. In November 1963, an all-electronic switching system went into
use at the Brown Engineering Company at Cocoa Beach, Florida. But this
was a small installation, essentially another test installation, serving
only a single company. Kappel's tone on the subject in the 1964 annual
report was, for him, an almost apologetic: "Electronic switching equipment
must be manufactured in volume to unprecedented standards of reliability....
To turn out the equipment economically and with good speed, mass production
methods must be developed; but, at the same time, there can be no loss
of precision..." Another year and millions of dollars later, on May 30,
1965, the first commercial electric central office was put into service
at Succasunna, New Jersey. Even at Succasunna, only 200 of the town's 4,300
subscribers initially had the benefit of electronic switching's added speed
and additional services, such as provision for three party conversations
and automatic transfer of incoming calls. But after that, ESS was on its
way. In January 1966, the second commercial installation, this one serving
2,900 telephones, went into service in Chase, Maryland. By the end of 1967
there were additional ESS offices in California, Connecticut, Minnesota,
Georgia, NY, Florida, and Pennsylvania; by the end of 1970 there were 120
offices serving 1.8 million customers; and by 1974 there were 475 offices
serving 5.6 million customers. The difference between conventional switching
and electronic switching is the difference between "hardware" and "software";
in the former case, maintenance is done on the spot, with screwdriver and
pliers, while in the case of electronic switching, it can be done remotely,
by computer, from a central point, making it possible to have only one
or two technicians on duty at a time at each switching center. The development
program, when the final figures were added up, was found to have required
a staggering four thousand man-years of work at Bell Labs and to have cost
not $45 million but $500 million!
117.The Lunch
Box by The Jolly Roger
Introduction The Lunch Box is a VERY
simple transmitter which can be handy for all sorts of things. It is quite
small and can easily be put in a number of places. I have successfully
used it for tapping fones, getting inside info, blackmail and other such
things. The possibilities are endless. I will also include the plans or
an equally small receiver for your newly made toy. Use it for just about
anything. You can also make the transmitter and receiver together in one
box and use it as a walkie talkie. Materials you will need (1) 9 volt battery
with battery clip (1) 25-mfd, 15 volt electrolytic capacitor (2) .0047
mfd capacitors (1) .022 mfd capacitor (1) 51 pf capacitor (1) 365 pf variable
capacitor (1) Transistor antenna coil (1) 2N366 transistor (1) 2N464 transistor
(1) 100k resistor (1) 5.6k resistor (1) 10k resistor (1) 2meg potentiometer
with SPST switch Some good wire, solder, soldering iron, board to put it
on, box (optional) Schematic for The Lunch Box This may get a tad confusing
but just print it out and pay attention. [!] ! 51 pf ! ---+---- ------------base
collector ! )( 2N366 +----+------/\/\/----GND 365 pf () emitter ! ! )(
! ! +-------- ---+---- ! ! ! ! ! ! ! GND / .022mfd ! ! 10k\ ! ! ! / GND
+------------------------emitter ! ! ! 2N464 / .0047 ! base collector 2meg
\----+ ! ! +--------+ ! / ! GND ! ! ! GND ! ! ! +-------------+.0047+--------------------+
! ! ! +--25mfd-----+ -----------------------------------------+ ! ! microphone
+--/\/\/-----+ ---------------------------------------------+ 100k ! !
GND---->/<---------------------!+!+!+---------------+ switch Battery
from 2meg pot. Notes about the schematic GND means ground The GND near
the switch and the GND by the 2meg potentiometer should be connected. Where
you see: )( () )( it is the transistor antenna coil with 15 turns of regular
hook-up wire around it. The middle of the loop on the left side (the left
of "()") you should run a wire down to the "+" which has nothing attached
to it. There is a .0047 capacitor on the correct piece of wire. For the
microphone use a magnetic earphone (1k to 2k). Where you see "[!]" is the
antenna. Use about 8 feet of wire to broadcast approx. 300ft. Part 15 of
the FCC rules and regulation says you can't broadcast over 300 feet without
a license. (Hahaha). Use more wire for an antenna for longer distances.
(Attach it to the black wire on the fone line for about a 250 foot antenna!)
Operation of the Lunch Box This transmitter will send the signals over
the AM radio band. You use the variable capacitor to adjust what freq.
you want to use. Find a good unused freq. down at the lower end of the
scale and you're set. Use the 2 meg pot. to adjust gain. Just fuck with
it until you get what sounds good. The switch on the 2meg is for turning
the Lunch Box on and off. When everything is adjusted, turn on an AM radio
adjust it to where you think the signal is. Have a friend lay some shit
thru the Box and tune in to it. That's all there is to it. The plans for
a simple receiver are shown below: The Lunch Box receiver (1) 9 volt battery
with battery clip (1) 365 pf variable capacitor (1) 51 pf capacitor (1)
1N38B diode (1) Transistor antenna coil (1) 2N366 transistor (1) SPST toggle
switch (1) 1k to 2k magnetic earphone Schematic for receiver [!] ! 51 pf
! +----+----+ ! ! ) 365 pf (----+ ! ) ! ! +---------+---GND ! +---*>!----base
collector----- diode 2N366 earphone emitter +----- ! ! GND ! - + - battery
+ GND------>/<------------+ switch Closing statement This two devices
can be built for under a total of $10.00. Not too bad. Using these devices
in illegal ways is your option. If you get caught, I accept NO responsibility
for your actions. This can be a lot of fun if used correctly. Hook it up
to the red wire on the phone line and it will send the conversation over
the air waves.
118.Olive Box
Plans by The Jolly Roger
This is a relatively new box, and all
it basically does is serve as a phone ringer. You have two choices for
ringers, a piezoelectric transducer (ringer), or a standard 8 ohm speaker.
The speaker has a more pleasant tone to it, but either will do fine. This
circuit can also be used in conjunction with a rust box to control an external
something or other when the phone rings. Just connect the 8 ohm speaker
output to the inputs on the rust box, and control the pot to tune it to
light the light (which can be replaced by a relay for external controlling)
when the phone rings. ______________ | | ^ NC --|-- 5 4 --|-----/\/\/------->G
| | / R2 G<----)|----|-- 6 3 --|-- NC | C3 | U1 | -------|-- 7 2 --|----------
--- -- - > TO RINGER | | ----|-- 8 1 --|-- | |______________| | | ---/\/\/----|(-----
L1 | R1 C1 ------------------------------------------ L2 a. Main ringer
TTL circuit (>::::::::::::::::::::::::::::::::::::::::::::::::::::::::<)
_ FROM PIN 2 < - -- --- ----------| |_| |------------->G P1 b. Piezoelectric
transducer (>::::::::::::::::::::::::::::::::::::::::::::::::::::::::<)
__ /| FROM PIN 2 < - -- --- ---------|(---------. .-------| |/ | >||<
|S1| | >||< --| | | >||< | |__|\ | G<---------.>||<.--- \|
T1 c. Electromagnetic transducer Parts List U1 - Texas Instruments TCM1506
T1 - 4000:8 ohm audio transformer S1 - 8 ohm speaker R1 - 2.2k resistor
R2 - External variable resistor; adjusts timing frequency C1 - .47uF capacitor
C2 - .1uF capacitor C3 - 10uF capacitor L1 - Tip L2 - Ring L1 and L2 are
the phone line. Shift Rate: This is the formula for determining the shift
rate: 1 1 SR = --------------------- = ------------ = 6¬ Hz (DSR(1/f1)+DSR(1/f2))
128 128 ---- + ---- 1714 1500 DSR = Shift Devider Rate ratio = 128 f1 =
High Output Frequency = 1714 f2 = Low Output Frequency = 1500 119.The Tron
Box by The GREAT Captain Crunch!! ------------------R-----F---- I I I I
I I I I- (C) (C) (C) I I I I- I I I I ----------------------------- (C)=capacitor
F =fuse R =resistor I,- are wire Parts List: (3) electrolytic capacitors
rated at 50V(lowest) .47UF (1) 20-30 OHM « Watt resistor (1) 120Volt
fuse (amp rating best to use at least half of total house current or even
less it keeps you from blowing your breaker just in case...) (1) power
cord (cut up an extension cord. Need plug part and wire) (1) electrically
insulated box for the rest of us. If your don't feel comfortable about
electricity then don't play with this. There is voltage present that will
***kill you***. The thing works when the load in your house is low like
at night time. It will put a reverse phase signal on the line and cancel
out the other phase and put a reverse phase running everything in the house.
Well if you have ever switched the power leads on a D\C (battery powered)
motor you will see that it runs backwards well your electric meter sort
of works this way...so reverse phase makes the meter slow down and if your
lucky it will go backwards. Anyway it means a cheaper electric bill.
120.More TRW Info
by The Jolly Roger
TRW is a large database in which company's
and banks can run credit checks on their customers. Example: John Jones
orders $500 worth of stereo equipment from the Joe Blow Electronic distributing
Co. Well it could be that he gave the company a phony credit card number,
or doesn't have enough credit, etc. Well they call up TRW and then run
a check on him, TRW then lists his card numbers (everything from sears
to visa) and tells the numbers, credit, when he lost it last (if he ever
did) and then of course tells if he has had any prior problems paying his
bills. I would also like to add that although TRW contains information
on millions of people, not every part of the country is served, although
the major area are.. So if you hate someone and live in a small state,
you probably wont be able to order him 300 pink toilet seats from K-mart.
Logging on To log on, you dial-up your local access number (or long-distance,
what ever turns you on) and wait for it to say "TRW" at this prompt, you
type either an "A" or a "Ctrl-G" and it will say "circuit building in progress"
it will wait for a minute and then clear the screen, now you will type
one of the following. Tca1 Tca2 Tnj1 Tga1 This is to tell it what geographical
area the customer is in, it really doesn't matter which you use, because
TRW will automatically switch when it finds the record.. Next, you will
type in the pswd and info on the person you are trying to get credit info
on. You type it in a format like this: Rts Pswd Lname Fname ...,House number
First letter of street name Zip
121.Phreaker's
Phunhouse by the Jolly Roger
The long awaited prequil to Phreaker's
Guide has finally arrived. Conceived from the boredom and loneliness that
could only be derived from: The Traveler! But now, he has returned in full
strength (after a small vacation) and is here to 'World Premiere' the new
files everywhere. Stay cool. This is the prequil to the first one, so just
relax. This is not made to be an exclusive ultra elite file, so kinda calm
down and watch in the background if you are too cool for it. Phreak Dictionary
Here you will find some of the basic but necessary terms that should be
known by any phreak who wants to be respected at all. Phreak: The action
of using mischievous and mostly illegal ways in order to not pay for some
sort of telecommunications bill, order, transfer, or other service. It
often involves usage of highly illegal boxes and machines in order to defeat
the security that is set up to avoid this sort of happening. [fr'eaking].
v. A person who uses the above methods of destruction and chaos in order
to make a better life for all. A true phreaker will not go against his
fellows or narc on people who have ragged on him or do anything termed
to be dishonorable to phreaks. [fr'eek]. n. A certain code or dialup useful
in the action of being a phreak. (Example: "I hacked a new metro phreak
last night.") Switching System: There are 3 main switching systems currently
employed in the US, and a few other systems will be mentioned as background.
SxS: This system was invented in 1918 and was employed in over half of
the country until 1978. It is a very basic system that is a general waste
of energy and hard work on the linesman. A good way to identify this is
that it requires a coin in the phone booth before it will give you a dial
tone, or that no call waiting, call forwarding, or any other such service
is available. Stands for: Step by Step XB: This switching system was first
employed in 1978 in order to take care of most of the faults of SxS switching.
Not only is it more efficient, but it also can support different services
in various forms. XB1 is Crossbar Version 1. That is very limited and is
hard to distinguish from SxS except by direct view of the wiring involved.
Next up was XB4, Crossbar Version 4. With this system, some of the basic
things like DTMF that were not available with SxS can be accomplished.
For the final stroke of XB, XB5 was created. This is a service that can
allow DTMF plus most 800 type services (which were not always available.)
Stands for: Crossbar. ESS: A nightmare in telecom. In vivid color, ESS
is a pretty bad thing to have to stand up to. It is quite simple to identify.
Dialing 911 for emergencies, and ANI [see ANI below] are the most common
facets of the dread system. ESS has the capability to list in a person's
caller log what number was called, how long the call took, and even the
status of the conversation (modem or otherwise.) Since ESS has been employed,
which has been very recently, it has gone through many kinds of revisions.
The latest system to date is ESS 11a, that is employed in Washington D.C.
for security reasons. ESS is truly trouble for any phreak, because it is
'smarter' than the other systems. For instance, if on your caller log they
saw 50 calls to 1-800-421-9438, they would be able to do a CN/A [see Loopholes
below] on your number and determine whether you are subscribed to that
service or not. This makes most calls a hazard, because although 800 numbers
appear to be free, they are recorded on your caller log and then right
before you receive your bill it deletes the billings for them. But before
that the are open to inspection, which is one reason why extended use of
any code is dangerous under ESS. Some of the boxes [see Boxing below] are
unable to function in ESS. It is generally a menace to the true phreak.
Stands For: Electronic Switching System. Because they could appear on a
filter somewhere or maybe it is just nice to know them anyways. SSS: Strowger
Switching System. First non-operator system available. WES: Western Electronics
Switching. Used about 40 years ago with some minor places out west. Boxing:
The use of personally designed boxes that emit or cancel electronical impulses
that allow simpler acting while phreaking. Through the use of separate
boxes, you can accomplish most feats possible with or without the control
of an operator. Some boxes and their functions are listed below. Ones marked
with '*' indicate that they are not operatable in ESS. *Black Box:Makes
it seem to the phone company that the phone was never picked up. Blue Box:
Emits a 2600hz tone that allows you to do such things as stack a trunk
line, kick the operator off line, and others. Red Box: Simulates the noise
of a quarter, nickel, or dime being dropped into a payphone. Cheese Box:
Turns your home phone into a pay phone to throw off traces (a red box is
usually needed in order to call out.) *Clear Box: Gives you a dial tone
on some of the old SxS payphones without putting in a coin. Beige Box:
A simpler produced linesman's handset that allows you to tap into phone
lines and extract by eavesdropping, or crossing wires, etc. Purple Box:
Makes all calls made out from your house seem to be local calls. ANI [ANI]:
Automatic Number Identification. A service available on ESS that allows
a phone service [see Dialups below] to record the number that any certain
code was dialed from along with the number that was called and print both
of these on the customer bill. dialups [see Dialups below] are all designed
just to use ANI. Some of the services do not have the proper equipment
to read the ANI impulses yet, but it is impossible to see which is which
without being busted or not busted first. Dialups [dy'l'ups]: Any local
or 800 extended outlet that allows instant access to any service such as
MCI, Sprint, or AT&T that from there can be used by hand-picking or
using a program to reveal other peoples codes which can then be used moderately
until they find out about it and you must switch to another code (preferably
before they find out about it.) Dialups are extremely common on both senses.
Some dialups reveal the company that operates them as soon as you hear
the tone. Others are much harder and some you may never be able to identify.
A small list of dialups: 1-800-421-9438 (5 digit codes) 1-800-547-6754
(6 digit codes) 1-800-345-0008 (6 digit codes) 1-800-734-3478 (6 digit
codes) 1-800-222-2255 (5 digit codes) Codes: Codes are very easily accessed
procedures when you call a dialup. They will give you some sort of tone.
If the tone does not end in 3 seconds, then punch in the code and immediately
following the code, the number you are dialing but strike the '1' in the
beginning out first. If the tone does end, then punch in the code when
the tone ends. Then, it will give you another tone. Punch in the number
you are dialing, or a '9'. If you punch in a '9' and the tone stops, then
you messed up a little. If you punch in a tone and the tone continues,
then simply dial then number you are calling without the '1'. All codes
are not universal. The only type that I know of that is truly universal
is Metrophone. Almost every major city has a local Metro dialup (for Philadelphia,
(215)351-0100/0126) and since the codes are universal, almost every phreak
has used them once or twice. They do not employ ANI in any outlets that
I know of, so feel free to check through your books and call 555-1212 or,
as a more devious manor, subscribe yourself. Then, never use your own code.
That way, if they check up on you due to your caller log, they can usually
find out that you are subscribed. Not only that but you could set a phreak
hacker around that area and just let it hack away, since they usually group
them, and, as a bonus, you will have their local dialup. 950's. They seem
like a perfectly cool phreakers dream. They are free from your house, from
payphones, from everywhere, and they host all of the major long distance
companies (950)1044 ,
950-1033
122.Phrack Magazine
- Vol. 3, Issue 27 by Knight Lightning Prologue
If you are not already familiar with
NSFnet, I would suggest that you read: "Frontiers" (Phrack Inc., Volume
Two, Issue 24, File 4 of 13), and definitely; "NSFnet: National Science
Foundation Network" (Phrack Inc., Volume Three, Issue 26, File 4 of 11).
Introduction MIDNET is a regional computer network that is part of the
NSFnet, the National Science Foundation Network. Currently, eleven mid-United
States universities are connected to each other and to the NSFnet via MIDnet:
UA - University of Arkansas at Fayetteville ISU - Iowa State University
at Ames UI - University of Iowa at Iowa City KSU - Kansas State University
at Manhattan KU - University of Kansas at Lawrence UMC - University of
Missouri at Columbia WU - Washington University at St. Louis, Missouri
UNL - University of Nebraska at Lincoln OSU - Oklahoma State University
at Stillwater UT - University of Tulsa (Oklahoma) OU - University of Oklahoma
at Norman Researchers at any of these universities that have funded grants
can access the six supercomputer centers funded by the NSF: John Von Neuman
Supercomputer Center National Center for Atmospheric Research Cornell National
Supercomputer Facility National Center for Supercomputing Applications
Pittsburgh Supercomputing Center San Diego Supercomputing Center In addition,
researchers and scientists can communicate with each other over a vast
world-wide computer network that includes the NSFnet, ARPAnet, CSnet, BITnet,
and others that you have read about in The Future Transcendent Saga. Please
refer to "Frontiers" (Phrack Inc., Volume Two, Issue 24, File 4 of 13)
for more details. MIDnet is just one of several regional computer networks
that comprise the NSFnet system. Although all of these regional computer
networks work the same, MIDnet is the only one that I have direct access
to and so this file is written from a MIDnet point of view. For people
who have access to the other regional networks of NSFnet, the only real
differences depicted in this file that would not apply to the other regional
networks are the universities that are served by MIDnet as opposed to:
NYSERnet in New York State SURAnet in the southeastern United States SEQSUInet
in Texas BARRnet in the San Francisco area MERIT in Michigan (There are
others that are currently being constructed.) These regional networks all
hook into the NSFnet backbone, which is a network that connects the six
supercomputer centers. For example, a person at Kansas State University
can connect with a supercomputer via MIDnet and the NSFnet backbone. That
researcher can also send mail to colleagues at the University of Delaware
by using MIDnet, NSFnet and SURAnet. Each university has its own local
computer network which connects on-campus computers as well as providing
a means to connecting to a regional network. Some universities are already
connected to older networks such as CSnet, the ARPAnet and BITnet. In principal,
any campus connected to any of these networks can access anyone else in
any other network since there are gateways between the networks. Gateways
are specialized computers that forward network traffic, thereby connecting
networks. In practice, these wide-area networks use different networking
technology which make it impossible to provide full functionality across
the gateways. However, mail is almost universally supported across all
gateways, so that a person at a BITnet site can send mail messages to a
colleague at an ARPAnet site (or anywhere else for that matter). You should
already be somewhat familiar with this, but if not refer to; "Limbo To
Infinity" (Phrack Inc., Volume Two, Issue 24, File 3 of 13) and "Internet
Domains" (Phrack Inc., Volume Three, Issue 26, File 8 of 11) Computer networks
rely on hardware and software that allow computers to communicate. The
language that enables network communication is called a protocol. There
are many different protocols in use today. MIDnet uses the TCP/IP protocols,
also known as the DOD (Department of Defense) Protocol Suite. Other networks
that use TCP/IP include ARPAnet, CSnet and the NSFnet. In fact, all the
regional networks that are linked to the NSFnet backbone are required to
use TCP/IP. At the local campus level, TCP/IP is often used, although other
protocols such as IBM's SNA and DEC's DECnet are common. In order to communicate
with a computer via MIDnet and the NSFnet, a computer at a campus must
use TCP/IP directly or use a gateway that will translate its protocols
into TCP/IP. The Internet is a world-wide computer network that is the
conglomeration of most of the large wide area networks, including ARPAnet,
CSnet, NSFnet, and the regionals, such as MIDnet. To a lesser degree, other
networks such as BITnet that can send mail to hosts on these networks are
included as part of the Internet. This huge network of networks, the Internet,
as you have by now read all about in the pages of Phrack Inc., is a rapidly
growing and very complex entity that allows sophisticated communication
between scientists, students, government officials and others. Being a
part of this community is both exciting and challenging. This chapter of
the Future Transcendent Saga gives a general description of the protocols
and software used in MIDnet and the NSFNet. A discussion of several of
the more commonly used networking tools is also included to enable you
to make practical use of the network as soon as possible. The DOD Protocol
Suite The DOD Protocol Suite includes many different protocols. Each protocol
is a specification of how communication is to occur between computers.
Computer hardware and software vendors use the protocol to create programs
and sometimes specialized hardware in order to implement the network function
intended by the protocol. Different implementations of the same protocol
exist for the varied hardware and operating systems found in a network.
The three most commonly used network functions are: Mail -- Sending and
receiving messages File Transfer -- Sending and receiving files Remote
Login -- Logging into a distant computer Of these, mail is probably the
most commonly used. In the TCP/IP world, there are three different protocols
that realize these functions: SMTP -- (Simple Mail Transfer Protocol) Mail
FTP -- (File Transfer Protocol) sending and receiving files Telnet -- Remote
login How to use these protocols is discussed in the next section. At first
glance, it is not obvious why these three functions are the most common.
After all, mail and file transfer seem to be the same thing. However, mail
messages are not identical to files, since they are usually comprised of
only ASCII characters and are sequential in structure. Files may contain
binary data and have complicated, non-sequential structures. Also, mail
messages can usually tolerate some errors in transmission whereas files
should not contain any errors. Finally, file transfers usually occur in
a secure setting (i.e. The users who are transferring files know each other's
names and passwords and are permitted to transfer the file, whereas mail
can be sent to anybody as long as their name is known). While mail and
transfer accomplish the transfer of raw information from one computer to
another, Telnet allows a distant user to process that information, either
by logging in to a remote computer or by linking to another terminal. Telnet
is most often used to remotely log in to a distant computer, but it is
actually a general-purpose communications protocol. I have found it incredibly
useful over the last year. In some ways, it could be used for a great deal
of access because you can directly connect to another computer anywhere
that has TCP/IP capabilities, however please note that Telnet is *NOT*
Telenet. There are other functions that some networks provide, including
the following: Name to address translation for networks, computers and
people The current time Quote of the day or fortune Printing on a remote
printer, or use of any other remote peripheral Submission of batch jobs
for non-interactive execution Dialogues and conferencing between multiple
users Remote procedure call (i.e. Distributing program execution over several
remote computers) Transmission of voice or video information Some of these
functions are still in the experimental stages and require faster computer
networks than currently exist. In the future, new functions will undoubtedly
be invented and existing ones improved. The DOD Protocol Suite is a layered
network architecture, which means that network functions are performed
by different programs that work independently and in harmony with each
other. Not only are there different programs but there are different protocols.
The protocols SMTP, FTP and Telnet are described above. Protocols have
been defined for getting the current time, the quote of the day, and for
translating names. These protocols are called applications protocols because
users directly interact with the programs that implement these protocols.
The Transmission Control Protocol, TCP, is used by many of the application
protocols. Users almost never interact with TCP directly. TCP establishes
a reliable end-to-end connection between two processes on remote computers.
Data is sent through a network in small chunks called packets to improve
reliability and performance. TCP ensures that packets arrive in order and
without errors. If a packet does have errors, TCP requests that the packet
be retransmitted. In turn, TCP calls upon IP, Internet Protocol, to move
the data from one network to another. IP is still not the lowest layer
of the architecture, since there is usually a "data link layer protocol"
below it. This can be any of a number of different protocols, two very
common ones being X.25 and Ethernet. FTP, Telnet and SMTP are called "application
protocols", since they are directly used by applications programs that
enable users to make use of the network. Network applications are the actual
programs that implement these protocols and provide an interface between
the user and the computer. An implementation of a network protocol is a
program or package of programs that provides the desired network function
such as file transfer. Since computers differ from vendor to vendor (e.g.
IBM, DEC, CDC), each computer must have its own implementation of these
protocols. However, the protocols are standardized so that computers can
interpolate over the network (i.e. Can understand and process each other's
data). For example, a TCP packet generated by an IBM computer can be read
and processed by a DEC computer. In many instances, network applications
programs use the name of the protocol. For example, the program that transfers
files may be called "FTP" and the program that allows remote logins may
be called "Telnet." Sometimes these protocols are incorporated into larger
packages, as is common with SMTP. Many computers have mail programs that
allow users on the same computer to send mail to each other. SMTP functions
are often added to these mail programs so that users can also send and
receive mail through a network. In such cases, there is no separate program
called SMTP that the user can access, since the mail program provides the
user interface to this network function. Specific implementation of network
protocols, such as FTP, are tailored to the computer hardware and operating
system on which they are used. Therefore, the exact user interface varies
from one implementation to another. For example, the FTP protocol specifies
a set of FTP commands which each FTP implementation must understand and
process. However, these are usually placed at a low level, often invisible
to the user, who is given a higher set of commands to use. These higher-level
commands are not standardized so they may vary from one implementation
of FTP to another. For some operating systems, not all of these commands
make equal sense, such as "Change Directory," or may have different meanings.
Therefore the specific user interface that the user sees will probably
differ. This file describes a generic implementation of the standard TCP/IP
application protocols. User, users are still identified by their usernames,
but hosts are now identified by their hostname and any and all domains
of which they are a part. For example, the address "KNIGHT@UMCVMB.MISSOURI.EDU"
specifies username "KNIGHT" on host "UMCVMB". However, host "UMCVMB" is
a part of the domain "MISSOURI" " which is in turn part of the domain "EDU".
There are other domains in "EDU", although only one is named "MISSOURI".
In the domain "MISSOURI", there is only one host named "UMCVMB". However,
other domains in "EDU" could theoretically have hosts named "UMCVMB" (although
I would say that this is rather unlikely in this example). Thus the combination
of hostname and all its domains makes it unique. The method of translating
such names into IP addresses is no longer as straightforward as looking
up the hostname in a table. Several protocols and specialized network software
called nameservers and resolvers implement the domain name scheme. Not
all TCP/IP implementations support domain names because it is rather new.
In those cases, the local hosttable provides the only way to translate
hostnames to IP addresses. The system manager of that computer will have
to put an entry into the hosttable for every host that users may want to
connect to. In some cases, users may consult the nameserver themselves
to find out the IP address for a given hostname and then use that IP address
directly instead of a hostname. I have selected a few network hosts to
demonstrate how a host system can be specified by both the hostname and
host numerical address. Some of the nodes I have selected are also nodes
on BITnet, perhaps even some of the others that I do not make a note of
due a lack of omniscient awareness about each and every single host system
in the world :-) Numerical BITnetHostnameLocation18.72.0.39ATHENA.MIT.EDUMass.
Institute of Technology MIT26.0.0.73SRI-NIC.ARPADDN Network Information
Center -36.21.0.13MACBETH.STANFORD.EDUStanford University ?36.21.0.60PORTIA.STANFORD.EDUStanford
University ?128.2.11.131ANDREW.CMU.EDUCarnegie Mellon Univ. ANDREW128.3.254.13LBL.GOVLawrence
Berkeley Labrotories LBL128.6.4.7RUTGERS.RUTGERS.EDURutgers University
?128«9.99.1CUCARD.MED.COLUMBIA.EDUColumbia University ?128.102.18.3AMES.ARC.NASA.GOVAmes
Research Center [NASA] -128.103.1.1HARVARD.EDUHarvard University HARVARD128.111.24.40HUB.UCSB.EDUUniv.
Of Santa Barbara ?128.115.14.1LLL-WINKEN.LLNL.GOVLawrence Livermore
Labratories -128.143.2.7UVAARPA.VIRGINIA.EDUUniversity of Virginia
?128.148.128.40BROWNVM.BROWN.EDUBrown University BROWN128.163.1«UKCC.UKY.EDUUniversity
of Kentucky UKCC128.183.10.4NSSDCA.GSFC.NASA.GOVGoddard Space Flight
Center [NASA]-128.186.4.18RAI.CC.FSU.EDUFlorida State University FSU128.206.1.1UMCVMB.MISSOURI.EDUUniv.
of MissouriColumbia UMCVMB128.208.1.15MAX.ACS.WASHINGTON.EDUUniversity
of Washington MAX128.228.1.2CUNYVM.CUNY.EDUCity University of New York
CUNYVM129.10.1.6NUHUB.ACS.NORTHEASTERN.EDUNortheastern University NUHUB131.151.1.4UMRVMA.UMR.EDUUniversity
of Missouri Rolla UMRVMA192.9.9.1SUN.COMSun Microsystems, Inc. -192.33.18.30VM1.NODAK.EDUNorth
Dakota State Univ. NDSUVM1192.33.18«0PLAINS.NODAK.EDUNorth Dakota
State Univ. NDSUVAX Please Note: Not every system on BITnet has an IP
address. Likewise, not every system that has an IP address is on BITnet.
Also, while some locations like Stanford University may have nodes on BITnet
and have hosts on the IP as well, this does not necessarily imply that
the systems on BITnet and on IP (the EDU domain in this case) are the same
systems. Attempts to gain unauthorized access to systems on the internet
are not tolerated and is legally a federal offense. At some hosts, they
take this very seriously, especially the government hosts such as NASA's
Goddard Space Flight Center, where they do not mind telling you so at the
main prompt when you connect to their system. However, some nodes are public
access to an extent. The DDN Network Information Center can be used by
anyone. The server and database there have proven to be an invaluable source
of information when locating people, systems, and other information that
is related to the Internet. Telnet Remote login refers to logging in to
a remote computer from a terminal connected to a local computer. Telnet
is the standard protocol in the DOD Protocol Suite for accomplishing this.
The "rlogin" program, provided with Berkeley UNIX systems and some other
systems, also enables remote login. For purposes of discussion, the "local
computer" is the computer to which your terminal is directly connected
while the "remote computer" is the computer on the network to which you
are communicating and to which your terminal is *NOT* directly connected.
Since some computers use a different method of attaching terminals to computers,
a better definition would be the following: The "local computer" is the
computer that you are currently using and the "remote computer" is the
computer on the network with which you are or will be communicating. Note
that the terms "host" and "computer" are synonymous in the following discussion.
To use Telnet, simply enter the command: TELNET The prompt that Telnet
gives is: Telnet> (However, you can specify where you want to Telnet to
immediately and bypass the prompts and other delays by issuing the command:
TELNET [location].) There is help available by typing in ?. This prints
a list of all the valid subcommands that Telnet provides with a one-line
explanation. Telnet> ? To connect to another computer, use the open subcommand
to open a connection to that computer. For example, to connect to the host
"UMCVMB.MISSOURI.EDU", do "open umcvmb.missouri.edu" Telnet will resolve
(i.e. Translate, the hostname "umcvmb.missouri.edu" into an IP address
and will send a packet to that host requesting login. If the remote host
decides to let you attempt a login, it prompts you for your username and
password. If the host does not respond, Telnet will "time out" (i.e. Wait
for a reasonable amount of time such as 20 seconds) and then terminate
with a message such as "Host not responding." If your computer does not
have an entry for a remote host in its hosttable and it cannot resolve
the name, you can use the IP address explicitly in the telnet command.
For example, TELNET 26.0.0.73 (Note: This is the IP address for the DDN
Network Information Center [SRI-NIC.ARPA]) If you are successful in logging
in, your terminal is connected to the remote host. For all intents and
purposes, your terminal is directly hard-wired to that host and you should
be able to do anything on your remote terminal that you can do at any local
terminal. There are a few exceptions to this rule, however. Telnet provides
a network escape character, such as CONTROL-T. You can find out what the
escape character is by entering the "status" subcommand: Telnet> status
You can change the escape character by entering the "escape" subcommand:
Telnet> escape When you type in the escape character, the Telnet prompt
returns to your screen and you can enter subcommands. For example, to break
the connection, which usually logs you off the remote host, enter the subcommand
"quit": Telnet> quit Your Telnet connection usually breaks when you log
off the remote host, so the "quit" subcommand is not usually used to log
off. When you are logged in to a remote computer via Telnet, remember that
there is a time delay between your local computer and the remote one. This
often becomes apparent to users when scrolling a long file across the terminal
screen and they wish to cancel the scrolling by typing CONTROL-C or something
similar. After typing the special control character, the scrolling continues.
The special control character takes a certain amount of time to reach the
remote computer which is still scrolling information. Thus response from
the remote computer will not likely be as quick as response from a local
computer. Once you are remotely logged on, the computer you are logged
on to effectively becomes your "local computer," even though your original
"local computer" still considers you logged on. You can log on to a third
computer which would then become your "local computer" and so on. As you
log out of each session, your previous session becomes active again. File
Transfer FTP is the program that allows files to be sent from one computer
to another. "FTP" stands for "File Transfer Protocol". When you start using
FTP, a communications channel with another computer on the network is opened.
For example, to start using FTP and initiate a file transfer session with
a computer on the network called "UMCVMB", you would issue the following
subcommand: FTP UMCVMB.MISSOURI.EDU Host "UMCVMB" will prompt you for an
account name and password. If your login is correct, FTP will tell you
so, otherwise it will say "login incorrect." Try again or abort the FTP
program. (This is usually done by typing a special control character such
as CONTROL-C. The "program abort" character varies from system to system.)
Next you will see the FTP prompt, which is: Ftp> There are a number of
subcommands of FTP. The subcommand "?" will list these commands and a brief
description of each one. You can initiate a file transfer in either direction
with FTP, either from the remote host or to the remote host. The "get"
subcommand initiates a file transfer from the remote host (i.e. Tells the
remote computer to send the file to the local computer [the one on which
you issued the "ftp" command]). Simply enter "get" and FTP will prompt
you for the remote host's file name and the (new) local host's file name.
Example: Ftp> get Remote file name? theirfile local file name? myfile You
can abbreviate this by typing both file names on the same line as the "get"
subcommand. If you do not specify a local file name, the new local file
will be called the same thing as the remote file. Valid FTP subcommands
to get a file include the following: get theirfile myfile get doc.x25 The
"put" subcommand works in a similar fashion and is used to send a file
from the local computer to the remote computer. Enter the command "put"
and FTP will prompt you for the local file name and then the remote file
name. If the transfer cannot be done because the file doesn't exist or
for some other reason, FTP will print an error message. There are a number
of other subcommands in FTP that allow you to do many more things. Not
all of these are standard so consult your local documentation or type a
question mark at the FTP prompt. Some functions often built into FTP include
the ability to look at files before getting or putting them, the ability
to change directories, the ability to delete files on the remote computer,
and the ability to list the directory on the remote host. An intriguing
capability of many FTP implementations is "third party transfers." For
example, if you are logged on computer A and you want to cause computer
B to send a file to computer C, you can use FTP to connect to computer
B and use the "rmtsend" command. Of course, you have to know usernames
and passwords on all three computers, since FTP never allows you to peek
into someone's directory and files unless you know their username and password.
The "cd" subcommand changes your working directory on the remote host.
The "lcd" subcommand changes the directory on the local host. For UNIX
systems, the meaning of these subcommands is obvious. Other systems, especially
those that do not have directory-structured file system, may not implement
these commands or may implement them in a different manner. The "dir" and
"ls" subcommands do the same thing, namely list the files in the working
directory of the remote host. The "list" subcommand shows the contents
of a file without actually putting it into a file on the local computer.
This would be helpful if you just wanted to inspect a file. You could interrupt
it before it reached the end of the file by typing CONTROL-C or some other
special character. This is dependent on your FTP implementation. The "delete"
command can delete files on the remote host. You can also make and remove
directories on the remote host with "mkdir" and "rmdir". The "status" subcommand
will tell you if you are connected and with whom and what the state of
all your options are. If you are transferring binary files or files with
any non-printable characters, turn binary mode on by entering the "binary"
subcommand: binary To resume non-binary transfers, enter the "ascii" subcommand.
Transferring a number of files can be done easily by using "mput" (multiple
put) and "mget" (multiple get). For example, to get every file in a particular
directory, first issue a "cd" command to change to that directory and then
a "mget" command with an asterisk to indicate every file: cd somedirectory
mget * When you are done, use the "close" subcommand to break the communications
link. You will still be in FTP, so you must use the "bye" subcommand to
exit FTP and return to the command level. The "quit" subcommand will close
the connection and exit from FTP at the same time. Mail Mail is the simplest
network facility to use in many ways. All you have to do is to create your
message, which can be done with a file editor or on the spur of the moment,
and then send it. Unlike FTP and Telnet, you do not need to know the password
of the username on the remote computer. This is so because you cannot change
or access the files of the remote user nor can you use their account to
run programs. All you can do is to send a message. There is probably a
program on your local computer which does mail between users on that computer.
Such a program is called a mailer. This may or may not be the way to send
or receive mail from other computers on the network, although integrated
mailers are more and more common. UNIX mailers will be used as an example
in this discussion. Note that the protocol which is used to send and receive
mail over a TCP/IP network is called SMTP, the "Simple Mail Transfer Protocol."
Typically, you will not use any program called SMTP, but rather your local
mail program. UNIX mailers are usually used by invoking a program named
"mail". To receive new mail, simply type "mail". There are several varieties
of UNIX mailers in existence. Consult your local documentation for details.
For example, the command "man mail" prints out the manual pages for the
mail program on your computer. To send mail, you usually specify the address
of the recipient on the mail command. For example: "mail knight@umcvmb.missouri.edu"
will send the following message to username "knight" on host "umcvmb".
You can usually type in your message one line at a time, pressing RETURN
after each line and typing CONTROL-D to end the message. Other facilities
to include already-existing files sometimes exist. For example, Berkeley
UNIX's allow you to enter commands similar to the following to include
a file in your current mail message: r myfile In this example, the contents
of "myfile" are inserted into the message at this point. Most UNIX systems
allow you to send a file through the mail by using input redirection. For
example: mail knight@umcvmb.missouri.edu < myfile In this example, the
contents of "myfile" are sent as a message to "knight" on "umcvmb." Note
that in many UNIX systems the only distinction between mail bound for another
user on the same computer and another user on a remote computer is simply
the address specified. That is, there is no hostname for local recipients.
Otherwise, mail functions in exactly the same way. This is common for integrated
mail packages. The system knows whether to send the mail locally or through
the network based on the address and the user is shielded from any other
details. "The Quest For Knowledge Is Without End..."
123.Phrack Magazine
- Vol. 3, Issue 27 by Knight Lightning Prologue For None
VMS Users DECnet is the network for
DEC machines, in most cases you can say VAX's. DECnet allows you to do:
e-mail file transfer remote login remote command remote job entry PHONE
PHONE is an interactive communication between users and is equal to TALK
on UNIX or a "deluxe"-CHAT on VM/CMS. BELWUE, the university network of
the state Baden-Wuerttemberg in West Germany contains (besides other networks)
a DECnet with about 400 VAX's. On every VAX there is standard-account called
DECNET with pw:= DECNET, which is not reachable via remote login. This
account is provided for several DECnet-Utilities and as a pseudo-guest-account.
The DECNET-account has very restricted privileges: You cannot edit a file
or make another remote login. The HELP is equipped by the system and is
similar to the MAN command on UNIX. More information on DECnet can be found
in "Looking Around In DECnet" by Deep Thought in this very issue of Phrack
Inc. Here, at the University of Ulm, we have an *incredibly* ignorant computer
center staff, with an even bigger lack of system-literature (besides the
80kg of VAX/VMS-manuals). The active may search for information by himself,
which is over the level of "run," "FORTRAN," or "logout." My good luck
that I have other accounts in the BELWUE-DECnet, where more information
is offered for the users. I am a regular student in Ulm and all my accounts
are completely legal and corresponding to the German laws. I don't call
myself a "hacker," I feel more like a "user" (...it's more a defining-problem).
In the HELP-menu in a host in Tuebingen I found the file netdcl.com and
the corresponding explanation, which sends commands to the DECNET-Account
of other VAX's and executes them there (remote command). The explanation
in the HELP-menu was idiot-proof -- therefore for me, too :-) With the
command "$ mcr ncp show known nodes" you can obtain a list of all netwide
active VAX's, as is generally known, and so I pinged all these VAX's to
look for more information for a knowledge-thirsty user. With "help", "dir"
and other similar commands I look around on those DECnet accounts, always
watching for topics related to the BELWUE-network. It's a pity, that 2/3
of all VAX's have locked the DECNET-Account for NETDCL.COM. Their system
managers are probably afraid of unauthorized access, but I cannot imagine
how there could be such an unauthorized access, because you cannot log
on this account -- no chance for trojan horses, etc. Some system managers
called me back after I visited their VAX to chat with me about the network
and asked me if they could help me in any way. One sysop from Stuttgart
even sent me a version of NETDCL.COM for the ULTRIX operation system. Then,
after a month, the HORROR came over me in shape of a the following mail:
--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
--- --- From: TUEBINGEN::SYSTEM 31-MAY-1989 15:31:11.38 To: FRAMSTAG CC:
Subj: don't make any crap, or you'll be kicked out! From: ITTGPX::SYSTEM
29-MAY-1989 16:46 To: TUEBINGEN::SYSTEM Subj: System-breaking-in 01-May-1989
To the system manager of the Computer TUEBINGEN, On May 1st 1989 we had
a System-breaking-in in our DECNET-account, which started from your machine.
By help of our accounting we ascertained your user FRAMSTAG to have emulated
an interactive log-on on our backbone-node and on every machine of our
VAX-cluster with the "trojan horse" NETDCL.COM. Give us this user's name
and address and dear up the occurrence completely. We point out that the
user is punishable. In case of repetition we would be forced to take corresponding
measures. We will check whether our system got injured. If not, this time
we will disregard any measure. Inform us via DECnet about your investigation
results -- we are attainable by the nodenumber 1084::system Dipl.-Ing.
Michael Hager --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
--- --- --- --- --- My system manager threatened me with the deleting of
my account, if I would not immediately enlighten the affair. *Gulp*! I
was conscious about my innocence, but how to tell it to the others? I explained,
step by step, everything to my system manager. He then understood after
a while, but the criminal procedure still hovered over me... so, I took
quickly to my keyboard, to compose file of explanations and to send it
to that angry system manager in Stuttgart (node 1084 is an institute there).
But no way out: He had run out of disk quota and my explanation-mail sailed
into the nirwana: --- --- --- --- --- --- --- --- --- --- --- --- --- ---
--- --- --- --- --- --- $ mail explanation To: 1084::system %MAIL-E, error
sending to user SYSTEM at 1084 %MAIL-E-OPENOUT, error opening SYS$SYSROOT:[SYSMGR]MAIL$00040092594FD194.MAI;
as output -RMS-E-CRE, ACP file create failed -SYSTEM-F-EXDISKQUOTA, disk
quota exceeded --- --- --- --- --- --- --- --- --- --- --- --- --- ---
--- --- --- --- --- --- Also the attempt of a connection with the PHONE-facility
failed: In his borderless hacker-paranoia, he cut off his PHONE... and
nowhere is a list with the REAL-addresses of the virtual DECnet-addresses
available (to prevent hacking). Now I stood there with the brand "DANGEROUS
HACKER!" and I had no chance to vindicate myself. I poured out my troubles
to an acquaintance of mine, who is a sysop in the computer-center in Freiburg.
He asked other sysops and managers thru the whole BELWUE-network until
someone gave him a telephone number after a few days -- and that was the
right one! I phoned to this Hager and told him what I had done with his
DECnet-account and also what NOT. I wanted to know which crime I had committed.
He promptly canceled all of his reproaches, but he did not excuse his defames
incriminations. I entreated him to inform my system manager in Tuebingen
that I have done nothing illegal and to stop him from erasing my account.
This happens already to a fellow student of mine (in this case, Hager was
also guilty). He promised me that he would officially cancel his reproaches.
After over a week this doesn't happen (I'm allowed to use my account further
on). In return for it, I received a new mail from Hager on another account
of mine: --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
--- --- --- --- From: 1084::HAGER 1-JUN-1989 12:51 To: 50180::STUD_11 Subj:
System-breaking-in On June 1st 1989 you have committed a system-breaking-in
on at least one of our VAX's. We were able to register this occurrence.
We would be forced to take further measure if you did not dear up the occurrence
completely until June 6th. Of course the expenses involved would be imposed
on you. Hence enlightenment must be in your own interest. We are attainable
via DECnet-mail with the address 1084::HAGER or via following address:
Institut fuer Technische Thermodynamik und Thermische Verfahrenstechnik
Dipl.-Ing. M. Hager Tel.: 0711/685-6109 Dipl.-Ing. M. Mrzyglod Tel.: 0711/685-3398
Pfaffenwaldring 9/10-1 7000 Stuttgart-80 M. Hager M. Mrzyglod --- --- ---
--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- This
was the reaction of my attempt: "$ PHONE 1084::SYSTEM". I have not answered
to this mail. I AM SICK OF IT!
124. Phrack Magazine
- Vol. 3, Issue 28 by Taran King
ACSNET Australian Computer Science
Network (ACSNET), also known as Oz, has its gateway through the CSNET node
munnari.oz.au and if you cannot directly mail to the oz.au domain, try
either username%munnari.oz.au@UUNET.UU.NET or munnari! username@UUNET.UU.NET.
AT&T MAIL AT&T Mail is a mailing service of AT&T, probably
what you might call it's MCI-Mail equivalent. It is available on the UUCP
network as node name attmail but I've had problems having mail get through.
Apparently, it does cost money to mail to this service and the surrounding
nodes are not willing to pick up the tab for the ingoing mail, or at least,
this has seemingly been the case thus far. I believe, though, that perhaps
routing to att!attmail!user would work. AT&T recently announced six
new X.400 interconnections between AT&T Mail and electronic mail services
in the US, Korea, Sweden, Australia, and Finland. In the US, AT&T Mail
is now interconnected with Telenet Communications Corporation's service,
Telemail, allowing users of both services to exchange messages easily.
With the addition of these interconnections, the AT&T Mail Gateway
400 Service allows AT&T Mail subscribers to exchange messages with
users of the following electronic messaging systems: CompanyE-Mail NameCountryTeleDeltaTeDe
400SwedenOTCMPS400AustraliaTelecom-CanadaEnvoy100CanadaDACOMDACOM
MHSKoreaP&T-TeleMailNet 400FinlandHelsinki Telephone Co.ELISAFinlandDialcomDialcomUSATelenetTelemailUSAKDDMessaviaJapanTranspacATLAS400France
The interconnections are based on the X.400 standard, a set of guidelines
for the format, delivery and receipt of electronic messages recommended
by an international standards committee the CCITT. International X.400
messages incur a surcharge. They are: To Canada: Per note: $.05 Per message
unit: $.10 To other international locations: Per note: $.20 Per message
unit: $«0 There is no surcharge for X.400 messages within the US
The following are contacts to speak with about mailing through these mentioned
networks. Other questions can be directed through AT&T Mail's toll-free
number, 1-800-624-5672. MHS Gateway: mhs!atlas MHS Gateway: mhs!dacom Administrator:
Bernard Tardieu Administrator: Bob Nicholson Transpac AT&T Phone: 3399283203
Morristown, NJ 07960 Phone: +1 201 644 1838 MHS Gateway: mhs!dialcom MHS
Gateway: mhs!elisa Administrator: Mr. Laraman Administrator: Ulla Karajalainen
Dialcom Nokia Data South Plainfield, NJ 07080 Phone: 01135804371 Phone:
+1 441 493 3843 MHS Gateway: mhs!envoy MHS Gateway: mhs!kdd Administrator:
Kin C. Ma Administrator: Shigeo Lwase Telecom Canada Kokusai Denshin Denwa
CO. Phone: +1 613 567 7584 Phone: 8133477419 MHS Gateway: mhs!mailnet MHS
Gateway: mhs!otc Administrator: Kari Aakala Administrator: Gary W. Krumbine
Gen Directorate Of Post & AT&T Information Systems Phone: 35806921730
Lincroft, NJ 07738 Phone: +1 201 576 2658 MHS Gateway: mhs!telemail MHS
Gateway: mhs Administrator: Jim Kelsay Administrator: AT&T Mail MHS
GTE Telenet Comm Corp Gateway Reston, VA 22096 AT&T Phone: +1 703 689
6034 Lincroft, NJ 08838 Phone: +1 800 624 5672 CMR Previously known as
Intermail, the Commercial Mail Relay (CMR) Service is a mail relay service
between the Internet and three commercial electronic mail systems: US Sprint/Telenet,
MCI-Mail, and DIALCOM systems (i.e. Compmail, NSFMAIL, and USDA-MAIL).
An important note: The only requirement for using this mail gateway is
that the work conducted must be DARPA sponsored research and other approved
government business. Basically, this means that unless you've got some
government-related business, you're not supposed to be using this gateway.
Regardless, it would be very difficult for them to screen everything that
goes through their gateway. Before I understood the requirements of this
gateway, I was sending to a user of MCI-Mail and was not contacted about
any problems with that communication. Unfortunately, I mistyped the MCI-Mail
address on one of the letters and that letter ended up getting read by
system administrators who then informed me that I was not to be using that
system, as well as the fact that they would like to bill me for using it.
That was an interesting thought on their part anyway, but do note that
using this service does incur charges. The CMR mailbox address in each
system corresponds to the label: Telemail: [Intermail/USCISI]TELEMAIL/USA
MCI-Mail: Intermail or 107-8239 CompMail: Intermail or CMP0817 NSF-Mail:
Intermail or NSF153 USDA-Mail: Intermail or AGS9999 Addressing examples
for each e-mail system are as follows: MCIMAIL: 123-4567 seven digit address
Everett T. Bowens person's name (must be unique!) COMPMAIL: CMP0123 three
letters followed by three or four digits S.Cooper initial, then "." and
then last name 134:CMP0123 domain, then ":" and then combination system
and account number NSFMAIL: NSF0123 three letters followed by three or
four digits A.Phillips initial, then "." and then last name 157:NSF0123
domain, then ":" and then combination system and account number USDAMAIL:
AGS0123 three letters followed by three or four digits P.Shifter initial,
then "." and then last name 157:AGS0123 domain, then ":" and then combination
system and account number TELEMAIL: BARNOC user (directly on Telemail)
BARNOC/LODH user/organization (directly on Telemail) [BARNOC/LODH]TELEMAIL/USA
[user/organization]system branch/country The following are other Telenet
system branches/countries that can be mailed to: TELEMAIL/USA NASAMAIL/USA
MAIL/USA TELEMEMO/AUSTRALIA TELECOM/CANADA TOMMAIL/CHILE TMAILUK/GB ITALMAIL/ITALY
ATI/JAPAN PIPMAIL/ROC DGC/USA FAAMAIL/USA GSFC/USA GTEMAIL/USA TM11/USA
TNET.TELEMAIL/USA USDA/USA Note: OMNET's ScienceNet is on the Telenet system
MAIL/USA and to mail to it, the format would be [A.MAILBOX/OMNET]MAIL/USA.
The following are available subdivisions of OMNET: AIR Atmospheric Sciences
EARTH Solid Earth Sciences LIFE Life Sciences OCEAN Ocean Sciences POLAR
Interdisciplinary Polar Studies SPACE Space Science and Remote Sensing
The following is a list of DIALCOM systems available in the listed countries
with their domain and system numbers: Service NameCountryDomain NumberSystem
NumberKeylink-DialcomAustralia6007, 08, 09DialcomCanada2020,
21, 22, 23, 24DPT DatabooksDenmark12471TeleboxFinland12762TeleboxWest
Germany3015, 16DialcomHong Kong8088, 89EirmailIreland10074GoldnetIsrael5005,
06MastermailItaly13065, 67MastermailItaly166, 68DialcomJapan7013,
14DialcomKorea152Telecom GoldMalta10075DialcomMexico152MemocomNetherlands12427,
28, 29MemocomNetherlands155StarnetNew Zealand6401, 02DialcomPuerto
Rico5825TeleboxSingapore8810, 11, 12DialcomTaiwan152Telecom
GoldUnited Kingdom10001, 04, 17, 80-89DIALCOMUSA129-34, 37, 38,
41-59, 61-63, 90-99 NOTE: You can also mail to username@NASAMAIL.NASA.GOV
or username@GSFCMAIL.NASA.GOV instead of going through the CMR gateway
to mail to NASAMAIL or GSFCMAIL. For more information and instructions
on how to use CMR, send a message to the user support group at intermail-request@intermail.isi.edu
(you'll get basically what I've listed plus maybe a bit more). Please read
Chapter 3 of The Future Transcendent Saga (Limbo to Infinity) for specifics
on mailing to these destination mailing systems. COMPUSERVE CompuServe
is well known for its games and conferences. It does, though, have mailing
capability. Now, they have developed their own Internet domain, called
COMPUSERVE.COM. It is relatively new and mail can be routed through either
TUT.CIS.OHIO-STATE.EDU or NORTHWESTERN.ARPA. Example: user%COMPUSERVE.COM@TUT.CIS.OHIO-STATE.EDU
or replace TUT.CIS.OHIO-STATE.EDU with NORTHWESTERN.ARPA). The CompuServe
link appears to be a polled UUCP connection at the gateway machine. It
is actually managed via a set of shell scripts and a comm utility called
xcomm, which operates via command scripts built on the fly by the shell
scripts during analysis of what jobs exist to go into and out of CompuServe.
CompuServe subscriber accounts of the form 7xxxx, yyyy can be addressed
as 7xxxx.yyyy@compuserve.com. CompuServe employees can be addressed by
their usernames in the csi.compuserve.com subdomain. CIS subscribers write
mail to ">inet:user@host.domain" to mail to users on the Wide-Area Networks,
where ">gateway:" is CompuServe's internal gateway access syntax. The gateway
generates fully-RFC-compliant headers. To fully extrapolate -- from the
CompuServe side, you would use their EasyPlex mail system to send mail
to someone in BITNET or the Internet. For example, to send me mail at my
Bitnet ID, you would address it to: INET:C488869%UMCVMB.BITNET@CUNYVM.CUNY.EDU
Or to my Internet ID: INET:C488869@UMCVMB.MISSOURI.EDU Now, if you have
a BITNET to Internet userid, this is a silly thing to do, since your connect
time to CompuServe costs you money. However, you can use this information
to let people on CompuServe contact YOU. CompuServe Customer Service says
that there is no charge to either receive or send a message to the Internet
or BITNET. DASNET DASnet is a smaller network that connects to the Wide-Area
Networks but charges for their service. DASnet subscribers get charged
for both mail to users on other networks AND mail for them from users of
other networks. The following is a brief description of DASnet, some of
which was taken from their promotional text letter. DASnet allows you to
exchange electronic mail with people on more than 20 systems and networks
that are interconnected with DASnet. One of the drawbacks, though, is that,
after being subscribed to these services, you must then subscribe to DASnet,
which is a separate cost. Members of Wide-Area networks can subscribe to
DASnet too. Some of the networks and systems reachable through DASnet include
the following: ABA/net, ATT Mail, BIX (Byte Information eXchange), DASnet
Network, Dialcom, EIES, EasyLink, Envoy 100, FAX, GeoMail, INET, MCI Mail,
NWI, PeaceNet/EcoNet, Portal Communications, The Meta Network, The Source,
Telemail, ATI's Telemail (Japan), Telex, TWICS (Japan), UNISON, UUCP, The
WELL, and Domains (i.e. ".COM" and ".EDU" etc.). New systems are added
all of the time. As of the writing of this file, Connect, GoverNET, MacNET,
and The American Institute of Physics PI-MAIL are soon to be connected.
You can get various accounts on DASnet including: Corporate Accounts --
If your organization wants more than one individual subscription. Site
Subscriptions -- If you want DASnet to link directly to your organization's
electronic mail system. To send e-mail through DASnet, you send the message
to the DASnet account on your home system. You receive e-mail at your mailbox,
as you do now. On the Wide-Area Networks, you send mail to XB.DAS@STANFORD.BITNET.
On the Subject: line, you type the DASnet address in brackets and then
the username just outside of them. The real subject can be expressed after
the username separated by a "!" (Example: Subject: [0756TK]randy!How's
Phrack?). The only disadvantage of using DASnet as opposed to Wide-Area
networks is the cost. Subscription costs as of 3/3/89 cost $4.75 per month
or $5.75 per month for hosts that are outside of the USA You are also charged
for each message that you send. If you are corresponding with someone who
is not a DASnet subscriber, THEIR MAIL TO YOU is billed to your account.
The following is an abbreviated cost list for mailing to the different
services of DASnet: PARTIAL List DASnet Cost DASnet Cost of Services 1st
1000 Each Additional 1000 Linked by DASnet (e-mail) Characters Characters:
INET, MacNET, PeaceNet, NOTE: 20 lines Unison, UUCP*, Domains, .21 .11
of text is app. e.g. .COM, .EDU* 1000 characters. Dialcom--Any "host" in
US .36 .25 Dialcom--Hosts outside US .93 .83 EasyLink (From EasyLink) .21
.11 (To EasyLink) «5 .23 US FAX (international avail.) .79 .37 GeoMail--Any
"host" in US .21 .11 GeoMail--Hosts outside US .74 .63 MCI (from MCI) .21
.11 (to MCI) .78 .25 (Paper mail - USA) 2.31 .21 Telemail .36 .25 W.U.
Telex--United States 1.79 1.63 (You can also send Telexes outside the US)
TWICS--Japan .89 .47 * The charges given here are to the gateway to the
network. The DASnet user is not charged for transmission on the network
itself. Subscribers to DASnet get a free DASnet Network Directory as well
as a listing in the directory, and the ability to order optional DASnet
services like auto-porting or DASnet Telex Service which gives you your
own Telex number and answerback for $8.40 a month at this time. DASnet
is a registered trademark of DA Systems, Inc. DA Systems, Inc. 1503 E.
Campbell Ave. Campbell, CA 95008 408-559-7434 TELEX: 910 380-3530 The following
two sections on PeaceNet and AppleLink are in association with DASnet as
this network is what is used to connect.
125. Phrack Magazine
- Vol. 3, Issue 28 by Dispater
Introduction: After reading the earlier
renditions of schematics for the Pearl Box, I decided that there was an
easier and cheaper way of doing the same thing with an IC and parts you
probably have just laying around the house. What Is A Pearl Box and Why
Do I Want One? A Pearl Box is a tone generating device that is used to
make a wide range of single tones. Therefore, it would be very easy to
modify this basic design to make a Blue Box by making 2 Pearl Boxes and
joining them together in some fashion. A Pearl Box can be used to create
any tone you wish that other boxes may not. It also has a tone sweep option
that can be used for numerous things like detecting different types of
phone tapping devices. Parts List: CD4049 RCA integrated circuit .1 uF
disk capacitor 1 uF 16V electrolitic capacitor 1K resistor 10M resistor
1Meg pot 1N914 diode Some SPST momentary push-button switches 1 SPDT toggle
switch 9 Volt battery & clip and miscellaneous stuff you should have
laying around the house. State-of-the-Art-Text Schematic: + 16V 1uF - _______________________________||_____
| ! ! || | _ | _______________________ |__________| |/| 8ohms ____|__|_____:__|__:__|_
| __________| | | | 9 10 11 12 13 14 15 16 | | | |_|\| | CD4049UBE | |
| |_1__2__3__4__5__6__7__8_| : | _ | | |__| |__| | |____________________|_________[-]
| | ! ! : [b] | |__________________________| [a] | : : | [t] | ! 1N914
! ! [t] |___________|/|_____________________________________[+] : |\| :
: | | | | 10M | | |___/\/\/\__| | | | | |_____||____| | <-- These 2
wires to the center pole || | | of switch. .1uF 50V | | | | _______________________|
|_____________________________ | ___[Toggle Switch]____________ | | | |
___ | | | | o o | | | | /\/\/\___| |__| |_/\/\/\____/\/\/\ | | ^ | 1K ^
| |____| ___ | |___| | o o | | /\/\/\___| |__|
126. Phrack Magazine
- Vol. 3, Issue 28 by Dark OverLord
There are many ways of getting copies
of files from a remote system that you do not have permission to read or
an account on login on to and access them through. Many administrators
do not even bother to restrict many access points that you can use. Here
are the simplest ways: Use uucp(1) [Trivial File Transfer Protocol] to
retrieve a copy of a file if you are running on an Internet based network.
Abuse uucp(1) [Unix to Unix Copy Program] to retrieve a copy of a file
if uucp connections are running on that system. Access one of many known
security loopholes. In the following examples, we will use the passwd file
as the file to acquire since it is a readable file that can be found on
most systems that these attacks are valid on. Method A : First start the
tftp program: Enter the command: tftp [You have the following prompt:]
tftp> The next step is to connect to the system that you wish to retrieve
files from. At the tftp, type: tftp> connect other.system.com Now request
the file you wish to get a copy of (in our case, the passwd file /etc/passwd
): tftp> get /etc/passwd /tmp/passwd [You should see something that looks
like the following:] Received 185659 bytes in 22 seconds. Now exit the
tftp program with the "quit" command: tftp> quit You should now have a
copy of other.system.com's passwd file in your directory. NOTE: Some Unix
systems' tftp programs have a different syntax. The above was tested under
SunOS 4.0 For example, on Apollos, the syntax is: tftp -{g|g!|p|r|w}
127.Phrack Magazine
- Vol. 3, Issue 30 by Phone Phanatic
"Until a few years ago -- maybe ten
-- it was very common to see TWX and Telex machines in almost every business
place." There were only minor differences between Telex and TWX. The biggest
difference was that the former was always run by Western Union, while the
latter was run by the Bell System for a number of years. TWX literally
meant "(T)ype(W)riter e(x)change," and it was Bell's answer to competition
from Western Union. There were "three row" and "four row" machines, meaning
the number of keys on the keyboard and how they were laid out. The "three
row" machines were simply part of the regular phone network; that is, they
could dial out and talk to another TWX also connected on regular phone
lines. Eventually these were phased out in favor of "newer and more improved"
machines with additional keys, as well as a paper tape reader attachment
which allowed sending the same message repeatedly to many different machines.
These "four row" machines were not on the regular phone network, but were
assigned their own area codes (410-510-610-710-810-910) where they still
remain today. The only way a four row machine could call a three row machine
or vice-versa was through a gateway of sorts which translated some of the
character set unique to each machine. Western Union's network was called
Telex and in addition to being able to contact (by dial up) other similar
machines, Telex could connect with TWX (and vice-versa) as well as all
the Western Union public offices around the country. Until the late 1950's
or early 1960's, every small town in America had a Western Union office.
Big cities like Chicago had perhaps a dozen of them, and they used messengers
to hand deliver telegrams around town. Telegrams could be placed in person
at any public office, or could be called in to the nearest public office.
By arrangement with most telcos, the Western Union office in town nearly
always had the phone number 4321, later supplemented in automated exchanges
with some prefix XXX-4321. Telegrams could be charged to your home phone
bill (this is still the case in some communities) and from a coin phone,
one did not ask for 4321, but rather, called the operator and asked for
Western Union. This was necessary since once the telegram had been given
verbally to the wire clerk, s/he in turn had to flash the hook and get
your operator back on the line to tell them "collect five dollars and twenty
cents" or whatever the cost was. Telegrams, like phone calls, could be
sent collect or billed third party. If you had an account with Western
Union, i.e. a Telex machine in your office, you could charge the calls
there, but most likely you would simply send the telegram from there in
the first place. Sometime in the early 1960's, Western Union filed suit
against AT&T asking that they turn over their TWX business to them.
They cited an earlier court ruling, circa 1950's, which said AT&T was
prohibited from acquiring any more telephone operating companies except
under certain conditions. The Supreme Court agreed with Western Union that
"spoken messages" were the domain of Ma Bell, but "written messages" were
the domain of Western Union. So Bell was required to divest itself of the
TWX network, and Western Union has operated it since, although a few years
ago they began phasing out the phrase "TWX" in favor of "Telex II"; their
original device being "Telex I" of course. TWX still uses ten digit dialing
with 610 (Canada) or 710/910 (USA) being the leading three digits. Apparently
410-510 have been abandoned; or at least they are used very little, and
Bellcore has assigned 510 to the San Francisco area starting in a year
or so. 410 still has some funny things on it, like the Western Union "Infomaster,"
which is a computer that functions like a gateway between Telex, TWX, EasyLink
and some other stuff. Today, the Western Union network is but a skeleton
of its former self. Now most of their messages are handled on dial up terminals
connected to the public phone network. It has been estimated the TWX/Telex
business is about fifty percent of what it was a decade ago, if that much.
Then there was the Time Service, a neat thing which Western Union offered
for over seventy years, until it was discontinued in the middle 1960's.
The Time Service provided an important function in the days before alternating
current was commonly available. For example, Chicago didn't have AC electricity
until about 1945. Prior to that we used DC, or direct current. Well, to
run an electric clock, you need 60 cycles AC current for obvious reasons,
so prior to the conversion from DC power to AC power, electric wall clocks
such as you see in every office were unheard of. How were people to tell
the time of day accurately? Enter the Western Union clock. The Western
Union, or "telegraph clock" was a spring driven wind up clock, but with
a difference. The clocks were "perpetually self-winding," manufactured
by the Self-Winding Clock Company of New York City. They had large batteries
inside them, known as "telephone cells" which had a life of about ten years
each. A mechanical contrivance in the clock would rotate as the clock spring
unwound, and once each hour would cause two metal clips to contact for
about ten seconds, which would pass juice to the little motor in the clock
which in turn re-wound the main spring. The principle was the same as the
battery operated clocks we see today. The battery does not actually run
the clock -- direct current can't do that -- but it does power the tiny
motor which re-winds the spring which actually drives the clock. The Western
Union clocks came in various sizes and shapes, ranging from the smallest
dials which were nine inches in diameter to the largest which were about
eighteen inches in diameter. Some had sweep second hands; others did not.
Some had a little red light bulb on the front which would flash. The typical
model was about sixteen inches, and was found in offices, schools, transportation
depots, radio station offices, and of course in the telegraph office itself.
The one thing all the clocks had in common was their brown metal case and
cream-colored face, with the insignia "Western Union" and their corporate
logo in those days which was a bolt of electricity, sort of like a letter
"Z" laying on its side. And in somewhat smaller print below, the words
"Naval Observatory Time." The local clocks in an office or school or wherever
were calibrated by a "master clock" (actually a sub-master) on the premises.
Once an hour on the hour, the (sub) master clock would drop a metal contact
for just a half second, and send about nine volts DC up the line to all
the local clocks. They in turn had a "tolerance" of about two minutes on
both sides of the hour so that the current coming to them would yank the
minute hand exactly upright onto the twelve from either direction if the
clock was fast or slow. The sub-master clocks in each building were in
turn serviced by the master clock in town; usually this was the one in
the telegraph office. Every hour on the half hour, the master clock in
the telegraph office would throw current to the sub-masters, yanking them
into synch as required. And as for the telegraph offices themselves, they
were serviced twice a day by -- you guessed it -- the Naval Observatory
Master clock in Our Nation's Capitol, by the same routine. Someone there
would press half a dozen buttons at the same time, using all available
fingers; current would flow to every telegraph office and synch all the
master clocks in every community. Western Union charged fifty cents per
month for the service, and tossed the clock in for free! Oh yes, there
was an installation charge of about two dollars when you first had service
(i.e. a clock) installed. The clocks were installed and maintained by the
"clockman," a technician from Western Union who spent his day going around
hanging new clocks, taking them out of service, changing batteries every
few years for each clock, etc. What a panic it was for them when "war time"
(what we now call Daylight Savings Time) came around each year! Wally,
the guy who serviced all the clocks in downtown Chicago had to start on
*Thursday* before the Sunday official changeover just to finish them all
by *Tuesday* following. He would literally rush in an office, use his screwdriver
to open the case, twirl the hour hand around one hour forward in the spring,
(or eleven hours *forward* in the fall since the hands could not be moved
backward beyond the twelve going counterclockwise), slam the case back
on, screw it in, and move down the hall to the next clock and repeat the
process. He could finish several dozen clocks per day, and usually the
office assigned him a helper twice a year for these events. He said they
never bothered to line the minute hand up just right, because it would
have taken too long, and ".....anyway, as long as we got it within a minute
or so, it would synch itself the next time the master clock sent a signal..."
Working fast, it took a minute to a minute and a half to open the case,
twirl the minute hand, put the case back on, "stop and BS with the receptionist
for a couple seconds" and move along. The master clock sent its signal
over regular telco phone lines. Usually it would terminate in the main
office of whatever place it was, and the (sub) master there would take
over at that point. Wally said it was very important to do a professional
job of hanging the clock to begin with. It had to be level, and the pendulum
had to be just right, otherwise the clock would gain or lose more time
than could be accommodated in the hourly synching process. He said it was
a very rare clock that actually was out by even a minute once an hour,
let alone the two minutes of tolerance built into the gear works. "...Sometimes
I would come to work on Monday morning, and find out in the office that
the clock line had gone open Friday evening. So nobody all weekend got
a signal. Usually I would go down a manhole and find it open someplace
where one of the Bell guys messed it up, or took it off and never put it
back on. To find out where it was open, someone in the office would 'ring
out' the line; I'd go around downtown following the loop as we had it laid
out, and keep listening on my headset for it. When I found the break or
the open, I would tie it down again and the office would release the line;
but then I had to go to all the clocks *before* that point and restart
them, since the constant current from the office during the search had
usually caused them to stop." But he said, time and again, the clocks were
usually so well mounted and hung that "...it was rare we would find one
so far out of synch that we had to adjust it manually. Usually the first
signal to make it through once I repaired the circuit would yank everyone
in town to make up for whatever they lost or gained over the weekend..."
In 1965, Western Union decided to discontinue the Time Service. In a nostalgic
letter to subscribers, they announced their decision to suspend operations
at the end of the current month, but said "for old time's sake" anyone
who had a clock was welcome to keep it and continue using it; there just
would not be any setting signals from the master clocks any longer. Within
a day or two of the official announcement, every Western Union clock in
the Chicago area headquarters building was gone. The executives snatched
them off the wall, and took them home for the day when they would have
historical value. All the clocks in the telegraph offices disappeared about
the same time, to be replaced with standard office-style electric wall
clocks.
128.Phrack Magazine
- Vol. 3, Issue 30 by Synthecide
There are literally hundreds of systems
connected to some of these larger networks, like Tymnet and Telenet. Navigation
around these networks is very simple, and usually well explained in their
on-line documentation. Furthermore, some systems will actually tell you
what is connected and how to get to it. In the case of Tymnet, after dialing
in, at the log in prompt, type "information" for the on-line documentation.
Accessing systems through networks is as simple as providing an address
for it to connect to. The best way to learn about the addresses and how
to do things on a network is to read "A Novice's Guide to Hacking (1989
Edition)" which was in Issue 22, File 4 of 12, Volume Two (December 23,
1988). Some points are reiterated here. Once on a network, you provide
the NUA (network user address) of the system you wish to connect to. NUAs
are strings of 15 digits, broken up in to 3 fields, the NETWORK ADDRESS,
the AREA PREFIX, and the DNIC. Each field has 5 digits, and are left padded
with 0's where necessary. The DNIC determines which network to take the
address from. Tymnet, for example, is 03106. 03110 is Telenet. The AREA
PREFIX and NETWORK ADDRESS determine the connection point. By providing
the address of the system that you wish to connect to, you will be accessing
it through the net... as if you were calling it directly. Obviously, then,
this provides one more level of security for access. By connecting to an
outdial, you can increase again the level of security you enjoy, by using
the outdial in that area to connect to the remote system. Addendum -- Accessing
Tymnet Over Local Packet Networks This is just another way to get that
extra step and/or bypass other routes. This table is copied from Tymnet's
on-line information. As said earlier, it's a great resource, this on-line
information! BELL ATLANTIC NODECITYSTATESPEEDACCESS NUMBERNETWORK03526DOVERDELAWARE300/2400302/734-9465@PDN03526GEORGETOWNDELAWARE300/2400302/856-7055@PDN03526NEWARKDELAWARE300/2400302/366-0800@PDN03526WILMINGTONDELAWARE300/1200302/428-0030@PDN03526WILMINGTONDELAWARE2400302/655-1144@PDN06254WASHINGTONDIST.
OF COL.300/1200202/479-7214@PDN06254WASHINGTON(MIDTOWN)DIST. OF
COL.2400202/785-1688@PDN06254WASHINGTON(DOWNTOWN)DIST. OF COL.300/1200202/393-6003@PDN06254WASHINGTON(MIDTOWN)DIST.
OF COL.300/1200202/293-4641@PDN06254WASHINGTONDIST. OF COL.300/1200202/546-5549@PDN06254WASHINGTONDIST.
OF COL.300/1200202/328-0619@PDN06254BETHESDAMARYLAND300/1200301/986-9942@PDN06254COLESVILLEMARYLAND300/2400301/989-9324@PDN06254HYATTSVILLEMARYLAND300/1200301/779-9935@PDN06254LAURELMARYLAND300/2400301/490-9971@PDN06254ROCKVILLEMARYLAND300/1200301/340-9903@PDN06254SILVER
SPRINGMARYLAND300/1200301/495-9911@PDN07771BERNARDSVILLENEW JERSEY300/2400201/766-7138@PDN07771CLINTONNEW
JERSEY300-1200201/730-8693@PDN07771DOVERNEW JERSEY300/2400201/361-9211@PDN07771EATONTOWN/RED
BANKNEW JERSEY300/2400201/758-8000@PDN07771ELIZABETHNEW JERSEY300/2400201/289-5100@PDN07771ENGLEWOODNEW
JERSEY300/2400201/871-3000@PDN07771FREEHOLDNEW JERSEY300/2400201/780-8890@PDN07771HACKENSACKNEW
JERSEY300/2400201/343-9200@PDN07771JERSEY CITYNEW JERSEY300/2400201/659-3800@PDN07771LIVINGSTONNEW
JERSEY300/2400201/533-0561@PDN07771LONG BRANCH/RED BANKNEW JERSEY300/2400201/758-8000@PDN07771MADISONNEW
JERSEY300/2400201/593-0004@PDN07771METUCHENNEW JERSEY300/2400201/906-9500@PDN07771MIDDLETOWNNEW
JERSEY300/2400201/957-9000@PDN07771MORRISTOWNNEW JERSEY300/2400201/455-0437@PDN07771NEWARKNEW
JERSEY300/2400201/623-0083@PDN07771NEW BRUNSWICKNEW JERSEY300/2400201/247-2700@PDN07771NEW
FOUNDLANDNEW JERSEY300/2400201/697-9380@PDN07771PASSAICNEW JERSEY300/2400201/473-6200@PDN07771PATERSONNEW
JERSEY300/2400201/345-7700@PDN07771PHILLIPSBURGNEW JERSEY300/2400201/454-9270@PDN07771POMPTON
LAKESNEW JERSEY300/2400201/835-8400@PDN07771RED BANKNEW JERSEY300/2400201/758-8000@PDN07771RIDGEWOODNEW
JERSEY300/2400201/445-4800@PDN07771SOMERVILLENEW JERSEY300/2400201/218-1200@PDN07771SOUTH
RIVERNEW JERSEY300/2400201/390-9100@PDN07771SPRING LAKENEW JERSEY300/2400201/974-0850@PDN07771TOMS
RIVERNEW JERSEY300/2400201/286-3800@PDN07771WASHINGTONNEW JERSEY300/2400201/689-6894@PDN07771WAYNE/PATERSONNEW
JERSEY300/2400201/345-7700@PDN03526ALLENTOWNPENNSYLVANIA300/1200215/435-0266@PDN11301ALTOONAPENNSYLVANIA300/1200814/946-8639@PDN11301ALTOONAPENNSYLVANIA2400814/949-0505@PDN03526AMBLERPENNSYLVANIA300/1200215/283-2170@PDN10672AMBRIDGEPENNSYLVANIA300/1200412/266-9610@PDN10672CARNEGIEPENNSYLVANIA300/1200412/276-1882@PDN10672CHARLEROIPENNSYLVANIA300/1200412/483-9100@PDN03526CHESTER
HEIGHTSPENNSYLVANIA300/1200215/358-0820@PDN03526COATESVILLEPENNSYLVANIA300/1200215/383-7212@PDN10672CONNELLSVILLEPENNSYLVANIA300/1200412/628-7560@PDN03526DOWNINGTON/COATES.PENNSYLVANIA300/1200215/383-7212@PDN03562DOYLESTOWNPENNSYLVANIA300/1200215/340-0052@PDN03562GERMANTOWNPENNSYLVANIA300/1200215-843-4075@PDN10672GLENSHAWPENNSYLVANIA300/1200412/487-6868@PDN10672GREENSBURGPENNSYLVANIA300/1200412/836-7840@PDN11301HARRISBURGPENNSYLVANIA300/1200717/236-3274@PDN11301HARRISBURGPENNSYLVANIA2400717/238-0450@PDN10672INDIANAPENNSYLVANIA300/1200412/465-7210@PDN03526KING
OF PRUSSIAPENNSYLVANIA300/1200215/270-2970@PDN03526KIRKLYNPENNSYLVANIA300/1200215/789-5650@PDN03526LANSDOWNEPENNSYLVANIA300/1200215/626-9001@PDN10672LATROBEPENNSYLVANIA300/1200412/537-0340@PDN11301LEMOYNE/HARRISBURGPENNSYLVANIA300/1200717/236-3274@PDN10672MCKEESPORTPENNSYLVANIA300/1200412/673-6200@PDN10672NEW
CASTLEPENNSYLVANIA300/1200412/658-5982@PDN10672NEW KENSINGTONPENNSYLVANIA300/1200412/337-0510@PDN03526NORRISTOWNPENNSYLVANIA300/1200215/270-2970@PDN03526PAOLIPENNSYLVANIA300/1200215/648-0010@PDN03562PHILADELPHIAPENNSYLVANIA300/1200215/923-7792@PDN03562PHILADELPHIAPENNSYLVANIA300/1200215/557-0659@PDN03562PHILADELPHIAPENNSYLVANIA300/1200215/545-7886@PDN03562PHILADELPHIAPENNSYLVANIA300/1200215/677-0321@PDN03562PHILADELPHIAPENNSYLVANIA2400215/625-0770@PDN10672PITTSBURGHPENNSYLVANIA300/1200412/281-8950@PDN10672PITTSBURGHPENNSYLVANIA300/1200412-687-4131@PDN10672PITTSBURGHPENNSYLVANIA2400412/261-9732@PDN10672POTTSTOWNPENNSYLVANIA300/1200215/327-8032@PDN03526QUAKERTOWNPENNSYLVANIA300/1200215/538-7032@PDN03526READINGPENNSYLVANIA300/1200215/375-7570@PDN10672ROCHESTERPENNSYLVANIA300/1200412/728-9770@PDN03526SCRANTONPENNSYLVANIA300/1200717/348-1123@PDN03526SCRANTONPENNSYLVANIA2400717/341-1860@PDN10672SHARONPENNSYLVANIA300/1200412/342-1681@PDN03526TULLYTOWNPENNSYLVANIA300/1200215/547-3300@PDN10672UNIONTOWNPENNSYLVANIA300/1200412/437-5640@PDN03562VALLEY
FORGEPENNSYLVANIA300/1200215/270-2970@PDN10672WASHINGTONPENNSYLVANIA300/1200412/223-9090@PDN03526WAYNEPENNSYLVANIA300/1200215/341-9605@PDN10672WILKINSBURGPENNSYLVANIA300/1200412/241-1006@PDN06254ALEXANDRIAVIRGINIA300/1200703/683-6710@PDN06254ARLINGTONVIRGINIA300/1200703/524-8961@PDN06254FAIRFAXVIRGINIA300/1200703/385-1343@PDN06254MCLEANVIRGINIA300/1200703/848-2941@PDN@PDN
BELL ATLANTIC - NETWORK NAME IS PUBLIC DATA NETWORK (PDN) (CONNECT MESSAGE)
. _. _. _< _C _R _> _ (SYNCHRONIZES DATA SPEEDS) WELCOME TO THE BPA/DST
PDN *. _T _ _< _C _R _> _ (TYMNET ADDRESS) 131069 (ADDRESS CONFIRMATION
- TYMNET DNIC) COM (CONFIRMATION OF CALL SET-UP) -GWY 0XXXX- TYMNET: PLEASE
LOG IN: (HOST # WITHIN DASHES) BELL SOUTH NODECITYSTATEDENSITYACCESS
NUMBERMODEM10207ATLANTAGEORGIA300/1200404/261-4633@PLSK10207ATHENSGEORGIA300/1200404/354-0614@PLSK10207COLUMBUSGEORGIA300/1200404/324-5771@PLSK10207ROMEGEORGIA300/1200404/234/7542@PLSK@PLSK
BELLSOUTH - NETWORK NAME IS PULSELINK (CONNECT MESSAGE) . _. _. _ _<
_C _R _> _ (SYNCHRONIZES DATA SPEEDS) (DOES NOT ECHO TO THE TERMINAL) CONNECTED
PULSELINK 1 _3 _1 _0 _6 _ (TYMNET ADDRESS) (DOES NOT ECHO TO THE TERMINAL)
PULSELINK: CALL CONNECTED TO 1 3106 -GWY 0XXXX- TYMNET: PLEASE LOG IN:
(HOST # WITHIN DASHES) PACIFIC BELL NODECITYSTATEDENSITYACCESS NUMBERNETWORK03306BERKELEYCALIFORNIA300/1200415-548-2121@PPS06272EL
SEGUNDOCALIFORNIA300/1200213-640-8548@PPS06272FULLERTONCALIFORNIA300/1200714-441-2777@PPS06272INGLEWOODCALIFORNIA300/1200213-216-7667@PPS06272ANGELES(DOWNTOWN)CALIFORNIA300/1200213-687-3727@PPS06272LOS
ANGELESCALIFORNIA300/1200213-480-1677@PPS03306MOUNTAIN VIEWCALIFORNIA300/1200415-960-3363@PPS03306OAKLANDCALIFORNIA300/1200415-893-9889@PPS03306PALO
ALTOCALIFORNIA300/1200415-325-4666@PPS06272PASADENACALIFORNIA300/1200818-356-0780@PPS03306SAN
FRANCISCOCALIFORNIA300/1200415-543-8275@PPS03306SAN FRANCISCOCALIFORNIA300/1200415-626-5380@PPS03306SAN
FRANCISCOCALIFORNIA300/1200415-362-2280@PPS03306SAN JOSECALIFORNIA300/1200408-920-0888@PPS06272SANTA
ANNACALIFORNIA300/1200714-972-9844@PPS06272VAN NUYSCALIFORNIA300/1200818-780-1066@PPS@PPS
PACIFIC BELL - NETWORK NAME IS PUBLIC PACKET SWITCHING (PPS) (CONNECT MESSAGE)
. _. _. _< _C _R _ (SYNCHRONIZES DATA SPEEDS) (DOES NOT ECHO TO THE
TERMINAL) ONLINE 1200 WELCOME TO PPS: 415-XXX-XXXX 1 _3 _1 _0 _6 _9 _ (TYMNET
ADDRESS) (DOES NOT ECHO UNTIL TYMNET RESPONDS) -GWY 0XXXX- TYMNET: PLEASE
LOG IN: (HOST # WITHIN DASHES) SOUTHERN NEW ENGLAND NODECITYSTATEDENSITYACCESS
NUMBERSNETWORK02727BRIDGEPORTCONNECTICUT300/2400203/366-6972@CONNNET02727BRISTOLCONNECTICUT300/2400203/589-5100@CONNNET02727CANAANCONNECTICUT300/2400203/824-5103@CONNNET02727CLINTONCONNECTICUT300/2400203/669-4243@CONNNET02727DANBURYCONNECTICUT300/2400203/743-2906@CONNNET02727DANIELSONCONNECTICUT300/2400203/779-1880@CONNNET02727HARTFORD/MIDDLETOWNCONNECTICUT300/2400203/724-6219@CONNNET02727MERIDENCONNECTICUT300/2400203/237-3460@CONNNET02727NEW
HAVENCONNECTICUT300/2400203/776-1142@CONNNET02727NEW LONDONCONNECTICUT300/2400203/443-0884@CONNNET02727NEW
MILFORDCONNECTICUT300/2400203/355-0764@CONNNET02727NORWALKCONNECTICUT300/2400203/866-5305@CONNNET02727OLD
GREDDWICHCONNNETICUT300/2400203/637-8872@CONNNET02727OLD SAYBROOKCONNECTICUT300/2400203/388-0778@CONNNET02727SEYMOURCONNECTICUT300/2400203/881-1455@CONNNET02727STAMFORDCONNECTI3/625-8100@MRLK05443HUTCHINSONKANSAS300/1200316/669-1052@MRLK05443LAWRENCEKANSAS300/1200913/841-5580@MRLK05443MANHATTANKANSAS300/1200913/539-9291@MRLK05443PARSONSKANSAS300/1200316/421-0620@MRLK05443SALINAKANSAS300/1200913/825-4547@MRLK05443TOPEKAKANSAS300/1200913/235-1909@MRLK05443WICHITAKANSAS300/1200316/269-1996@MRLK04766BRIDGETON/ST.
LOUISMISSOURI300/1200314/622-0900@MRLK04766ST. LOUISMISSOURI300/1200314/622-0900@MRLK
On a side note, the recent book The Cuckoo's Egg provides some interesting
information (in the form of a story, however) on a Tymnet hacker. Remember
that he was into BIG things, and hence he was cracked down upon. If you
keep a low profile, networks should provide a good access method. If you
can find a system that is connected to the Internet that you can get on
from Tymnet, you are doing well.
129.Phrack Magazine
- Vol. 3, Issue 30 by Dedicated Link
INTRODUCTION DECWRL is a mail gateway
computer operated by Digital's Western Research Laboratory in Palo Alto,
California. Its purpose is to support the interchange of electronic mail
between Digital and the "outside world." DECWRL is connected to Digital's
Easynet, and also to a number of different outside electronic mail networks.
Digital users can send outside mail by sending to DECWRL::"outside-address",
and digital users can also receive mail by having your correspondents route
it through DECWRL. The details of incoming mail are more complex, and are
discussed below. It is vitally important that Digital employees be good
citizens of the networks to which we are connected. They depend on the
integrity of our user community to ensure that tighter controls over the
use of the gateway are not required. The most important rule is "no chain
letters," but there are other rules depending on whether the connected
network that you are using is commercial or non-commercial. The current
traffic volume (September 1989) is about 10,000 mail messages per day and
about 3,000 USENET messages per day. Gatewayed mail traffic has doubled
every year since 1983. DECWRL is currently a Vax 8530 computer with 48
megabytes of main memory, 2500 megabytes of disk space, 8 9600-baud (Telebit)
modem ports, and various network connections. They will shortly be upgrading
to a Vax 8650 system. They run Ultrix 3.0 as the base operating system.
ADMINISTRATION The gateway has engineering staff, but no administrative
or clerical staff. They work hard to keep it running, but they do not have
the resources to answer telephone queries or provide tutorials in its use.
They post periodic status reports to the USENET newsgroup dec.general.
Various helpful people usually copy these reports to the VAXNOTES "gateways"
conference within a day or two. HOW TO SEND MAIL DECWRL is connected to
quite a number of different mail networks. If you were logged on directly
to it, you could type addresses directly, e.g. To: strange!foreign!address.
But since you are not logged on directly to the gateway, you must send
mail so that when it arrives at the gateway, it will be sent as if that
address had been typed locally. * Sending from VMS If you are a VMS user,
you should use NMAIL, because VMS mail does not know how to requeue and
retry mail when the network is congested or disconnected. From VMS, address
your mail like this: To: nm%DECWRL::"strange!foreign!address" The quote
characters (") are important, to make sure that VMS doesn't try to interpret
strange!foreign!address itself. If you are typing such an address inside
a mail program, it will work as advertised. If you are using DCL and typing
directly to the command line, you should beware that DCL likes to remove
quotes, so you will have to enclose the entire address in quotes, and then
put two quotes in every place that one quote should appear in the address:
$ mail test.msg "nm%DECWRL::""foreign!addr""" /subj="hello" Note the three
quotes in a row after foreign!addr. The first two of them are doubled to
produce a single quote in the address, and the third ends the address itself
(balancing the quote in front of the nm%). Here are some typical outgoing
mail addresses as used from a VMS system: To: nm%DECWRL::"lll-winkin!netsys!phrack"
To: nm%DECWRL::"postmaster@msp.pnet.sc.edu" To: nm%DECWRL::"netsys!phrack@uunet.uu.net"
To: nm%DECWRL::"phrackserv@CUNYVM.bitnet" To: nm%DECWRL::"Chris.Jones@f654.n987.z1.fidonet.org"
* Sending from Ultrix If your Ultrix system has been configured for it,
then you can, from your Ultrix system, just send directly to the foreign
address, and the mail software will take care of all of the gateway routing
for you. Most Ultrix systems in Corporate Research and in the Palo Alto
cluster are configured this way. To find out whether your Ultrix system
has been so configured, just try it and see what happens. If it doesn't
work, you will receive notification almost instantly. NOTE: The Ultrix
mail system is extremely flexible; it is almost completely configurable
by the customer. While this is valuable to customers, it makes it very
difficult to write global instructions for the use of Ultrix mailers, because
it is possible that the local changes have produced something quite unlike
the vendor-delivered mailer. One of the popular changes is to tinker with
the meaning of quote characters (") in Ultrix addresses. Some systems consider
that these two addresses are the same: site1!site2!user@host.dec.com and
"site1!site2!user"@host.dec.com while others are configured so that one
form will work and the other will not. All of these examples use the quotes.
If you have trouble getting the examples to work, please try them again
without the quotes. Perhaps your Ultrix system is interpreting the quotes
differently. If your Ultrix system has an IP link to Palo Alto (type "/etc/ping
decwrl.dec.com" to find out if it does), then you can route your mail to
the gateway via IP. This has the advantage that your Ultrix mail headers
will reach the gateway directly, instead of being translated into DECNET
mail headers and then back into Ultrix at the other end. Do this as follows:
To: "alien!address"@decwrl.dec.com The quotes are necessary only if the
alien address contains a ! character, but they don't hurt if you use them
unnecessarily. If the alien address contains an "@" character, you will
need to change it into a "%" character. For example, to send via IP to
joe@widget.org, you should address the mail. To: "joe%widget.org"@decwrl.dec.com
If your Ultrix system has only a DECNET link to Palo Alto, then you should
address mail in much the same way that VMS users do, save that you should
not put the nm% in front of the address: To: DECWRL::"strange!foreign!address"
Here are some typical outgoing mail addresses as used from an Ultrix system
that has IP access. Ultrix systems without IP access should use the same
syntax as VMS users, except that the nm% at the front of the address should
not be used. To: "lll-winken!netsys!phrack"@decwrl.dec.com To: "postmaster%msp.pnet.sc.edu"@decwrl.dec.com
To: "phrackserv%CUNYVM.bitnet"@decwrl.dec.com To: "netsys!phrack%uunet.uu.net"@decwrl.dec.com
To: "Chris.Jones@f654.n987.z1.fidonet.org"@decwrl.dec.com DETAILS OF USING
OTHER NETWORKS All of the world's computer networks are connected together,
more or less, so it is hard to draw exact boundaries between them. Precisely
where the internet ends and UUCP begins is a matter of interpretation.
For purposes of sending mail, though, it is convenient to divide the network
universe into these categories: Easynet: Digital's internal DECNET network.
Characterized by addresses of the form NODE::USER. Easynet can be used
for commercial purposes. Internet: A collection of networks including the
old ARPAnet, the NSFnet, the CSnet, and others. Most international research,
development, and educational organizations are connected in some fashion
to the Internet. Characterized by addresses of the form user@site.subdomain.domain.
The internet itself cannot be used for commercial purposes. UUCP: A very
primitive network with no management, built with auto-dialers phoning one
computer from another. Characterized by addresses of the form place1!place2!user.
The UUCP network can be used for commercial purposes provided that none
of the sites through which the message is routed objects to that. USENET:
Not a network at all, but a layer of software built on top of UUCP and
Internet. BITNET: An IBM-based network linking primarily educational sites.
Digital users can send to BITNET as if it were part of internet, but BITNET
users need special instructions for reversing the process. BITNET cannot
be used for commercial purposes. Fidonet: A network of personal computers.
I am unsure of the status of using Fidonet for commercial purposes, nor
am I sure of its efficacy. DOMAINS AND DOMAIN ADDRESSING There is a particular
network called "the Internet;" it is somewhat related to what used to be
"the ARPAnet." The Internet style of addressing is flexible enough that
people use it for addressing other networks as well, with the result that
it is quite difficult to look at an address and tell just what network
it is likely to traverse. But the phrase "Internet address" does not mean
"mail address of some computer on the Internet" but rather "mail address
in the style used by the Internet." Terminology is even further confused
because the word "address" means one thing to people who build networks
and something entirely different to people who use them. In this file an
"address" is something like "mike@decwrl.dec.com" and not "192.1.24.177"
(which is what network engineers would call an "internet address"). The
Internet naming scheme uses hierarchical domains, which despite their title
are just a bookkeeping trick. It doesn't really matter whether you say
NODE: :USER or USER@NODE, but what happens when you connect two companies'
networks together and they both have a node ANCHOR?? You must, somehow,
specify which ANCHOR you mean. You could say ANCHOR.DEC::USER or DEC.ANCHOR::USER
or USER@ANCHOR.DEC or USER@DEC.ANCHOR. The Internet convention is to say
USER@ANCHOR.DEC, with the owner (DEC) after the name (ANCHOR). But there
could be several different organizations named DEC. You could have Digital
Equipment Corporation or Down East College or Disabled Education Committee.
The technique that the Internet scheme uses to resolve conflicts like this
is to have hierarchical domains. A normal domain isn't DEC or STANFORD,
but DEC.COM (commercial) and STANFORD.EDU (educational). These domains
can be further divided into ZK3.DEC.COM or CS.STANFORD.EDU. This doesn't
resolve conflicts completely, though: both Central Michigan University
and Carnegie-Mellon University could claim to be CMU.EDU. The rule is that
the owner of the EDU domain gets to decide, just as the owner of the CMU.EDU
gets to decide whether the Electrical Engineering department or the Elementary
Education department gets subdomain EE.CMU.EDU. The domain scheme, while
not perfect, is completely extensible. If you have two addresses that can
potentially conflict, you can suffix some domain to the end of them, thereby
making, say, decwrl.UUCP be somehow different from DECWRL.ENET. DECWRL's
entire mail system is organized according to Internet domains, and in fact
we handle all mail internally as if it were Internet mail. Incoming mail
is converted into Internet mail, and then routed to the appropriate domain;
if that domain requires some conversion, then the mail is converted to
the requirements of the outbound domain as it passes through the gateway.
For example, they put Easynet mail into the domain ENE. On a side note,
the recent book The Cuckoo's Egg provides some interesting information
(in the form of a story, however) on a Tymnet hacker. Remember that he
was into BIG things, and hence he was cracked down upon. If you keep a
low profile, networks should provide a good access method. If you can find
a system that is connected to the Internet that you can get on from Tymnet,
you are doing well. Username@f
130.Sodium Chlorate
by the Jolly Roger
Sodium Chlorate is a strong oxidizer
used in the manufacture of explosives. It can be used in place of Potassium
Chlorate. Material Required: 2 carbon or lead rods (1 in. diameter by 5
in. long) Salt, or ocean water Sulfuric acid, diluted Motor Vehicle Water
2 wires, 16 gauge (3/64 in. diameter approx.), 6 ft. long, insulated. Gasoline
1 gallon glass jar, wide mouth (5 in. diameter by 6 in. high approx.) Sticks
String Teaspoon Trays Cup Heavy cloth Knife Large flat pan or tray Sources
of Carbon or Lead rods: Dry Cell Batteries (2-« in. diameter by 7"
long) or plumbing supply store. Sources of Salt Water: Grocery store or
ocean Sources of Sulfuric Acid: Motor Vehicle Batteries. Procedure: Mix
« cup of salt into the one gallon glass jar with 3 liters (3 quarts)
of water. Add 2 teaspoons of battery acid to the solution and stir vigorously
for 5 minutes. Strip about 4 inches of insulation from both ends of the
two wires. With knife and sticks, shape 2 strips of wood 1 by 1/8 by 1-«.
Tie the wood strips to the lead or carbon rods so that they are 1-«
inches apart. Connect the rods to the battery in a motor vehicle with the
insulated wire. Submerge 4-« inches of the rods in the salt water
solution. With gear in neutral position, start the vehicle engine. Depress
the accelerator approx. 1/5 of its full travel. Run the engine with the
accelerator in this position for 2 hours, then shut it down for 2 hours.
Repeat this cycle for a total of 64 hours while maintaining the level of
the acid-salt water solution in the glass jar. CAUTION: This arrangement
employs voltages which can be quite dangerous! Do not touch bare wire leads
while engine is running!! Shut off the engine. Remove the rods from the
glass jar and disconnect wire leads from the battery. Filter the solution
through the heavy cloth into a flat pan or tray, leaving the sediment at
the bottom of the glass jar. Allow the water in the filtered solution to
evaporate at room temperature (approx. 16 hours). The residue is approximately
60% or more sodium chlorate which is pure enough to be used as an explosive
ingredient.
131.Mercury Fulminate
by the Jolly Roger
Mercury Fulminate is used as a primary
explosive in the fabrication of detonators. It is to be used with a booster
explosive such as picric acid or RDX (which are elsewhere in this Cookbook).
Material Required: Nitric Acid, 90% conc. (1.48 sp. gr) Mercury Ethyl (grain)
alcohol (90%) Filtering material [Paper Towels] Teaspoon measure (¬,
«, and 1 tsp. capacity)-aluminum, stainless steel or wax coated Heat
Source Clean wooden stick Clean water Glass containers Tape Syringe Source
of Nitric Acid: Elsewhere in this Cookbook Industrial metal processors
Source of Mercury: Thermometers Mercury switches Old radio tubes Procedure:
Dilute 5 teaspoons of nitric acid with 2-« teaspoons of clean water
in a glass container by adding the acid to the water. Dissolve 1/8 teaspoon
of mercury in the diluted nitric acid. This will yield dark red fumes.
NOTE: It may be necessary to add water, on drop at a time, to the mercury-acid
solution in order to start a reaction. CAUTION: Acid will burn skin and
destroy clothing. If any is spilled, wash it away with a large quantity
of water. Do NOT inhale fumes! Warm 10 teaspoons of the alcohol in a container
until the alcohol feels warm to the inside of the wrist. Pour the metal-acid
solution into the warm alcohol. Reaction should start in less than 5 minutes.
Dense white fumes will be given off during the reaction. As time lapses,
the fumes will become less dense. Allow 10 to 15 minutes to complete reaction.
Fulminate will settle to the bottom. CAUTION: This reaction generates large
quantities of toxic, flammable fumes. The process MUST be conducted outdoors
or in a well-ventilated area, away from sparks or open flames. DO NOT inhale
fumes! Filter the solution through a paper towel into a container. Crystals
may stick to the side of the container. If so, tilt and squirt water down
the sides of the container until all of the material collects on the filter
paper. Wash the crystals with 6 teaspoons of ethyl alcohol. Allow these
mercury fulminate crystals to air dry. CAUTION: Handle dry explosive with
great care. Do not scrape or handle it roughly! Keep away from sparks or
open flames. Store in a cool, dry place.
132.Improvised
Black Powder by The Jolly Roger
Black powder can be prepared in a simple,
safe manner. It may be used as blasting or gun powder. Materials: Potassium
Nitrate, granulated, 3 cups (3/4 liter) Wood charcoal, powdered, 2 cups
Sulfur, powdered, « cup Alcohol, 5 pints (2-« liters) (whiskey,
rubbing alcohol, etc.) Water, 3 cups (3/4 liter) Heat source 2 buckets
- each 2 gallon (7-« liters) capacity, at least one of which is heat
resistant (metal, ceramic, etc.) Flat window screening, at least 1 foot
(30 cm) square Large wooden stick Cloth, at least 2 feet (60 cm) square
Procedure: Place alcohol in one of the buckets. Place potassium nitrate,
charcoal, and sulfur in the heat resistant bucket. Add 1 cup water and
mix thoroughly with wooden stick until all ingredients are dissolved. Add
remaining water (2 cups) to mixture. Place bucket on heat source and stir
until small bubbles begin to form. CAUTION: DO NOT boil mixture. Be sure
ALL mixture stays wet. If any is dry, as on sides of pan, it may ignite!
Remove bucket from heat and pour mixture into alcohol while stirring vigorously.
Let alcohol mixture stand about 5 minutes. Strain mixture through cloth
to obtain black powder. Discard liquid. Wrap cloth around black powder
and squeeze to remove all excess liquid. Place screening over dry bucket.
Place workable amount of damp powder on screen and granulate by rubbing
solid through screen. NOTE: If granulated particles appear to stick together
and change shape, recombine entire batch of powder and repeat steps 5 &
6. Spread granulated black powder on flat, dry surface so that layer about
« inch (1-¬ cm) is formed. Allow to dry. Use radiator, or direct
sunlight. This should be dried as soon as possible, preferably in an hour.
The longer the drying period, the less effective the black powder. CAUTION:
Remove from heat AS SOON AS granules are dry. Black powder is now ready
to use.
133.Nitric Acid
by The Jolly Roger
Nitric Acid is used in the preparation
of many explosives, incendiary mixtures, and acid delay timers. It may
be prepared by distilling a mixture of potassium nitrate and concentrated
sulfuric acid. Material Required: Potassium Nitrate (2 parts by volume)
CONCENTRATED sulfuric acid (1 part by volume) 2 bottles or ceramin jugs
(narrow necks are preferable) Pot or frying pan Heat source (wood, charcoal,
or coal) Tape (paper, electrical, masking, but NOT cellophane!) Paper or
rags IMPORTANT: If sulfuric acid is obtained from a motor vehicle battery,
concentrate it by boiling it UNTIL white fumes appear. DO NOT INHALE FUMES.
NOTE: The amount of nitric acid produced is the same as the amount of potassium
nitrate. Thus, for two tablespoons of nitric acid, use 2 tablespoons of
potassium nitrate and 1 tablespoonful of concentrated sulfuric acid. Source
of Potassium Nitrate: Elsewhere in this Cookbook Drug stores Source of
CONCENTRATED sulfuric acid: Motor vehicle batteries Industrial plants Procedure:
Place dry potassium nitrate in bottle or jug. Add sulfuric acid. Do not
fill the bottle more than ¬ full. Mix until paste is formed. CAUTION:
DO NOT INHALE FUMES! Wrap paper or rags around necks of two bottles. securely
tape necks of two bottles together. Be sure that bottles are flush against
each other and that there are no air spaces. Support bottles on rocks or
cans so that empty bottle is SLIGHTLY lower than bottle containing paste
so that nitric acid that is formed in receiving bottle will not run into
other bottle. Build fire in pot or frying pan. Gently heat bottle containing
mixture by gently moving fire in and out. As red fumes begin to appear
periodically pour cool water over empty receiving bottle. Nitric acid will
begin to form in receiving bottle. CAUTION: Do not overheat or wet bottle
containing mixture or it may shatter. As an added precaution, place bottle
to be heated in heat resistant container filled with sand or gravel. Heat
this outer container to produce nitric acid. Continue the above process
until no more red fumes are formed. If the nitric acid formed in the receiving
bottle is not clear (cloudy) pour it into cleaned bottle and repeat steps
2-6. CAUTION: Nitric acid should be kept away from all combustibles and
should be kept in a SEALED CERAMIC OR GLASS container. DO NOT inhale fumes!
134.Dust Bomb
Instructions by The Jolly Roger
An initiator which will initiate common
material to produce dust explosions can be rapidly and easily constructed.
This type of charge is ideal for the destruction of enclosed areas such
as rooms or buildings. Material Required: A flat can, 3 in. (8 cm) in diameter
and 1-« in. (3-3/4 cm) high. A 6-« ounce tuna can serves the
purpose quite well. Blasting cap Explosive Aluminum (may be wire, cut sheet,
flattened can, or powder) Large nail, 4 in. (10 cm) long Wooden rod - ¬
in. (6 mm) diameter Flour, gasoline, and powder or chipped aluminum NOTE:
Plastic explosive produce better explosions than cast explosives. Procedure:
Using the nail, press a hole through the side of the tuna can 3/8 inch
to « inch (1 to 1-« cm) from the bottom. Using a rotating and
lever action, enlarge the hole until it will accommodate the blasting cap.
Place the wooden rod in the hole and position the end of the rod at the
center of the can. Press explosive into the can, being sure to surround
the rod, until it is 3/4 inch (2 cm) from the top of the can. Carefully
remove the wooden rod. Place the aluminum metal on top of the explosive.
Just before use, insert the blasting cap into the cavity made by the rod.
The initiator is now ready to use. NOTE: If it is desired to carry the
initiator some distance, cardboard may be pressed on top of the aluminum
to insure against loss of material. How to Use: This particular unit works
quite well to initiate charges of five pounds of flour, « gallon
(1-2/3 liters) of gasoline, or two pounds of flake painters aluminum. The
solid materials may merely be contained in sacks or cardboard cartons.
The gasoline may be placed in plastic coated paper milk cartons, as well
as plastic or glass bottles. The charges are placed directly on top of
the initiator and the blasting cap is actuated electrically or by a fuse
depending on the type of cap employed. this will destroy a 2,000 cubic
feet enclosure (building 10 x 20 x 10 feet). Note: For larger enclosures,
use proportionally larger initiators and charges.
135.Carbon-Tet
Explosive by The Jolly Roger
A moist explosive mixture can be made
from fine aluminum powder combined with carbon tetrachloride or tetrachloroethylene.
This explosive can be detonated with a blasting cap. Material Required:
Fine aluminum bronzing powder Carbon Tetrachloride or Tetrachloroethylene
Stirring rod (wood) Mixing container (bowl, bucket, etc.) Measuring container
(cup, tablespoon, etc.) Storage container (jar, can, etc.) Blasting cap
Pipe, can or jar Source of Carbon Tetrachloride: Paint store Pharmacy Fire
extinguisher fluid Source of Tetrachloroethylene: Dry cleaners Pharmacy
Procedure: Measure out two parts aluminum powder to one part carbon tetrachloride
or tetrachlorethylene liquid into mixing container, adding liquid to powder
while stirring with the wooden rod. Stir until the mixture becomes the
consistency of honey syrup. CAUTION: Fumes from the liquid are dangerous
and should not be inhaled. Store explosive in a jar or similar water proof
container until ready to use. The liquid in the mixture evaporates quickly
when not confined. NOTE: Mixture will detonate in this manner for a period
of 72 hours. How to Use: Pour this mixture into an iron or steel pipe which
has an end cap threaded on one end. If a pipe is not available, you may
use a dry tin can or glass jar. Insert blasting cap just beneath the surface
of the explosive mix. NOTE: Confining the open end of the container will
add to the effectiveness of the explosive.
136.Making Picric
Acid from Aspirin by The Jolly Roger
Picric Acid can be used as a booster
explosive in detonators, a high explosive charge, or as an intermediate
to preparing lead picric. Material Required: Aspirin tablets (5 grains
per tablet) Alcohol, 95% pure Sulfuric acid, concentrated, (if battery
acid, boil until white fumes disappear) Potassium Nitrate (see elsewhere
in this Cookbook) Water Paper towels Canning jar, 1 pint Rod (glass or
wood) Glass containers Ceramic or glass dish Cup Teaspoon Tablespoon Pan
Heat source Tape Procedure: Crush 20 aspirin tablets in a glass container.
Add 1 teaspoon of water and work into a paste. Add approximately 1/3 to
« cup of alcohol (100 milliliters) to the aspirin paste; stir while
pouring. Filter the alcohol-aspirin solution through a paper towel into
another glass container. Discard the solid left in the paper towel. Pour
the filtered solution into a glass or ceramic dish. Evaporate the alcohol
and water from the solution by placing the dish into a pan of hot water.
White powder will remain in the dish after evaporation. NOTE: The water
in the pan should be at hot bath temperature, not boiling, approx 160øF
to 180øF. It should not burn the hands. Pour 1/3 cup (80 milliliters)
of concentrated sulfuric acid into a canning jar. Add the white powder
to the sulfuric acid. Heat canning jar of sulfuric acid in a pan of simmering
hot water bath for 15 minutes; then remove jar from the bath. Solution
will turn to a yellow-orange color. Add 3 level teaspoons (15 grams) of
potassium nitrate in three portions to the yellow-orange solution; stir
vigorously during additions. Solution will turn red, then back to a yellow-orange
color. Allow the solution to cool to ambient room temperature while stirring
occasionally. Slowly pour the solution, while stirring, into 1-¬ cup
(300 milliliters) of cold water and allow to cool. Filter the solution
through a paper towel into a glass container. Light yellow particles will
collect on the paper towel. Wash the light yellow particles with 2 tablespoons
(25 milliliters) of water. Discard the waste liquid in the container. Place
articles in ceramic dish and set in a hot water bath, as in step 5, for
2 hours.
137.Reclamation
of RDX from C-4 Explosives by the Jolly Roger
RDX can be obtained from C-4 explosives
with the use of gasoline. It can be used as a booster explosive for detonators
or as a high explosive charge. Material Required: Gasoline C-4 explosive
2 - pint glass jars, wide mouth Paper towels Stirring rod (glass or wood)
Water Ceramic or glass dish Pan Heat source Teaspoon Cup Tape NOTE: Water,
Ceramic or glass dish, pan, & heat source are all optional. The RDX
can be air dried instead. Procedure: Place 1-« teaspoons (15 grams)
of C-4 explosive in one of the pint jars. Add 1 cup (240 milliliters) of
gasoline. NOTE: These quantities can be increased to obtain more RDX. For
example, use 2 gallons of gasoline per 1 cup of C-4. Knead and stir the
C-4 with the rod until the C-4 has broken down into small particles. Allow
mixture to stand for « hour. Stir the mixture again until a fine
white powder remains on the bottom of the jar. Filter the mixture through
a paper towel into the other glass jar. Wash the particles collected on
the paper towel with « cup (120 milliliters) of gasoline. Discard
the waste liquid. Place the RDX particles in a glass or ceramic dish. Set
the dish in a pan of hot water, not boiling and dry for a period of 1 hour.
NOTE: The RDX particles may be air dried for a period of 2 to 3 hours.
138.Egg-based
Gelled Flame Fuels by The Jolly Roger
The white of any bird egg can be used
to gel gasoline for use as a flame fuel which will adhere to target surfaces.
Materials Required: Parts by VolumeIngredientHow usedCommon Source85GasolineMotor
FuelGas Stations Stove FuelMotor Vehicle Solvent14Egg
WhitesFoodFood Store IndustrialFarms ProcessesAny
one of the following:1Table SaltFoodSea Water IndustrialNatural
Brine ProcessesFood Store3Ground CoffeeFoodCoffee Plant
Food Store3Dried Tea LeavesFoodTea Plant Food Store3CocoaFoodCacao
Tree Food Store2SugarSweeteningSugar Cane FoodsFood
Store1SaltpeterPyrotechnicsNatural(Potassium Nitrate)ExplosivesDeposits
MatchesDrug Store Medicine1Epsom SaltsMedicineNatural
Mineral WaterKisserite IndustrialDrug Store ProcessesFood
Store2Washing SodaWashing CleanerFood Store(Sal Soda)MedicineDrug
Store PhotographyPhoto Supply Store1 «Baking
SodaBakingFood Store BeveragesDrug Store Medicines Mineral
Waters1 «AspirinMedicineDrug Store Food Store
Procedure: CAUTION: Make sure that there are no open flames in the area
when mixing flame fuels! NO SMOKING!! Separate the egg white from the yolk.
This can be done by breaking the egg into a dish and carefully removing
the yolk with a spoon. Pour egg white into a jar, bottle, or other container,
and add gasoline. Add the salt (or other additive) to the mixture and stir
occasionally until gel forms (about 5 to 10 minutes). NOTE: A thicker gelled
flame fuel can be obtained by putting the capped jar in hot (65øC)
water for about « hour and then letting them cool to room temperature.
(DO NOT HEAT THE GELLED FUEL CONTAINING COFFEE!!)
139.Clothespin
Switch by The Jolly Roger
A spring type clothespin is used to
make a circuit closing switch to actuate explosive charges, mines, booby
traps, and alarm systems. Material Required: Spring type clothespin Sold
copper wire -- 1/16 in. (2 mm) in diameter Strong string on wire Flat piece
of wood (roughly 1/8 x 1" x 2") Knife Procedure: Strip four in. (10 cm)
of insulation from the ends of 2 solid copper wires. Scrape the copper
wires with pocket knife until the metal is shiny. Wind one scraped wire
tightly on jaw of the clothespin, and the other wire on the other jaw.
Make a hole in one end of the flat piece of wood using a knife, heated
nail or drill. Tie strong string or wire through the hole. Place flat piece
of wood between the jaws of the clothespin switch. Basic Firing Circuit:
______________ | |---------------------------\ | initiator |----------\
| strong -------------- | | twine | | \ | _---------_________ | ---------
| | \clothespin \ / \ / switch \ / \ / \ / + - ---------- | | | battery|
---------- When the flat piece of wood is removed by pulling the string,
the jaws of the clothespin will close, completing the circuit. CAUTION:
Do not attach the battery until the switch and trip wire have been emplaced
and examined. Be sure that the flat piece of wood is separating the jaws
of the switch.
140.Flexible Plate
Switch by The Jolly Roger
This flexible plate switch is used
for initiating emplaced mines and explosives. Material Required: Two flexible
metal sheets: One approximately 10 in. (25 cm) square One approximately
10 in. x 8 in. (20 cm) Piece of wood 10 in. square x 1 in. thick Four soft
wood blocks 1 in. x 1 in. x ¬ in. Eight flat head nails, 1 in. long
Connecting wires Adhesive tape Procedure: Nail 10 in. by 8 in. metal sheet
to 10 in. square piece of wood so that 1 in. of wood shows on each side
of the metal. Leave one of the nails sticking up about ¬ in. Strip
insulation from the end of one connecting wire. Wrap this end around the
nail and drive the nail all the way in. Place the four wood blocks on the
corners of the wood base. Place the 10 in. square flexible metal sheet
so that it rests on the blocks in line with the wood base. Drive four nails
through the metal sheet and the blocks (1 per block) to fasten the sheet
to the wood base. A second connecting wire is attached to one of the nails
as in step #2. Wrap the adhesive tape around the edges of the plate and
wood base. This will assure that no dirt or other foreign matter will get
between the plates and prevent the switch from operating. How to use: The
switch is placed in a hole in the path of expected traffic and covered
with a thin layer of dirt or other camouflaging material. The mine or other
explosive device connected to the switch can be buried with the switch
or emplaced elsewhere as desired. When a vehicle passes over the switch,
the two metal plates make contact closing the firing circuit.
141.Low Signature
Systems (Silencers) by The Jolly Roger
Low signature systems (silencers) for
improvised small arms weapons can be made from steel gas or water pipe
and fittings. Material Required: Grenade Container Steel pipe nipple, 6
in. (15 cm) long - (see table 1 for diameter) 2 steel pipe couplings -
(see table 2 for dimensions) Cotton cloth - (see table 2) Drill Absorbent
cotton Procedure: Drill hole in grenade container at both ends to fit outside
diameter of pipe nipple. (see table 1) -> /----------------------\ / |
| 2.75 in | ) ( <-holes dia. \ | | -> \-----------------------/ |-----------------------|
5 in. Drill four rows of holes in pipe nipple. Use table 1 for diameter
and location of holes. (Note: I suck at ASCII art!) 6 in. |-----------------------------------|
_____________________________________ ___ | O O O O O O O O O O O O O O
O O O | | C (nom. dia.) ------------------------------------- (size of
hole) | \ / (space between) B (dia.) A Thread one of the pipe couplings
on the drilled pipe nipple. Cut coupling length to allow barrel of weapon
to thread fully into low signature system. Barrel should butt against end
of the drilled pipe nipple. Separate the top half of the grenade container
from the bottom half. Insert the pipe nipple in the drilled hole at the
base of the bottom half of the container. Pack the absorbent cotton inside
the container and around the pipe nipple. Pack the absorbent cotton in
top half of grenade container leaving hole in center. Assemble container
to the bottom half. Thread the other coupling onto the pipe nipple. Note:
A longer container and pipe nipple, with same "A" and "B" dimensions as
those given, will further reduce the signature of the system. How to use:
Thread the low signature system on the selected weapon securely. Place
the proper cotton wad size into the muzzle end of the system (see table
2) Load weapon Weapon is now ready for use TABLE 1 Low Signature System
Dimensions CouplingHoles per4 rows ABCDRowTotal.45
cal3/8in¬in3/8in3/8in1248.38 cal3/8in¬in¬in¬in12489
mm3/8in¬in¬in¬in12487.62 mm3/8in¬in¬in¬in1248.22
cal¬in5/32in1/8*in1/8in1450 * Extra Heavy Pipe TABLE 2 Cotton
Wadding Sizes WeaponCotton Wadding Size.45 cal1-« x 6 inches.38
cal1 x 4 inches9 mm1 x 4 inches7.62 mm1 x 4 inches.22 calNot
needed
142.Delay Igniter
from a Cigarette by The Jolly Roger
A simple and economical (everyone wants
to save money haha) time delay can be made with a common cigarette. Materials
Required: Cigarette Paper match String (shoelace or similar cord) Fuse
cord (improvised or commercial) Procedure: Cut end of fuse cord at a slant
to expose inner core Light cigarette in normal fashion. Place a paper match
so that the had is over exposed end of fuse cord and tie both to the side
of the burning cigarette with string. Position the burning cigarette with
fuse so that it burns freely. A suggested method is to hang the delay on
a twig. Note: Common dry cigarettes burn about 1 inch every 7 or 8 minutes
in still air. (Now I am talking about all except American brands, which
burn about 1 inch every 4-5 minutes) If the fuse cord is place one inch
from the burning end of the cigarette a time delay of 7 or 8 minutes will
result. Delay time will vary depending upon type of cigarette, wind, moisture,
and other atmospheric conditions (get to know your cigarette!) To obtain
accurate delay time, a test run should be made under "use" conditions.
143.Nicotine by
The Jolly Roger
Nicotine is an abundant poison. Easily
found in tobacco products, in concentrated form a few drops can quickly
kill someone. Here is how to concentrate it: First get a can of chewing
tobacco or pipe tobacco. Remove the contents and soak in water overnight
in a jar (about 2/3 cup of water will do...). In the morning, strain into
another jar the mixture through a porous towel. Then wrap the towel around
the ball of tobacco and squeeze it until all of the liquid is in the jar.
Throw away the tobacco--you will not need it anymore. Now you have two
options. I recommend the first. It makes the nicotine more potent. Allow
to evaporate until a sticky syrup results in the jar. This is almost pure
nicotine (hell, it is pure enough for sure!). Heat over low flame until
water is evaporated and a thick sticky syrup results (I don't know how
long it takes... shouldn't take too long, though.). Now all you have to
do, when you wish to use it, is to put a few drops in a medicine dropper
or equivalent, and slip about 4 or 5 drops into the victim's coffee. Coffee
is recommended since it will disguise the taste. Since nicotine is a drug,
the victim should get quite a buzz before they turn their toes up to the
daisies, so to speak. Note: If the syrup is too sticky, dilute it with
a few drops of water. And while you are at it, better add an extra drop
to the coffee just to be sure!
144.Dried Seed
Timer by The Jolly Roger
A time delay device for electrical
firing circuits can be made using the principle of expansion of dried seeds.
Material Required: Dried peas, beans, or other dehydrated seeds Wide-mouth
glass jar with non-metal cap Two screws or bolts Thin metal plate Hand
drill Screwdriver Procedure: Determine the rate of the rise of the dried
seeds selected. This is necessary to determine the delay time of the timer.
Place a sample of the dried seeds in the jar and cover with water. Measure
the time it takes for the seeds to rise a given height. Most dried seeds
increase 50% in one to two hours. Cut a disc from thin metal plate. Disc
should fit loosely inside the jar. NOTE: If metal is painted, rusty, or
otherwise coated, it must be scraped or sanded to obtain a clean metal
surface Drill two holes in the cap of the jar about 2 inches apart. Diameter
of holes should be such that screws or bolts will thread tightly into them.
If the jar has a metal cap or no cap, a piece of wood or plastic (NOT METAL)
can be used as a cover. Turn the two screws or bolts through the holes
in the cap. Bolts should extend about one in. (2 « cm) into the jar.
IMPORTANT: Both bolts must extend the same distance below the container
cover. Pour dried seeds into the container. The level will depend upon
the previously measured rise time and the desired delay. Place the metal
disc in the jar on top of the seeds. How to use: Add just enough water
to completely cover the seeds and place the cap on the jar. Attach connecting
wires from the firing circuit to the two screws on the cap. Expansion of
the seeds will raise the metal disc until it contacts the screws and closes
the circuit.
145.Nail Grenade
by The Jolly Roger
Effective fragmentation grenades can
be made from a block of TNT or other blasting explosive and nails. Material
Required: Block of TNT or other blasting explosive Nails Non-electric (military
or improvised) blasting cap Fuse Cord Tape, string, wire, or glue Procedure:
If an explosive charge other than a standard TNT block is used, make a
hole in the center of the charge for inserting the blasting cap. TNT can
be drilled with relative safety. With plastic explosives, a hole can be
made by pressing a round stick into the center of the charge. The hole
should be deep enough that the blasting cap is totally within the explosive.
Tape, tie, or glue one or two rows of closely packed nails to the sides
of the explosive block. Nails should completely cover the four surfaces
of the block. Place blasting cap on one end of the fuse cord and crimp
with pliers. NOTE: To find out how long the fuse cord should be, check
the time it takes a known length to burn. If 12 inches (30 cm) burns for
30 seconds, a 10 second delay will require a 4 inch (10 cm) fuse. Insert
the blasting cap in the hole in the block of explosive. Tape or tie fuse
cord securely in place so that it will not fall out when the grenade is
thrown. Alternate Use: An effective directional anti-personnel mine can
be made by placing nails on only one side of the explosive block. For the
case, and electric blasting cap can be used.
146.The Bell Glossary
by The Jolly Roger
ACD: Automatic Call Distributor - A
system that automatically distributes calls to operator pools (providing
services such as intercept and directory assistance), to airline ticket
agents, etc. Administration: The tasks of record-keeping, monitoring, rearranging,
prediction need for growth, etc. AIS: Automatic Intercept System - A system
employing an audio-response unit under control of a processor to automatically
provide pertinent info to callers routed to intercept. Alert: To indicate
the existence of an incoming call, (ringing). ANI: Automatic Number Identification
- Often pronounced "Annie," a facility for automatically identify the number
of the calling party for charging purposes. Appearance: A connection upon
a network terminal, as in "the line has two network appearances." Attend:
The operation of monitoring a line or an incoming trunk for off-hook or
seizure, respectively. Audible: The subdued "image" of ringing transmitted
to the calling party during ringing; not derived from the actual ringing
signal in later systems. Backbone Route: The route made up of final-group
trunks between end offices in different regional center areas. BHC: Busy
Hour Calls - The number of calls placed in the busy hour. Blocking: The
ratio of unsuccessful to total attempts to use a facility; expresses as
a probability when computed a priority. Blocking Network: A network that,
under certain conditions, may be unable to form a transmission path from
one end of the network to the other. In general, all networks used within
the Bell Systems are of the blocking type. Blue Box: Equipment used fraudulently
to synthesize signals, gaining access to the toll network for the placement
of calls without charge. BORSCHT Circuit: A name for the line circuit in
the central office. It functions as a mnemonic for the functions that must
be performed by the circuit: Battery, Overvoltage, Ringing, Supervision,
Coding, Hybrid, and Testing. Busy Signal: (Called-line-busy) An audible
signal which, in the Bell System, comprises 480hz and 620hz interrupted
at 60IPM. Bylink: A special high-speed means used in crossbar equipment
for routing calls incoming from a step-by-step office. Trunks from such
offices are often referred to as "bylink" trunks even when incoming to
noncrossbar offices; they are more properly referred to as "dc incoming
trunks." Such high-speed means are necessary to assure that the first incoming
pulse is not lost. Cable Vault: The point which phone cable enters the
Central Office building. CAMA: Centralized Automatic Message Accounting
- Pronounced like Alabama. CCIS: Common Channel Interoffice Signaling -
Signaling information for trunk connections over a separate, nonspeech
data link rather that over the trunks themselves. CCITT: International
Telegraph and Telephone Consultative Committee- An International committee
that formulates plans and sets standards for intercountry communication
means. CDO: Community Dial Office - A small usually rural office typically
served by step-by-step equipment. CO: Central Office - Comprises a switching
network and its control and support equipment. Occasionally improperly
used to mean "office code." Centrex: A service comparable in features to
PBX service but implemented with some (Centrex CU) or all (Centrex CO)
of the control in the central office. In the later case, each station's
loop connects to the central office. Customer Loop: The wire pair connecting
a customer's station to the central office. DDD: Direct Distance Dialing
- Dialing without operator assistance over the nationwide intertoll network.
Direct Trunk Group: A trunk group that is a direct connection between a
given originating and a given terminating office. EOTT: End Office Toll
Trunking - Trunking between end offices in different toll center areas.
ESB: Emergency Service Bureau - A centralized agency to which 911 "universal"
emergency calls are routed. ESS: Electronic Switching System - A generic
term used to identify as a class, stored-program switching systems such
as the Bell System's No.1 No.2, No.3, No.4, or No«. ETS: Electronic
Translation Systems - An electronic replacement for the card translator
in 4A Crossbar systems. Makes use of the SPC 1A Processor. False Start:
An aborted dialing attempt. Fast Busy: (often called reorder) - An audible
busy signal interrupted at twice the rate of the normal busy signal; sent
to the originating station to indicate that the call blocked due to busy
equipment. Final Trunk Group: The trunk group to which calls are routed
when available high-usage trunks overflow; these groups generally "home"
on an office next highest in the hierarchy. Full Group: A trunk group that
does not permit rerouting off-contingent foreign traffic; there are seven
such offices. Glare: The situation that occurs when a two-way trunk is
seized more or less simultaneously at both ends. High Usage Trunk Group:
The appellation for a trunk group that has alternate routes via other similar
groups, and ultimately via a final trunk group to a higher ranking office.
Intercept: The agency (usually an operator) to which calls are routed when
made to a line recently removed from a service, or in some other category
requiring explanation. Automated versions (ASI) with automatic voice response
units are growing in use. Interrupt: The interruption on a phone line to
disconnect and connect with another station, such as an Emergence Interrupt.
Junctor: A wire or circuit connection between networks in the same office.
The functional equivalent to an intraoffice trunk. MF: Multi-Frequency
- The method of signaling over a trunk making use of the simultaneous application
of two out of six possible frequencies. NPA: Numbering Plan Area. ONI:
Operator Number Identification - The use of an operator in a CAMA office
to verbally obtain the calling number of a call originating in an office
not equipped with ANI. PBX: Private Branch Exchange - (PABX: Private Automatic
Branch Exchange) An telephone office serving a private customer, Typically
, access to the outside telephone network is provided. Permanent Signal:
A sustained off-hook condition without activity (no dialing or ringing
or completed connection); such a condition tends to tie up equipment, especially
in earlier systems. Usually accidental, but sometimes used intentionally
by customers in high-crime-rate areas to thwart off burglars. POTS: Plain
Old Telephone Service - Basic service with no extra "frills". ROTL: Remote
Office Test Line - A means for remotely testing trunks. RTA: Remote Trunk
Arrangement - An extension to the TSPS system permitting its services to
be provided up to 200 miles from the TSPS site. SF: Single Frequency. A
signaling method for trunks: 2600hz is impressed upon idle trunks. Supervise:
To monitor the status of a call. SxS: (Step-by-Step or Strowger switch)
- An electromechanical office type utilizing a gross-motion stepping switch
as a combination network and distributed control. Talkoff: The phenomenon
of accidental synthesis of a machine-intelligible signal by human voice
causing an unintended response. "whistling a tone". Trunk: A path between
central offices; in general 2-wire for interlocal, 4-wire for intertoll.
TSPS: Traffic Service Position System - A system that provides, under stored-program
control, efficient operator assistance for toll calls. It does not switch
the customer, but provides a bridge connection to the operator. X-bar:
(Crossbar) - An electromechanical office type utilizing a "fine-motion"
coordinate switch and a multiplicity of central controls (called markers).
There are four varieties: No.1 Crossbar: Used in large urban office application;
(1938) No.3 Crossbar: A small system started in (1974). No.4A/4M Crossbar:
A 4-wire toll machine; (1943). No« Crossbar: A machine originally
intended for relatively small suburban applications; (1948) Crossbar Tandem:
A machine used for interlocal office switching. 147.Phone Dial Locks --
How to Beat'em by The Jolly Roger Have you ever been in an office or somewhere
and wanted to make a free phone call but some asshole put a lock on the
phone to prevent out-going calls? Fret no more phellow phreak, for every
system can be beaten with a little knowledge! There are two ways to beat
this obstacle, first pick the lock, I don't have the time to teach locksmithing
so we go to the second method which takes advantage of telephone electronics.
To be as simple as possible when you pick up the phone you complete a circuit
known as a local loop. When you hang up you break the circuit. When you
dial (pulse) it also breaks the circuit but not long enough to hang up!
So you can "Push-dial." To do this you >>> RAPIDLY <<< depress
the switchhook. For example, to dial an operator (and then give her the
number you want to call) >>> RAPIDLY <<< & >>> EVENLY <<<
depress the switchhook 10 times. To dial 634-1268, depress 6 X'S pause,
then 3 X'S, pause, then 4X'S, etc. It takes a little practice but you'll
get the hang of it. Try practicing with your own # so you'll get a busy
tone when right. It'll also work on touch-tone since a DTMF line will
also accept pulse. Also, never depress the switchhook for more than a second
or it'll hang up! Finally, remember that you have just as much right to
that phone as the asshole who put the lock on it! 148.Exchange Scanning
by The Jolly Roger Almost every exchange in the bell system has test #'s
and other "goodies" such as loops with dial-ups. These "goodies" are usually
found between 9900 and 9999 in your local exchange. If you have the time
and initiative, scan your exchange and you may become lucky! Here are some
findings in the 914-268 exchange: 9900 - ANI 9901 - ANI 9927 - OSC. TONE
(POSSIBLE TONE SIDE OF A LOOP) 9936 - VOICE # TO THE TELCO CENTRAL OFFICE
9937 - VOICE # TO THE TELCO CENTRAL OFFICE 9941 - COMPUTER (DIGITAL VOICE
TRANSMISSION?) 9960 - OSC. TONE (TONE SIDE LOOP) MAY ALSO BE A COMPUTER
IN SOME EXCHANGES 9961 - NO RESPONSE (OTHER END OF LOOP?) 9962 - NO RESPONSE
(OTHER END OF LOOP?) 9963 - NO RESPONSE (OTHER END OF LOOP?) 9966 - COMPUTER
(SEE 9941) 9968 - TONE THAT DISAPPEARS--RESPONDS TO CERTAIN TOUCH-TONE
KEYS Most of the numbers between 9900 & 9999 will ring or go to a "what
#, please?" operator.
149.A Short History
of Phreaking by The Jolly Roger
Well now we know a little vocabulary,
and now its into history, Phreak history. Back at MIT in 1964 arrived a
student by the name of Stewart Nelson, who was extremely interested in
the telephone. Before entering MIT, he had built autodialers, cheese boxes,
and many more gadgets. But when he came to MIT he became even more interested
in "fone-hacking" as they called it. After a little while he naturally
started using the PDP-1, the schools computer at that time, and from there
he decided that it would be interesting to see whether the computer could
generate the frequencies required for blue boxing. The hackers at MIT were
not interested in ripping off Ma Bell, but just exploring the telephone
network. Stew (as he was called) wrote a program to generate all the tones
and set off into the vast network. Now there were more people phreaking
than the ones aerviewed several times (as you'll soon see). Well he finally
got caught after a long adventurous career. After he was caught he was
put in jail and was beaten up quite badly because he would not teach other
inmates how to box calls. After getting out, he joined Apple computer and
is still out there somewhere. Then there was Joe the Whistler, blind form
the day he was born. He could whistle a perfect 2600hz tone. It was rumored
phreaks used to call him to tune their boxes. Well that was up to about
1970, then from 1970 to 1979, phreaking was mainly done by college students,
businessmen and anyone who knew enough about electronics and the fone company
to make a 555 Ic to generate those magic tones. Businessmen and a few college
students mainly just blue box to get free calls. The others were still
there, exploring 800#'s and the new ESS systems. ESS posed a big problem
for phreaks then and even a bigger one now. ESS was not widespread, but
where it was, blue boxing was next to impossible except for the most experienced
phreak. Today ESS is installed in almost all major cities and blue boxing
is getting harder and harder. 1978 marked a change in phreaking, the Apple
][, now a computer that was affordable, could be programmed, and could
save all that precious work on a cassette. Then just a short while later
came the Apple Cat modem. With this modem, generating all blue box tones
was easy as writing a program to count form one to ten (a little exaggerated).
Pretty soon programs that could imitate an operator just as good as the
real thing were hitting the community, TSPS and Cat's Meow, are the standard
now and are the best. 1982-1986: LD services were starting to appear in
mass numbers. People now had programs to hack LD services, telephone exchanges,
and even passwords. By now many phreaks were getting extremely good and
BBS's started to spring up everywhere, each having many documentations
on phreaking for the novice. Then it happened, the movie War Games was
released and mass numbers of sixth grade to all ages flocked to see it.
The problem wasn't that the movie was bad, it was that now EVERYONE wanted
to be a hacker/phreak. Novices came out in such mass numbers, that bulletin
boards started to be busy 24 hours a day. To this day, they still have
not recovered. Other problems started to occur, novices guessed easy passwords
on large government computers and started to play around... Well it wasn't
long before they were caught, I think that many people remember the 414-hackers.
They were so stupid as to say "yes" when the computer asked them whether
they'd like to play games. Well at least it takes the heat off the real
phreaks/hacker/crackers.
150. "Secrets
of the Little Blue Box" by Ron Rosenbaum Dudes...
These four files contain the story,
"Secrets of the Little Blue Box". -A story so incredible it may even make
you feel sorry for the phone company- Printed in the October 1971 issue
of Esquire Magazine. If you happen to be in a library and come across a
collection of Esquire magazines, the October 1971 issue is the first issue
printed in the smaller format. The story begins on page 116 with a picture
of a blue box. --One Farad Cap, Atlantic Anarchist Guild The Blue Box Is
Introduced: Its Qualities Are Remarked I am in the expensively furnished
living room of Al Gilbertson (His real name has been changed.), the creator
of the "blue box." Gilbertson is holding one of his shiny black-and-silver
"blue boxes" comfortably in the palm of his hand, pointing out the thirteen
little red push buttons sticking up from the console. He is dancing his
fingers over the buttons, tapping out discordant beeping electronic jingles.
He is trying to explain to me how his little blue box does nothing less
than place the entire telephone system of the world, satellites, cables
and all, at the service of the blue-box operator, free of charge. "That's
what it does. Essentially it gives you the power of a super operator. You
seize a tandem with this top button," he presses the top button with his
index finger and the blue box emits a high-pitched cheep, "and like that"
-- cheep goes the blue box again -- "you control the phone company's long-distance
switching systems from your cute little Princes phone or any old pay phone.
And you've got anonymity. An operator has to operate from a definite location:
the phone company knows where she is and what she's doing. But with your
beeper box, once you hop onto a trunk, say from a Holiday Inn 800 (toll-free)
number, they don't know where you are, or where you're coming from, they
don't know how you slipped into their lines and popped up in that 800 number.
They don't even know anything illegal is going on. And you can obscure
your origins through as many levels as you like. You can call next door
by way of White Plains, then over to Liverpool by cable, and then back
here by satellite. You can call yourself from one pay phone all the way
around the world to a pay phone next to you. And you get your dime back
too." "And they can't trace the calls? They can't charge you?" "Not if
you do it the right way. But you'll find that the free-call thing isn't
really as exciting at first as the feeling of power you get from having
one of these babies in your hand. I've watched people when they first get
hold of one of these things and start using it, and discover they can make
connections, set up crisscross and zigzag switching patterns back and forth
across the world. They hardly talk to the people they finally reach. They
say hello and start thinking of what kind of call to make next. They go
a little crazy." He looks down at the neat little package in his palm.
His fingers are still dancing, tapping out beeper patterns. "I think it's
something to do with how small my models are. There are lots of blue boxes
around, but mine are the smallest and most sophisticated electronically.
I wish I could show you the prototype we made for our big syndicate order."
He sighs. "We had this order for a thousand beeper boxes from a syndicate
front man in Las Vegas. They use them to place bets coast to coast, keep
lines open for hours, all of which can get expensive if you have to pay.
The deal was a thousand blue boxes for $300 apiece. Before then we retailed
them for $1500 apiece, but $300,000 in one lump was hard to turn down.
We had a manufacturing deal worked out in the Philippines. Everything ready
to go. Anyway, the model I had ready for limited mass production was small
enough to fit inside a flip-top Marlboro box. It had flush touch panels
for a keyboard, rather than these unsightly buttons, sticking out. Looked
just like a tiny portable radio. In fact, I had designed it with a tiny
transistor receiver to get one AM channel, so in case the law became suspicious
the owner could switch on the radio part, start snapping his fingers, and
no one could tell anything illegal was going on. I thought of everything
for this model -- I had it lined with a band of thermite which could be
ignited by radio signal from a tiny button transmitter on your belt, so
it could be burned to ashes instantly in case of a bust. It was beautiful.
A beautiful little machine. You shouldve seen the faces on these syndicate
guys when they came back after trying it out. They'd hold it in their palm
like they never wanted to let it go, and they'd say, 'I can't believe it.
I can't believe it.' You probably won't believe it until you try it." The
Blue Box Is Tested: Certain Connections Are Made About eleven o'clock two
nights later Fraser Lucey has a blue box in the palm of his left hand and
a phone in the palm of his right. He is standing inside a phone booth next
to an isolated shut-down motel off Highway 1. I am standing outside the
phone booth. Fraser likes to show off his blue box for people. Until a
few weeks ago when Pacific Telephone made a few arrests in his city, Fraser
Lucey liked to bring his blue box (This particular blue box, like most
blue boxes, is not blue. Blue boxes have come to be called "blue boxes"
either because 1) The first blue box ever confiscated by phone-company
security men happened to be blue, or 2) To distinguish them from "black
boxes." Black boxes are devices, usually a resistor in series, which, when
attached to home phones, allow all incoming calls to be made without charge
to one's caller.) to parties. It never failed: A few cheeps from his device
and Fraser became the center of attention at the very hippest of gatherings,
playing phone tricks and doing request numbers for hours. He began to take
orders for his manufacturer in Mexico. He became a dealer. Fraser is cautious
now about where he shows off his blue box. But he never gets tired of playing
with it. "It's like the first time every time," he tells me. Fraser puts
a dime in the slot. He listens for a tone and holds the receiver up to
my ear. I hear the tone. Fraser begins describing, with a certain practiced
air, what he does while he does it. "I'm dialing an 800 number now. Any
800 number will do. It's toll free. Tonight I think I'll use the -----
(he names a well-know rent-a-car company) 800 number. Listen, It's ringing.
Here, you hear it? Now watch." He places the blue box over the mouthpiece
of the phone so that the one silver and twelve black push buttons are facing
up toward me. He presses the silver button -- the one at the top -- and
I hear that high-pitched beep. "That's 2600 cycles per second to be exact,"
says Lucey. "Now, quick. Listen." He shoves the earpiece at me. The ringing
has vanished. The line gives a slight hiccough, there is a sharp buzz,
and then nothing but soft white noise. "We're home free now," Lucey tells
me, taking back the phone and applying the blue box to its mouthpiece once
again. "We're up on a tandem, into a long-lines trunk. Once you're up on
a tandem, you can send yourself anywhere you want to go." He decides to
check out London first. He chooses a certain pay phone located in Waterloo
Station. This particular pay phone is popular with the phone-phreaks network
because there are usually people walking by at all hours who will pick
it up and talk for a while. He presses the lower left-hand corner button
which is marked "KP" on the face of the box. "That's Key Pulse. It tells
the tandem we're ready to give it instructions. First I'll punch out KP
182 START, which will slide us into the overseas sender in White Plains."
I hear a neat clunk-cheep. "I think we'll head over to England by satellite.
Cable is actually faster and the connection is somewhat better, but I like
going by satellite. So I just punch out KP Zero 44. The Zero is supposed
to guarantee a satellite connection and 44 is the country code for England.
Okay... we're there. In Liverpool actually. Now all I have to do is punch
out the London area code which is 1, and dial up the pay phone. Here, listen,
I've got a ring now." I hear the soft quick purr-purr of a London ring.
Then someone picks up the phone. "Hello," says the London voice. "Hello.
Who's this?" Fraser asks. "Hello. There's actually nobody here. I just
picked this up while I was passing by. This is a public phone. There's
no one here to answer actually." "Hello. Don't hang up. I'm calling from
the United States." "Oh. What is the purpose of the call? This is a public
phone you know." "Oh. You know. To check out, uh, to find out what's going
on in London. How is it there?" "Its five o'clock in the morning. It's
raining now." "Oh. Who are you?" The London passerby turns out to be an
R.A.F. enlistee on his way back to the base in Lincolnshire, with a terrible
hangover after a thirty-six-hour pass. He and Fraser talk about the rain.
They agree that it's nicer when it's not raining. They say good-bye and
Fraser hangs up. His dime returns with a nice clink. "Isn't that far out,"
he says grinning at me. "London, like that." Fraser squeezes the little
blue box affectionately in his palm. "I told ya this thing is for real.
Listen, if you don't mind I'm gonna try this girl I know in Paris. I usually
give her a call around this time. It freaks her out. This time I'll use
the ------ (a different rent-a-car company) 800 number and we'll go by
overseas cable, 133; 33 is the country code for France, the 1 sends you
by cable. Okay, here we go.... Oh damn. Busy. Who could she be talking
to at this time?" A state police car cruises slowly by the motel. The car
does not stop, but Fraser gets nervous. We hop back into his car and drive
ten miles in the opposite direction until we reach a Texaco station locked
up for the night. We pull up to a phone booth by the tire pump. Fraser
dashes inside and tries the Paris number. It is busy again. "I don't understand
who she could be talking to. The circuits may be busy. It's too bad I haven't
learned how to tap into lines overseas with this thing yet." Fraser begins
to phreak around, as the phone phreaks say. He dials a leading nationwide
charge card's 800 number and punches out the tones that bring him the time
recording in Sydney, Australia. He beeps up the weather recording in Rome,
in Italian of course. He calls a friend in Boston and talks about a certain
over-the-counter stock they are into heavily. He finds the Paris number
busy again. He calls up "Dial a Disc" in London, and we listen to Double
Barrel by David and Ansil Collins, the number-one hit of the week in London.
He calls up a dealer of another sort and talks in code. He calls up Joe
Engressia, the original blind phone-phreak genius, and pays his respects.
There are other calls. Finally Fraser gets through to his young lady in
Paris. They both agree the circuits must have been busy, and criticize
the Paris telephone system. At two-thirty in the morning Fraser hangs up,
pockets his dime, and drives off, steering with one hand, holding what
he calls his "lovely little blue box" in the other. You Can Call Long Distance
For Less Than You Think "You see, a few years ago the phone company made
one big mistake," Gilbertson explains two days later in his apartment.
"They were careless enough to let some technical journal publish the actual
frequencies used to create all their multi-frequency tones. Just a theoretical
article some Bell Telephone Laboratories engineer was doing about switching
theory, and he listed the tones in passing. At ----- (a well-known technical
school) I had been fooling around with phones for several years before
I came across a copy of the journal in the engineering library. I ran back
to the lab and it took maybe twelve hours from the time I saw that article
to put together the first working blue box. It was bigger and clumsier
than this little baby, but it worked." It's all there on public record
in that technical journal written mainly by Bell Lab people for other telephone
engineers. Or at least it was public. "Just try and get a copy of that
issue at some engineering-school library now. Bell has had them all red-tagged
and withdrawn from circulation," Gilbertson tells me. "But it's too late.
It's all public now. And once they became public the technology needed
to create your own beeper device is within the range of any twelve-year-old
kid, any twelve-year-old blind kid as a matter of fact. And he can do it
in less than the twelve hours it took us. Blind kids do it all the time.
They can't build anything as precise and compact as my beeper box, but
theirs can do anything mine can do." "How?" "Okay. About twenty years ago
AT&T. made a multi-billion-dollar decision to operate its entire long-distance
switching system on twelve electronically generated combinations of twelve
master tones. Those are the tones you sometimes hear in the background
after you've dialed a long-distance number. They decided to use some very
simple tones -- the tone for each number is just two fixed single-frequency
tones played simultaneously to create a certain beat frequency. Like 1300
cycles per second and 900 cycles per second played together give you the
tone for digit 5. Now, what some of these phone phreaks have done is get
themselves access to an electric organ. Any cheap family home-entertainment
organ. Since the frequencies are public knowledge now -- one blind phone
phreak has even had them recorded in one of the talking books for the blind
-- they just have to find the musical notes on the organ which correspond
to the phone tones. Then they tape them. For instance, to get Ma Bell's
tone for the number 1, you press down organ keys F~5 and A~5 (900 and 700
cycles per second) at the same time. To produce the tone for 2 it's F~5
and C~6 (1100 and 700 cps). The phone phreaks circulate the whole list
of notes so there's no trial and error anymore." He shows me a list of
the rest of the phone numbers and the two electric organ keys that produce
them. "Actually, you have to record these notes at 3 3/4 inches-per-second
tape speed and double it to 7 « inches-per-second when you play them
back, to get the proper tones," he adds. "So once you have all the tones
recorded, how do you plug them into the phone system?" "Well, they take
their organ and their cassette recorder, and start banging out entire phone
numbers in tones on the organ, including country codes, routing instructions,
'KP' and 'Start' tones. Or, if they don't have an organ, someone in the
phone-phreak network sends them a cassette with all the tones recorded,
with a voice saying 'Number one,' then you have the tone, 'Number two,'
then the tone and so on. So with two cassette recorders they can put together
a series of phone numbers by switching back and forth from number to number.
Any idiot in the country with a cheap cassette recorder can make all the
free calls he wants." "You mean you just hold the cassette recorder up
the mouthpiece and switch in a series of beeps you've recorded? The phone
thinks that anything that makes these tones must be its own equipment?"
"Right. As long as you get the frequency within thirty cycles per second
of the phone company's tones, the phone equipment thinks it hears its own
voice talking to it. The original granddaddy phone phreak was this blind
kid with perfect pitch, Joe Engressia, who used to whistle into the phone.
An operator could tell the difference between his whistle and the phone
company's electronic tone generator, but the phone company's switching
circuit can't tell them apart. The bigger the phone company gets and the
further away from human operators it gets, the more vulnerable it becomes
to all sorts of phone phreaking." A Guide for the Perplexed "But wait a
minute," I stop Gilbertson. "If everything you do sounds like phone-company
equipment, why doesn't the phone company charge you for the call the way
it charges its own equipment?" "Okay. That's where the 2600-cycle tone
comes in. I better start from the beginning." The beginning he describes
for me is a vision of the phone system of the continent as thousands of
webs, of long-line trunks radiating from each of the hundreds of toll switching
offices to the other toll switching offices. Each toll switching office
is a hive compacted of thousands of long-distance tandems constantly whistling
and beeping to tandems in far-off toll switching offices. The tandem is
the key to the whole system. Each tandem is a line with some relays with
the capability of signaling any other tandem in any other toll switching
office on the continent, either directly one-to-one or by programming a
roundabout route through several other tandems if all the direct routes
are busy. For instance, if you want to call from New York to Los Angeles
and traffic is heavy on all direct trunks between the two cities, your
tandem in New York is programmed to try the next best route, which may
send you down to a tandem in New Orleans, then up to San Francisco, or
down to a New Orleans tandem, back to an Atlanta tandem, over to an Albuquerque
tandem and finally up to Los Angeles. When a tandem is not being used,
when it's sitting there waiting for someone to make a long-distance call,
it whistles. One side of the tandem, the side "facing" your home phone,
whistles at 2600 cycles per second toward all the home phones serviced
by the exchange, telling them it is at their service, should they be interested
in making a long-distance call. The other side of the tandem is whistling
2600 cps. into one or more long-distance trunk lines, telling the rest
of the phone system that it is neither sending nor receiving a call through
that trunk at the moment, that it has no use for that trunk at the moment.
"When you dial a long-distance number the first thing that happens is that
you are hooked into a tandem. A register comes up to the side of the tandem
facing away from you and presents that side with the number you dialed.
This sending side of the tandem stops whistling 2600 into its trunk line.
When a tandem stops the 2600 tone it has been sending through a trunk,
the trunk is said to be "seized," and is now ready to carry the number
you have dialed -- converted into multi-frequency beep tones -- to a tandem
in the area code and central office you want. Now when a blue-box operator
wants to make a call from New Orleans to New York he starts by dialing
the 800 number of a company which might happen to have its headquarters
in Los Angeles. The sending side of the New Orleans tandem stops sending
2600 out over the trunk to the central office in Los Angeles, thereby seizing
the trunk. Your New Orleans tandem begins sending beep tones to a tandem
it has discovered idly whistling 2600 cycles in Los Angeles. The receiving
end of that LA tandem is seized, stops whistling 2600, listens to the beep
tones which tell it which LA phone to ring, and starts ringing the 800
number. Meanwhile a mark made in the New Orleans office accounting tape
notes that a call from your New Orleans phone to the 800 number in LA has
been initiated and gives the call a code number. Everything is routine
so far. But then the phone phreak presses his blue box to the mouthpiece
and pushes the 2600-cycle button, sending 2600 out from the New Orleans
tandem to the LA tandem. The LA tandem notices 2600 cycles are coming over
the line again and assumes that New Orleans has hung up because the trunk
is whistling as if idle. The LA tandem immediately ceases ringing the LA
800 number. But as soon as the phreak takes his finger off the 2600 button,
the LA tandem assumes the trunk is once again being used because the 2600
is gone, so it listens for a new series of digit tones - to find out where
it must send the call. Thus the blue-box operator in New Orleans now is
in touch with a tandem in LA which is waiting like an obedient genie to
be told what to do next. The blue-box owner then beeps out the ten digits
of the New York number which tell the LA tandem to relay a call to New
York City. Which it promptly does. As soon as your party picks up the phone
in New York, the side of the New Orleans tandem facing you stops sending
2600 cycles to you and starts carrying his voice to you by way of the LA
tandem. A notation is made on the accounting tape that the connection has
been made on the 800 call which had been initiated and noted earlier. When
you stop talking to New York a notation is made that the 800 call has ended.
At three the next morning, when the phone company's accounting computer
starts reading back over the master accounting tape for the past day, it
records that a call of a certain length of time was made from your New
Orleans home to an LA 800 number and, of course, the accounting computer
has been trained to ignore those toll-free 800 calls when compiling your
monthly bill. "All they can prove is that you made an 800 toll-free call,"
Gilbertson the inventor concludes. "Of course, if you're foolish enough
to talk for two hours on an 800 call, and they've installed one of their
special anti-fraud computer programs to watch out for such things, they
may spot you and ask why you took two hours talking to Army Recruiting's
800 number when you're 4-F. But if you do it from a pay phone, they may
discover something peculiar the next day -- if they've got a blue-box hunting
program in their computer -- but you'll be a long time gone from the pay
phone by then. Using a pay phone is almost guaranteed safe." "What about
the recent series of blue-box arrests all across the country -- New York,
Cleveland, and so on?" I asked. "How were they caught so easily?" "From
what I can tell, they made one big mistake: they were seizing trunks using
an area code plus 555-1212 instead of an 800 number. Using 555 is easy
to detect because when you send multi-frequency beep tones of 555 you get
a charge for it on your tape and the accounting computer knows there's
something wrong when it tries to bill you for a two-hour call to Akron,
Ohio, information, and it drops a trouble card which goes right into the
hands of the security agent if they're looking for blue-box user. "Whoever
sold those guys their blue boxes didn't tell them how to use them properly,
which is fairly irresponsible. And they were fairly stupid to use them
at home all the time. "But what those arrests really mean is than an awful
lot of blue boxes are flooding into the country and that people are finding
them so easy to make that they know how to make them before they know how
to use them. Ma Bell is in trouble." And if a blue-box operator or a cassette-recorder
phone phreak sticks to pay phones and 800 numbers, the phone company can't
stop them? "Not unless they change their entire nationwide long-lines technology,
which will take them a few billion dollars and twenty years. Right now
they can't do a thing. They're screwed." Captain Crunch Demonstrates His
Famous Unit There is an underground telephone network in this country.
Gilbertson discovered it the very day news of his activities hit the papers.
That evening his phone began ringing. Phone phreaks from Seattle, from
Florida, from New York, from San Jose, and from Los Angeles began calling
him and telling him about the phone-phreak network. He'd get a call from
a phone phreak who'd say nothing but, "Hang up and call this number." When
he dialed the number he'd find himself tied into a conference of a dozen
phone phreaks arranged through a quirky switching station in British Columbia.
They identified themselves as phone phreaks, they demonstrated their homemade
blue boxes which they called "M-Fers" (for "multi-frequency," among other
things) for him, they talked shop about phone-phreak devices. They let
him in on their secrets on the theory that if the phone company was after
him he must be trustworthy. And, Gilbertson recalls, they stunned him with
their technical sophistication. I ask him how to get in touch with the
phone-phreak network. He digs around through a file of old schematics and
comes up with about a dozen numbers in three widely separated area codes.
"Those are the centers," he tells me. Alongside some of the numbers he
writes in first names or nicknames: names like Captain Crunch, Dr. No,
Frank Carson (also a code word for a free call), Marty Freeman (code word
for M-F device), Peter Perpendicular Pimple, Alefnull, and The Cheshire
Cat. He makes checks alongside the names of those among these top twelve
who are blind. There are five checks. I ask him who this Captain Crunch
person is. "Oh. The Captain. He's probably the most legendary phone phreak.
He calls himself Captain Crunch after the notorious Cap'n Crunch 2600 whistle."
(Several years ago, Gilbertson explains, the makers of Cap'n Crunch breakfast
cereal offered a toy-whistle prize in every box as a treat for the Cap'n
Crunch set. Somehow a phone phreak discovered that the toy whistle just
happened to produce a perfect 2600-cycle tone. When the man who calls himself
Captain Crunch was transferred overseas to England with his Air Force unit,
he would receive scores of calls from his friends and "mute" them -- make
them free of charge to them -- by blowing his Cap'n Crunch whistle into
his end.) "Captain Crunch is one of the older phone phreaks," Gilbertson
tells me. "He's an engineer who once got in a little trouble for fooling
around with the phone, but he can't stop. Well, the guy drives across country
in a Volkswagen van with an entire switchboard and a computerized super-sophisticated
M-F-er in the back. He'll pull up to a phone booth on a lonely highway
somewhere, snake a cable out of his bus, hook it onto the phone and sit
for hours, days sometimes, sending calls zipping back and forth across
the country, all over the world...." Back at my motel, I dialed the number
he gave me for "Captain Crunch" and asked for G---- T-----, his real name,
or at least the name he uses when he's not dashing into a phone booth beeping
out M-F tones faster than a speeding bullet and zipping phantomlike through
the phone company's long-distance lines. When G---- T----- answered the
phone and I told him I was preparing a story for Esquire about phone phreaks,
he became very indignant. "I don't do that. I don't do that anymore at
all. And if I do it, I do it for one reason and one reason only. I'm learning
about a system. The phone company is a System. A computer is a System,
do you understand? If I do what I do, it is only to explore a system. Computers,
systems, that's my bag. The phone company is nothing but a computer." A
tone of tightly restrained excitement enters the Captain's voice when he
starts talking about systems. He begins to pronounce each syllable with
the hushed deliberation of an obscene caller. "Ma Bell is a system I want
to explore. It's a beautiful system, you know, but Ma Bell screwed up.
It's terrible because Ma Bell is such a beautiful system, but she screwed
up. I learned how she screwed up from a couple of blind kids who wanted
me to build a device. A certain device. They said it could make free calls.
I wasn't interested in free calls. But when these blind kids told me I
could make calls into a computer, my eyes lit up. I wanted to learn about
computers. I wanted to learn about Ma Bell's computers. So I build the
little device, but I built it wrong and Ma Bell found out. Ma Bell can
detect things like that. Ma Bell knows. So I'm strictly rid of it now.
I don't do it. Except for learning purposes." He pauses. "So you want to
write an article. Are you paying for this call? Hang up and call this number."
He gives me a number in a area code a thousand miles away of his own. I
dial the number. "Hello again. This is Captain Crunch. You are speaking
to me on a toll-free loop-around in Portland, Oregon. Do you know what
a toll-free loop around is? I'll tell you." He explains to me that almost
every exchange in the country has open test numbers which allow other exchanges
to test their connections with it. Most of these numbers occur in consecutive
pairs, such as 302 956-0041 and 302 956-0042. Well, certain phone phreaks
discovered that if two people from anywhere in the country dial the two
consecutive numbers they can talk together just as if one had called the
other's number, with no charge to either of them, of course. "Now our voice
is looping around in a 4A switching machine up there in Canada, zipping
back down to me," the Captain tells me. "My voice is looping around up
there and back down to you. And it can't ever cost anyone money. The phone
phreaks and I have compiled a list of many of these numbers. You would
be surprised if you saw the list. I could show it to you. But I won't.
I'm out of that now. I'm not out to screw Ma Bell. I know better. If I
do anything it's for the pure knowledge of the System. You can learn to
do fantastic things. Have you ever heard eight tandems stacked up? Do you
know the sound of tandems stacking and unstacking? Give me your phone number.
Okay. Hang up now and wait a minute." Slightly less than a minute later
the phone rang and the Captain was on the line, his voice sounding far
more excited, almost aroused. "I wanted to show you what it's like to stack
up tandems. To stack up tandems." (Whenever the Captain says "stack up"
it sounds as if he is licking his lips.) "How do you like the connection
you're on now?" the Captain asks me. "It's a raw tandem. A raw tandem.
Ain't nothing' up to it but a tandem. Now I'm going to show you what it's
like to stack up. Blow off. Land in a far away place. To stack that tandem
up, whip back and forth across the country a few times, then shoot on up
to Moscow. "Listen," Captain Crunch continues. "Listen. I've got line tie
on my switchboard here, and I'm gonna let you hear me stack and unstack
tandems. Listen to this. It's gonna blow your mind." First I hear a super
rapid-fire pulsing of the flutelike phone tones, then a pause, then another
popping burst of tones, then another, then another. Each burst is followed
by a beep-kachink sound. "We have now stacked up four tandems," said Captain
Crunch, sounding somewhat remote. "That's four tandems stacked up. Do you
know what that means? That means I'm whipping back and forth, back and
forth twice, across the country, before coming to you. I've been known
to stack up twenty tandems at a time. Now, just like I said, I'm going
to shoot up to Moscow." There is a new, longer series of beeper pulses
over the line, a brief silence, then a ring. "Hello," answers a far-off
voice. "Hello. Is this the American Embassy Moscow?" "Yes, sir. Who is
this calling?" says the voice. "Yes. This is test board here in New York.
We're calling to check out the circuits, see what kind of lines you've
got. Everything okay there in Moscow?" "Okay?" "Well, yes, how are things
there?" "Oh. Well, everything okay, I guess." "Okay. Thank you." They hang
up, leaving a confused series of beep-kachink sounds hanging in mid-ether
in the wake of the call before dissolving away. The Captain is pleased.
"You believe me now, don't you? Do you know what I'd like to do? I'd just
like to call up your editor at Esquire and show him just what it sounds
like to stack and unstack tandems. I'll give him a show that will blow
his mind. What's his number? I ask the Captain what kind of device he was
using to accomplish all his feats. The Captain is pleased at the question.
"You could tell it was special, couldn't you?" Ten pulses per second. That's
faster than the phone company's equipment. Believe me, this unit is the
most famous unit in the country. There is no other unit like it. Believe
me." "Yes, I've heard about it. Some other phone phreaks have told me about
it." "They have been referring to my, ahem, unit? What is it they said?
Just out of curiosity, did they tell you it was a highly sophisticated
computer-operated unit, with acoustical coupling for receiving outputs
and a switch-board with multiple-line-tie capability? Did they tell you
that the frequency tolerance is guaranteed to be not more than .05 percent?
The amplitude tolerance less than .01 decibel? Those pulses you heard were
perfect. They just come faster than the phone company. Those were high-precision
op-amps. Op-amps are instrumentation amplifiers designed for ultra-stable
amplification, super-low distortion and accurate frequency response. Did
they tell you it can operate in temperatures from -55øC to +125øC?"
I admit that they did not tell me all that. "I built it myself," the Captain
goes on. "If you were to go out and buy the components from an industrial
wholesaler it would cost you at least $1500. I once worked for a semiconductor
company and all this didn't cost me a cent. Do you know what I mean? Did
they tell you about how I put a call completely around the world? I'll
tell you how I did it. I M-Fed Tokyo inward, who connected me to India,
India connected me to Greece, Greece connected me to Pretoria, South Africa,
South Africa connected me to South America, I went from South America to
London, I had a London operator connect me to a New York operator, I had
New York connect me to a California operator who rang the phone next to
me. Needless to say I had to shout to hear myself. But the echo was far
out. Fantastic. Delayed. It was delayed twenty seconds, but I could hear
myself talk to myself." "You mean you were speaking into the mouthpiece
of one phone sending your voice around the world into your ear through
a phone on the other side of your head?" I asked the Captain. I had a vision
of something vaguely autoerotic going on, in a complex electronic way.
"That's right," said the Captain. "I've also sent my voice around the world
one way, going east on one phone, and going west on the other, going through
cable one way, satellite the other, coming back together at the same time,
ringing the two phones simultaneously and picking them up and whipping
my voice both ways around the world back to me. Wow. That was a mind blower."
"You mean you sit there with both phones on your ear and talk to yourself
around the world," I said incredulously. "Yeah. Um hum. That's what I do.
I connect the phone together and sit there and talk." "What do you say?
What do you say to yourself when you're connected?" "Oh, you know. Hello
test one two three," he says in a low-pitched voice. "Hello test one two
three," he replied to himself in a high-pitched voice. "Hello test one
two three," he repeats again, low-pitched. "Hello test one two three,"
he replies, high-pitched. "I sometimes do this: Hello Hello Hello Hello,
Hello, hello," he trails off and breaks into laughter. Why Captain Crunch
Hardly Ever Taps Phones Anymore Using internal phone-company codes, phone
phreaks have learned a simple method for tapping phones. Phone-company
operators have in front of them a board that holds verification jacks.
It allows them to plug into conversations in case of emergency, to listen
in to a line to determine if the line is busy or the circuits are busy.
Phone phreaks have learned to beep out the codes which lead them to a verification
operator, tell the verification operator they are switchmen from some other
area code testing out verification trunks. Once the operator hooks them
into the verification trunk, they disappear into the board for all practical
purposes, slip unnoticed into any one of the 10,000 to 100,000 numbers
in that central office without the verification operator knowing what they're
doing, and of course without the two parties to the connection knowing
there is a phantom listener present on their line. Toward the end of my
hour-long first conversation with him, I asked the Captain if he ever tapped
phones. "Oh no. I don't do that. I don't think it's right," he told me
firmly. "I have the power to do it but I don't... Well one time, just one
time, I have to admit that I did. There was this girl, Linda, and I wanted
to find out... you know. I tried to call her up for a date. I had a date
with her the last weekend and I thought she liked me. I called her up,
man, and her line was busy, and I kept calling and it was still busy. Well,
I had just learned about this system of jumping into lines and I said to
myself, 'Hmmm. Why not just see if it works. It'll surprise her if all
of a sudden I should pop up on her line. It'll impress her, if anything.'
So I went ahead and did it. I M-Fed into the line. My M-F-er is powerful
enough when patched directly into the mouthpiece to trigger a verification
trunk without using an operator the way the other phone phreaks have to.
"I slipped into the line and there she was talking to another boyfriend.
Making sweet talk to him. I didn't make a sound because I was so disgusted.
So I waited there for her to hang up, listening to her making sweet talk
to the other guy. You know. So as soon as she hung up I instantly M-F-ed
her up and all I said was, 'Linda, we're through.' And I hung up. And it
blew her head off. She couldn't figure out what the hell happened. "But
that was the only time. I did it thinking I would surprise her, impress
her. Those were all my intentions were, and well, it really kind of hurt
me pretty badly, and... and ever since then I don't go into verification
trunks." Moments later my first conversation with the Captain comes to
a close. "Listen," he says, his spirits somewhat cheered, "listen. What
you are going to hear when I hang up is the sound of tandems unstacking.
Layer after layer of tandems unstacking until there's nothing left of the
stack, until it melts away into nothing. Cheep, cheep, cheep, cheep," he
concludes, his voice descending to a whisper with each cheep. He hangs
up. The phone suddenly goes into four spasms: kachink cheep. Kachink cheep
kachink cheep kachink cheep, and the complex connection has wiped itself
out like the Cheshire cat's smile. The MF Boogie Blues The next number
I choose from the select list of phone-phreak alumni, prepared for me by
the blue-box inventor, is a Memphis number. It is the number of Joe Engressia,
the first and still perhaps the most accomplished blind phone phreak. Three
years ago Engressia was a nine-day wonder in newspapers and magazines all
over America because he had been discovered whistling free long-distance
connections for fellow students at the University of South Florida. Engressia
was born with perfect pitch: he could whistle phone tones better than the
phone-company's equipment. Engressia might have gone on whistling in the
dark for a few friends for the rest of his life if the phone company hadn't
decided to expose him. He was warned, disciplined by the college, and the
whole case became public. In the months following media reports of his
talent, Engressia began receiving strange calls. There were calls from
a group of kids in Los Angeles who could do some very strange things with
the quirky General Telephone and Electronics circuitry in LA suburbs. There
were calls from a group of mostly blind kids in ----, California, who had
been doing some interesting experiments with Cap'n Crunch whistles and
test loops. There was a group in Seattle, a group in Cambridge, Massachusetts,
a few from New York, a few scattered across the country. Some of them had
already equipped themselves with cassette and electronic M-F devices. For
some of these groups, it was the first time they knew of the others. The
exposure of Engressia was the catalyst that linked the separate phone-phreak
centers together. They all called Engressia. They talked to him about what
he was doing and what they were doing. And then he told them -- the scattered
regional centers and lonely independent phone phreakers -- about each other,
gave them each other's numbers to call, and within a year the scattered
phone-phreak centers had grown into a nationwide underground. Joe Engressia
is only twenty-two years old now, but along the phone-phreak network he
is "the old man," accorded by phone phreaks something of the reverence
the phone company bestows on Alexander Graham Bell. He seldom needs to
make calls anymore. The phone phreaks all call him and let him know what
new tricks, new codes, new techniques they have learned. Every night he
sits like a sightless spider in his little apartment receiving messages
from every tendril of his web. It is almost a point of pride with Joe that
they call him. But when I reached him in his Memphis apartment that night,
Joe Engressia was lonely, jumpy and upset. "God, I'm glad somebody called.
I don't know why tonight of all nights I don't get any calls. This guy
around here got drunk again tonight and propositioned me again. I keep
telling him we'll never see eye to eye on this subject, if you know what
I mean. I try to make light of it, you know, but he doesn't get it. I can
head him out there getting drunker and I don't know what he'll do next.
It's just that I'm really all alone here, just moved to Memphis, it's the
first time I'm living on my own, and I'd hate for it to all collapse now.
But I won't go to bed with him. I'm just not very interested in sex and
even if I can't see him I know he's ugly. "Did you hear that? That's him
banging a bottle against the wall outside. He's nice. Well forget about
it. You're doing a story on phone phreaks? Listen to this. It's the MF
Boogie Blues. Sure enough, a jumpy version of Muskrat Ramble boogies its
way over the line, each note one of those long-distance phone tones. The
music stops. A huge roaring voice blasts the phone off my ear: "AND THE
QUESTION IS..." roars the voice, "CAN A BLIND PERSON HOOK UP AN AMPLIFIER
ON HIS OWN?" The roar ceases. A high-pitched operator-type voice replaces
it. "This is Southern Braille Tel. & Tel. Have tone, will phone." This
is succeeded by a quick series of M-F tones, a swift "kachink" and a deep
reassuring voice: "If you need home care, call the visiting-nurses association.
First National time in Honolulu is 4:32 p.m." Joe back in his Joe voice
again: "Are we seeing eye to eye? 'Si, si,' said the blind Mexican. Ahem.
Yes. Would you like to know the weather in Tokyo?" This swift manic sequence
of phone-phreak vaudeville stunts and blind-boy jokes manages to keep Joe's
mind off his tormentor only as long as it lasts. "The reason I'm in Memphis,
the reason I have to depend on that homosexual guy, is that this is the
first time I've been able to live on my own and make phone trips on my
own. I've been banned from all central offices around home in Florida,
they knew me too well, and at the University some of my fellow scholars
were always harassing me because I was on the dorm pay phone all the time
and making fun of me because of my fat ass, which of course I do have,
it's my physical fatness program, but I don't like to hear it every day,
and if I can't phone trip and I can't phone phreak, I can't imagine what
I'd do, I've been devoting three quarters of my life to it. "I moved to
Memphis because I wanted to be on my own as well as because it has a Number
5 crossbar switching system and some interesting little independent phone-company
districts nearby and so far they don't seem to know who I am so I can go
on phone tripping, and for me phone tripping is just as important as phone
phreaking." Phone tripping, Joe explains, begins with calling up a central-office
switch room. He tells the switchman in a polite earnest voice that he's
a blind college student interested in telephones, and could he perhaps
have a guided tour of the switching station? Each step of the tour Joe
likes to touch and feel relays, caress switching circuits, switchboards,
crossbar arrangements. So when Joe Engressia phone phreaks he feels his
way through the circuitry of the country garden of forking paths, he feels
switches shift, relays shunt, crossbars swivel, tandems engage and disengage
even as he hears -- with perfect pitch -- his M-F pulses make the entire
Bell system dance to his tune. Just one month ago Joe took all his savings
out of his bank and left home, over the emotional protests of his mother.
"I ran away from home almost," he likes to say. Joe found a small apartment
house on Union Avenue and began making phone trips. He'd take a bus a hundred
miles south in Mississippi to see some old-fashioned Bell equipment still
in use in several states, which had been puzzling. He'd take a bus three
hundred miles to Charlotte, North Carolina, to look at some brand-new experimental
equipment. He hired a taxi to drive him twelve miles to a suburb to tour
the office of a small phone company with some interesting idiosyncrasies
in its routing system. He was having the time of his life, he said, the
most freedom and pleasure he had known. In that month he had done very
little long-distance phone phreaking from his own phone. He had begun to
apply for a job with the phone company, he told me, and he wanted to stay
away from anything illegal. "Any kind of job will do, anything as menial
as the most lowly operator. That's probably all they'd give me because
I'm blind. Even though I probably know more than most switchmen. But that's
okay. I want to work for Ma Bell. I don't hate Ma Bell the way Gilbertson
and some phone phreaks do. I don't want to screw Ma Bell. With me it's
the pleasure of pure knowledge. There's something beautiful about the system
when you know it intimately the way I do. But I don't know how much they
know about me here. I have a very intuitive feel for the condition of the
line I'm on, and I think they're monitoring me off and on lately, but I
haven't been doing much illegal. I have to make a few calls to switchmen
once in a while which aren't strictly legal, and once I took an acid trip
and was having these auditory hallucinations as if I were trapped and these
planes were dive-bombing me, and all of sudden I had to phone phreak out
of there. For some reason I had to call Kansas City, but that's all." A
Warning Is Delivered At this point -- one o'clock in my time zone -- a
loud knock on my motel-room door interrupts our conversation. Outside the
door I find a uniformed security guard who informs me that there has been
an "emergency phone call" for me while I have been on the line and that
the front desk has sent him up to let me know. Two seconds after I say
good-bye to Joe and hang up, the phone rings. "Who were you talking to?"
the agitated voice demands. The voice belongs to Captain Crunch. "I called
because I decided to warn you of something. I decided to warn you to be
careful. I don't want this information you get to get to the radical underground.
I don't want it to get into the wrong hands. What would you say if I told
you it's possible for three phone phreaks to saturate the phone system
of the nation. Saturate it. Busy it out. All of it. I know how to do this.
I'm not gonna tell. A friend of mine has already saturated the trunks between
Seattle and New York. He did it with a computerized M-F-er hitched into
a special Manitoba exchange. But there are other, easier ways to do it."
Just three people? I ask. How is that possible? "Have you ever heard of
the long-lines guard frequency? Do you know about stacking tandems with
17 and 2600? Well, I'd advise you to find out about it. I'm not gonna tell
you. But whatever you do, don't let this get into the hands of the radical
underground." (Later Gilbertson, the inventor, confessed that while he
had always been skeptical about the Captain's claim of the sabotage potential
of trunk-tying phone phreaks, he had recently heard certain demonstrations
which convinced him the Captain was not speaking idly. "I think it might
take more than three people, depending on how many machines like Captain
Crunch's were available. But even though the Captain sounds a little weird,
he generally turns out to know what he's talking about.") "You know," Captain
Crunch continues in his admonitory tone, "you know the younger phone phreaks
call Moscow all the time. Suppose everybody were to call Moscow. I'm no
right-winger. But I value my life. I don't want the Commies coming over
and dropping a bomb on my head. That's why I say you've got to be careful
about who gets this information." The Captain suddenly shifts into a diatribe
against those phone phreaks who don't like the phone company. "They don't
understand, but Ma Bell knows everything they do. Ma Bell knows. Listen,
is this line hot? I just heard someone tap in. I'm not paranoid, but I
can detect things like that. Well, even if it is, they know that I know
that they know that I have a bulk eraser. I'm very clean." The Captain
pauses, evidently torn between wanting to prove to the phone-company monitors
that he does nothing illegal, and the desire to impress Ma Bell with his
prowess. "Ma Bell knows how good I am. And I am quite good. I can detect
reversals, tandem switching, everything that goes on a line. I have relative
pitch now. Do you know what that means? My ears are a $20,000 piece of
equipment. With my ears I can detect things they can't hear with their
equipment. I've had employment problems. I've lost jobs. But I want to
show Ma Bell how good I am. I don't want to screw her, I want to work for
her. I want to do good for her. I want to help her get rid of her flaws
and become perfect. That's my number-one goal in life now." The Captain
concludes his warnings and tells me he has to be going. "I've got a little
action lined up for tonight," he explains and hangs up. Before I hang up
for the night, I call Joe Engressia back. He reports that his tormentor
has finally gone to sleep -- "He's not blind drunk, that's the way I get,
ahem, yes; but you might say he's in a drunken stupor." I make a date to
visit Joe in Memphis in two days. A Phone Phreak Call Takes Care of Business
The next morning I attend a gathering of four phone phreaks in ----- (a
California suburb). The gathering takes place in a comfortable split-level
home in an upper-middle-class subdivision. Heaped on the kitchen table
are the portable cassette recorders, M-F cassettes, phone patches, and
line ties of the four phone phreaks present. On the kitchen counter next
to the telephone is a shoe-box-size blue box with thirteen large toggle
switches for the tones. The parents of the host phone phreak, Ralph, who
is blind, stay in the living room with their sighted children. They are
not sure exactly what Ralph and his friends do with the phone or if it's
strictly legal, but he is blind and they are pleased he has a hobby which
keeps him busy. The group has been working at reestablishing the historic
"2111" conference, reopening some toll-free loops, and trying to discover
the dimensions of what seem to be new initiatives against phone phreaks
by phone-company security agents. It is not long before I get a chance
to see, to hear, Randy at work. Randy is known among the phone phreaks
as perhaps the finest con man in the game. Randy is blind. He is pale,
soft and pear-shaped, he wears baggy pants and a wrinkly nylon white sport
shirt, pushes his head forward from hunched shoulders somewhat like a turtle
inching out of its shell. His eyes wander, crossing and recrossing, and
his forehead is somewhat pimply. He is only sixteen years old. But when
Randy starts speaking into a telephone mouthpiece his voice becomes so
stunningly authoritative it is necessary to look again to convince yourself
it comes from a chubby adolescent Randy. Imagine the voice of a crack oil-rig
foreman, a tough, sharp, weather-beaten Marlboro man of forty. Imagine
the voice of a brilliant performance-fund gunslinger explaining how he
beats the Dow Jones by thirty percent. Then imagine a voice that could
make those two sound like Stepin Fetchit. That is sixteen-year-old Randy's
voice. He is speaking to a switchman in Detroit. The phone company in Detroit
had closed up two toll-free loop pairs for no apparent reason, although
heavy use by phone phreaks all over the country may have been detected.
Randy is telling the switchman how to open up the loop and make it free
again: "How are you, buddy. Yeah. I'm on the board in here in Tulsa, Oklahoma,
and we've been trying to run some tests on your loop-arounds and we find'em
busied out on both sides.... Yeah, we've been getting a 'BY' on them, what
d'ya say, can you drop cards on 'em? Do you have 08 on your number group?
Oh that's okay, we've had this trouble before, we may have to go after
the circuit. Here lemme give 'em to you: your frame is 05, vertical group
03, horizontal 5, vertical file 3. Yeah, we'll hang on here.... Okay, found
it? Good. Right, yeah, we'd like to clear that busy out. Right. All you
have to do is look for your key on the mounting plate, it's in your miscellaneous
trunk frame. Okay? Right. Now pull your key from NOR over the LCT. Yeah.
I don't know why that happened, but we've been having trouble with that
one. Okay. Thanks a lot fella. Be seein' ya." Randy hangs up, reports that
the switchman was a little inexperienced with the loop-around circuits
on the miscellaneous trunk frame, but that the loop has been returned to
its free-call status. Delighted, phone phreak Ed returns the pair of numbers
to the active-status column in his directory. Ed is a superb and painstaking
researcher. With almost Talmudic thoroughness he will trace tendrils of
hints through soft-wired mazes of intervening phone-company circuitry back
through complex linkages of switching relays to find the location and identity
of just one toll-free loop. He spends hours and hours, every day, doing
this sort of thing. He has somehow compiled a directory of eight hundred
"Band-six in-WATS numbers" located in over forty states. Band-six in-WATS
numbers are the big 800 numbers -- the ones that can be dialed into free
from anywhere in the country. Ed the researcher, a nineteen-year-old engineering
student, is also a superb technician. He put together his own working blue
box from scratch at age seventeen. (He is sighted.) This evening after
distributing the latest issue of his in-WATS directory (which has been
typed into Braille for the blind phone phreaks), he announces he has made
a major new breakthrough: "I finally tested it and it works, perfectly.
I've got this switching matrix which converts any touch-tone phone into
an M-F-er." The tones you hear in touch-tone phones are not the M-F tones
that operate the long-distance switching system. Phone phreaks believe
AT&T. had deliberately equipped touch tones with a different set of
frequencies to avoid putting the six master M-F tones in the hands of every
touch-tone owner. Ed's complex switching matrix puts the six master tones,
in effect put a blue box, in the hands of every touch-tone owner. Ed shows
me pages of schematics, specifications and parts lists. "It's not easy
to build, but everything here is in the Heathkit catalog." Ed asks Ralph
what progress he has made in his attempts to reestablish a long-term open
conference line for phone phreaks. The last big conference -- the historic
"2111" conference -- had been arranged through an unused Telex test-board
trunk somewhere in the innards of a 4A switching machine in Vancouver,
Canada. For months phone phreaks could M-F their way into Vancouver, beep
out 604 (the Vancouver area code) and then beep out 2111 (the internal
phone-company code for Telex testing), and find themselves at any time,
day or night, on an open wire talking with an array of phone phreaks from
coast to coast, operators from Bermuda, Tokyo and London who are phone-phreak
sympathizers, and miscellaneous guests and technical experts. The conference
was a massive exchange of information. Phone phreaks picked each other's
brains clean, then developed new ways to pick the phone company's brains
clean. Ralph gave M F Boogies concerts with his home-entertainment-type
electric organ, Captain Crunch demonstrated his round-the-world prowess
with his notorious computerized unit and dropped leering hints of the "action"
he was getting with his girl friends. (The Captain lives out or pretends
to live out several kinds of fantasies to the gossipy delight of the blind
phone phreaks who urge him on to further triumphs on behalf of all of them.)
The somewhat rowdy Northwest phone-phreak crowd let their bitter internal
feud spill over into the peaceable conference line, escalating shortly
into guerrilla warfare; Carl the East Coast international tone relations
expert demonstrated newly opened direct M-F routes to central offices on
the island of Bahrein in the Persian Gulf, introduced a new phone-phreak
friend of his in Pretoria, and explained the technical operation of the
new Oakland-to Vietnam linkages. (Many phone phreaks pick up spending money
by M-F-ing calls from relatives to Vietnam GIs charging $5 for a whole
hour of trans-Pacific conversation.) Day and night the conference line
was never dead. Blind phone phreaks all over the country, lonely and isolated
in homes filled with active sighted brothers and sisters, or trapped with
slow and unimaginative blind kids in straitjacket schools for the blind,
knew that no matter how late it got they could dial up the conference and
find instant electronic communion with two or three other blind kids awake
over on the other side of America. Talking together on a phone hookup,
the blind phone phreaks say, is not much different from being there together.
Physically, there was nothing more than a two-inch-square wafer of titanium
inside a vast machine on Vancouver Island. For the blind kids >there<
meant an exhilarating feeling of being in touch, through a kind of skill
and magic which was peculiarly their own. Last April 1, however, the long
Vancouver Conference was shut off. The phone phreaks knew it was coming.
Vancouver was in the process of converting from a step-by-step system to
a 4A machine and the 2111 Telex circuit was to be wiped out in the process.
The phone phreaks learned the actual day on which the conference would
be erased about a week ahead of time over the phone company's internal-news-and-shop-talk
recording. For the next frantic seven days every phone phreak in America
was on and off the 2111 conference twenty-four hours a day. Phone phreaks
who were just learning the game or didn't have M-F capability were boosted
up to the conference by more experienced phreaks so they could get a glimpse
of what it was like before it disappeared. Top phone phreaks searched distant
area codes for new conference possibilities without success. Finally in
the early morning of April 1, the end came. "I could feel it coming a couple
hours before midnight," Ralph remembers. "You could feel something going
on in the lines. Some static began showing up, then some whistling wheezing
sound. Then there were breaks. Some people got cut off and called right
back in, but after a while some people were finding they were cut off and
couldn't get back in at all. It was terrible. I lost it about one a.m.,
but managed to slip in again and stay on until the thing died... I think
it was about four in the morning. There were four of us still hanging on
when the conference disappeared into nowhere for good. We all tried to
M-F up to it again of course, but we got silent termination. There was
nothing there." The Legendary Mark Bernay Turns Out To Be "The Midnight
Skulker" Mark Bernay. I had come across that name before. It was on Gilbertson's
select list of phone phreaks. The California phone phreaks had spoken of
a mysterious Mark Bernay as perhaps the first and oldest phone phreak on
the West Coast. And in fact almost every phone phreak in the West can trace
his origins either directly to Mark Bernay or to a disciple of Mark Bernay.
It seems that five years ago this Mark Bernay (a pseudonym he chose for
himself) began traveling up and down the West Coast pasting tiny stickers
in phone books all along his way. The stickers read something like "Want
to hear an interesting tape recording? Call these numbers." The numbers
that followed were toll-free loop-around pairs. When one of the curious
called one of the numbers he would hear a tape recording pre-hooked into
the loop by Bernay which explained the use of loop-around pairs, gave the
numbers of several more, and ended by telling the caller, "At six o'clock
tonight this recording will stop and you and your friends can try it out.
Have fun." "I was disappointed by the response at first," Bernay told me,
when I finally reached him at one of his many numbers and he had dispensed
with the usual "I never do anything illegal" formalities which experienced
phone phreaks open most conversations. "I went all over the coast with
these stickers not only on pay phones, but I'd throw them in front of high
schools in the middle of the night, I'd leave them unobtrusively in candy
stores, scatter them on main streets of small towns. At first hardly anyone
bothered to try it out. I would listen in for hours and hours after six
o'clock and no one came on. I couldn't figure out why people wouldn't be
interested. Finally these two girls in Oregon tried it out and told all
their friends and suddenly it began to spread." Before his Johny Appleseed
trip Bernay had already gathered a sizable group of early pre-blue-box
phone phreaks together on loop-arounds in Los Angeles. Bernay does not
claim credit for the original discovery of the loop-around numbers. He
attributes the discovery to an eighteen-year-old reform school kid in Long
Beach whose name he forgets and who, he says, "just disappeared one day."
When Bernay himself discovered loop-arounds independently, from clues in
his readings in old issues of the Automatic Electric Technical Journal,
he found dozens of the reform-school kid's friends already using them.
However, it was one of Bernay's disciples in Seattle that introduced phone
phreaking to blind kids. The Seattle kid who learned about loops through
Bernay's recording told a blind friend, the blind kid taught the secret
to his friends at a winter camp for blind kids in Los Angeles. When the
camp session was over these kids took the secret back to towns all over
the West. This is how the original blind kids became phone phreaks. For
them, for most phone phreaks in general, it was the discovery of the possibilities
of loop-arounds which led them on to far more serious and sophisticated
phone-phreak methods, and which gave them a medium for sharing their discoveries.
A year later a blind kid who moved back east brought the technique to a
blind kids' summer camp in Vermont, which spread it along the East Coast.
All from a Mark Bernay sticker. Bernay, who is nearly thirty years old
now, got his start when he was fifteen and his family moved into an L.A.
suburb serviced by General Telephone and Electronics equipment. He became
fascinated with the differences between Bell and G.T.&E. equipment.
He learned he could make interesting things happen by carefully timed clicks
with the disengage button. He learned to interpret subtle differences in
the array of clicks, whirrs and kachinks he could hear on his lines. He
learned he could shift himself around the switching relays of the L.A.
area code in a not-too-predictable fashion by interspersing his own hook-switch
clicks with the clicks within the line. (Independent phone companies --
there are nineteen hundred of them still left, most of them tiny island
principalities in Ma Bell's vast empire -- have always been favorites with
phone phreaks, first as learning tools, then as Archimedes platforms from
which to manipulate the huge Bell system. A phone phreak in Bell territory
will often M-F himself into an independent's switching system, with switching
idiosyncrasies which can give him marvelous leverage over the Bell System.
"I have a real affection for Automatic Electric Equipment," Bernay told
me. "There are a lot of things you can play with. Things break down in
interesting ways." Shortly after Bernay graduated from college (with a
double major in chemistry and philosophy), he graduated from phreaking
around with G.T.&E. to the Bell System itself, and made his legendary
sticker-pasting journey north along the coast, settling finally in Northwest
Pacific Bell territory. He discovered that if Bell does not break down
as interestingly as G.T.&E., it nevertheless offers a lot of "things
to play with." Bernay learned to play with blue boxes. He established his
own personal switchboard and phone-phreak research laboratory complex.
He continued his phone-phreak evangelism with ongoing sticker campaigns.
He set up two recording numbers, one with instructions for beginning phone
phreaks, the other with latest news and technical developments (along with
some advanced instruction) gathered from sources all over the country.
These days, Bernay told me, he had gone beyond phone-phreaking itself.
"Lately I've been enjoying playing with computers more than playing with
phones. My personal thing in computers is just like with phones, I guess
-- the kick is in finding out how to beat the system, how to get at things
I'm not supposed to know about, how to do things with the system that I'm
not supposed to be able to do." As a matter of fact, Bernay told me, he
had just been fired from his computer-programming job for doing things
he was not supposed to be able to do. He had been working with a huge time-sharing
computer owned by a large corporation but shared by many others. Access
to the computer was limited to those programmers and corporations that
had been assigned certain passwords. And each password restricted its user
to access to only the one section of the computer cordoned off from its
own information storager. The password system prevented companies and individuals
from stealing each other's information. "I figured out how to write a program
that would let me read everyone else's password," Bernay reports. "I began
playing around with passwords. I began letting the people who used the
computer know, in subtle ways, that I knew their passwords. I began dropping
notes to the computer supervisors with hints that I knew what I know. I
signed them 'The Midnight Skulker.' I kept getting cleverer and cleverer
with my messages and devising ways of showing them what I could do. I'm
sure they couldn't imagine I could do the things I was showing them. But
they never responded to me. Every once in a while they'd change the passwords,
but I found out how to discover what the new ones were, and I let them
know. But they never responded directly to the Midnight Skulker. I even
finally designed a program which they could use to prevent my program from
finding out what it did. In effect I told them how to wipe me out, The
Midnight Skulker. It was a very clever program. I started leaving clues
about myself. I wanted them to try and use it and then try to come up with
something to get around that and reappear again. But they wouldn't play.
I wanted to get caught. I mean I didn't want to get caught personally,
but I wanted them to notice me and admit that they noticed me. I wanted
them to attempt to respond, maybe in some interesting way." Finally the
computer managers became concerned enough about the threat of information-stealing
to respond. However, instead of using The Midnight Skulker's own elegant
self-destruct program, they called in their security personnel, interrogated
everyone, found an informer to identify Bernay as The Midnight Skulker,
and fired him. "At first the security people advised the company to hire
me full-time to search out other flaws and discover other computer freaks.
I might have liked that. But I probably would have turned into a double
double agent rather than the double agent they wanted. I might have resurrected
The Midnight Skulker and tried to catch myself. Who knows? Anyway, the
higher-ups turned the whole idea down." You Can Tap the F.B.I.'s Crime
Control Computer in the Comfort of Your Own Home, Perhaps. Computer freaking
may be the wave of the future. It suits the phone-phreak sensibility perfectly.
Gilbertson, the blue-box inventor and a lifelong phone phreak, has also
gone on from phone-phreaking to computer-freaking. Before he got into the
blue-box business Gilbertson, who is a highly skilled programmer, devised
programs for intead-box" device, of the kind used by bookies in the Thirties
(bookie gives a number to his betting clients; the phone with that number
is installed in some widow lady's apartment, but is rigged to ring in the
bookie's shop across town, cops trace big betting number and find nothing
but the widow). Not long after that afternoon in 1968 when, deep in the
stacks of an engineering library, he came across a technical journal with
the phone tone frequencies and rushed off to make his first blue box, not
long after that Gilbertson abandoned a very promising career in physical
chemistry and began selling blue boxes for $1,500 apiece. "I had to leave
physical chemistry. I just ran out of interesting things to learn," he
told me one evening. We had been talking in the apartment of the man who
served as the link between Gilbertson and the syndicate in arranging the
big $300,000 blue-box deal which fell through because of legal trouble.
There has been some smoking. "No more interesting things to learn," he
continues. "Physical chemistry turns out to be a sick subject when you
take it to its highest level. I don't know. I don't think I could explain
to you how it's sick. You have to be there. But you get, I don't know,
a false feeling of omnipotence. I suppose it's like phone-phreaking that
way. This huge thing is there. This whole system. And there are holes in
it and you slip into them like Alice and you're pretending you're doing
something you're actually not, or at least it's no longer you that's doing
what you thought you were doing. It's all Lewis Carroll. Physical chemistry
and phone-phreaking. That's why you have these phone-phreak pseudonyms
like The Cheshire Cat, the Red King, and The Snark. But there's something
about phone-phreaking that you don't find in physical chemistry." He looks
up at me: "Did you ever steal anything?" "Well yes, I..." "Then you know!
You know the rush you get. It's not just knowledge, like physical chemistry.
It's forbidden knowledge. You know. You can learn about anything under
the sun and be bored to death with it. But the idea that it's illegal.
Look: you can be small and mobile and smart and you're ripping off somebody
large and powerful and very dangerous." People like Gilbertson and Alexander
Graham Bell are always talking about ripping off the phone company and
screwing Ma Bell. But if they were shown a single button and told that
by pushing it they could turn the entire circuitry of A.T.&T. into
molten puddles, they probably wouldn't push it. The disgruntled-inventor
phone phreak needs the phone system the way the lapsed Catholic needs the
Church, the way Satan needs a God, the way The Midnight Skulker needed,
more than anything else, response. Later that evening Gilbertson finished
telling me how delighted he was at the flood of blue boxes spreading throughout
the country, how delighted he was to know that "this time they're really
screwed." He suddenly shifted gears. "Of course. I do have this love/hate
thing about Ma Bell. In a way I almost like the phone company. I guess
I'd be very sad if they were to disintegrate. In a way it's just that after
having been so good they turn out to have these things wrong with them.
It's those flaws that allow me to get in and mess with them, but I don't
know. There's something about it that gets to you and makes you want to
get to it, you know." I ask him what happens when he runs out of interesting,
forbidden things to learn about the phone system. "I don't know, maybe
I'd go to work for them for a while." "In security even?" "I'd do it, sure.
I just as soon play -- I'd just as soon work on either side." "Even figuring
out how to trap phone phreaks? I said, recalling Mark Bernay's game." "Yes,
that might be interesting. Yes, I could figure out how to outwit the phone
phreaks. Of course if I got too good at it, it might become boring again.
Then I'd have to hope the phone phreaks got much better and outsmarted
me for a while. That would move the quality of the game up one level. I
might even have to help them out, you know, 'Well, kids, I wouldn't want
this to get around but did you ever think of -- ?' I could keep it going
at higher and higher levels forever." The dealer speaks up for the first
time. He has been staring at the soft blinking patterns of light and colors
on the translucent tiled wall facing him. (Actually there are no patterns:
the color and illumination of every tile is determined by a computerized
random-number generator designed by Gilbertson which insures that there
can be no meaning to any sequence of events in the tiles.) "Those are nice
games you're talking about," says the dealer to his friend. "But I wouldn't
mind seeing them screwed. A telephone isn't private anymore. You can't
say anything you really want to say on a telephone or you have to go through
that paranoid bullshit. 'Is it cool to talk on the phone?' I mean, even
if it is cool, if you have to ask 'Is it cool,' then it isn't cool. You
know. 'Is it cool,' then it isn't cool. You know. Like those blind kids,
people are going to start putting together their own private telephone
companies if they want to really talk. And you know what else. You don't
hear silences on the phone anymore. They've got this time-sharing thing
on long-distance lines where you make a pause and they snip out that piece
of time and use it to carry part of somebody else's conversation.Instead
of a pause, where somebody's maybe breathing or sighing, you get this blank
hole and you only start hearing again when someone says a word and even
the beginning of the word is clipped off. Silences don't count -- you're
paying for them, but they take them away from you. It's not cool to talk
and you can't hear someone when they don't talk. What the hell good is
the phone? I wouldn't mind seeing them totally screwed." The Big Memphis
Bust Joe Engressia never wanted to screw Ma Bell. His dream had always
been to work for her. The day I visited Joe in his small apartment on Union
Avenue in Memphis, he was upset about another setback in his application
for a telephone job. "They're stalling on it. I got a letter today telling
me they'd have to postpone the interview I requested again. My landlord
read it for me. They gave me some runaround about wanting papers on my
rehabilitation status but I think there's something else going on." When
I switched on the 40-watt bulb in Joe's room -- he sometimes forgets when
he has guests -- it looked as if there was enough telephone hardware to
start a small phone company of his own. There is one phone on top of his
desk, one phone sitting in an open drawer beneath the desk top. Next to
the desk-top phone is a cigar-box-size M-F device with big toggle switches,
and next to that is some kind of switching and coupling device with jacks
and alligator plugs hanging loose. Next to that is a Braille typewriter.
On the floor next to the desk, lying upside down like a dead tortoise,
is the half-gutted body of an old black standard phone. Across the room
on a torn and dusty couch are two more phones, one of them a touch-tone
model; two tape recorders; a heap of phone patches and cassettes, and a
life-size toy telephone. Our conversation is interrupted every ten minutes
by phone phreaks from all over the country ringing Joe on just about every
piece of equipment but the toy phone and the Braille typewriter. One fourteen-year-old
blind kid from Connecticut calls up and tells Joe he's got a girl friend.
He wants to talk to Joe about girl friends. Joe says they'll talk later
in the evening when they can be alone on the line. Joe draws a deep breath,
whistles him off the air with an earsplitting 2600-cycle whistle. Joe is
pleased to get the calls but he looked worried and preoccupied that evening,
his brow constantly furrowed over his dark wandering eyes. In addition
to the phone-company stall, he has just learned that his apartment house
is due to be demolished in sixty days for urban renewal. For all its shabbiness,
the Union Avenue apartment house has been Joe's first home-of-his-own and
he's worried that he may not find another before this one is demolished.
But what really bothers Joe is that switchmen haven't been listening to
him. "I've been doing some checking on 800 numbers lately, and I've discovered
that certain 800 numbers in New Hampshire couldn't be reached from Missouri
and Kansas. Now it may sound like a small thing, but I don't like to see
sloppy work; it makes me feel bad about the lines. So I've been calling
up switching offices and reporting it, but they haven't corrected it. I
called them up for the third time today and instead of checking they just
got mad. Well, that gets me mad. I mean, I do try to help them. There's
something about them I can't understand -- you want to help them and they
just try to say you're defrauding them." It is Sunday evening and Joe invites
me to join him for dinner at a Holiday Inn. Frequently on Sunday evening
Joe takes some of his welfare money, calls a cab, and treats himself to
a steak dinner at one of Memphis' thirteen Holiday Inns. (Memphis is the
headquarters of Holiday Inn. Holiday Inns have been a favorite for Joe
ever since he made his first solo phone trip to a Bell switching office
in Jacksonville, Florida, and stayed in the Holiday Inn there. He likes
to stay at Holiday Inns, he explains, because they represent freedom to
him and because the rooms are arranged the same all over the country so
he knows that any Holiday Inn room is familiar territory to him. Just like
any telephone.) Over steaks in the Pinnacle Restaurant of the Holiday Inn
Medical Center on Madison Avenue in Memphis, Joe tells me the highlights
of his life as a phone phreak. At age seven, Joe learned his first phone
trick. A mean baby-sitter, tired of listening to little Joe play with the
phone as he always did, constantly, put a lock on the phone dial. "I got
so mad. When there's a phone sitting there and I can't use it... so I started
getting mad and banging the receiver up and down. I noticed I banged it
once and it dialed one. Well, then I tried banging it twice...." In a few
minutes Joe learned how to dial by pressing the hook switch at the right
time. "I was so excited I remember going 'whoo whoo' and beat a box down
on the floor." At age eight Joe learned about whistling. "I was listening
to some intercept non working-number recording in L.A.- I was calling L.A.
as far back as that, but I'd mainly dial non working numbers because there
was no charge, and I'd listen to these recordings all day. Well, I was
whistling 'cause listening to these recordings can be boring after a while
even if they are from L.A., and all of a sudden, in the middle of whistling,
the recording clicked off. I fiddled around whistling some more, and the
same thing happened. So I called up the switch room and said, 'I'm Joe.
I'm eight years old and I want to know why when I whistle this tune the
line clicks off.' He tried to explain it to me, but it was a little too
technical at the time. I went on learning. That was a thing nobody was
going to stop me from doing. The phones were my life, and I was going to
pay any price to keep on learning. I knew I could go to jail. But I had
to do what I had to do to keep on learning." The phone is ringing when
we walk back into Joe's apartment on Union Avenue. It is Captain Crunch.
The Captain has been following me around by phone, calling up everywhere
I go with additional bits of advice and explanation for me and whatever
phone phreak I happen to be visiting. This time the Captain reports he
is calling from what he describes as "my hideaway high up in the Sierra
Nevada." He pulses out lusty salvos of M-F and tells Joe he is about to
"go out and get a little action tonight. Do some phreaking of another kind,
if you know what I mean." Joe chuckles. The Captain then tells me to make
sure I understand that what he told me about tying up the nation's phone
lines was true, but that he and the phone phreaks he knew never used the
technique for sabotage. They only learned the technique to help the phone
company. "We do a lot of troubleshooting for them. Like this New Hampshire/Missouri
WATS-line flaw I've been screaming about. We help them more than they know."
After we say good-bye to the Captain and Joe whistles him off the line,
Joe tells me about a disturbing dream he had the night before: "I had been
caught and they were taking me to a prison. It was a long trip. They were
taking me to a prison a long long way away. And we stopped at a Holiday
Inn and it was my last night ever using the phone and I was crying and
crying, and the lady at the Holiday Inn said, 'Gosh, honey, you should
never be sad at a Holiday Inn. You should always be happy here. Especially
since it's your last night.' And that just made it worse and I was sobbing
so much I couldn't stand it." Two weeks after I left Joe Engressia's apartment,
phone-company security agents and Memphis police broke into it. Armed with
a warrant, which they left pinned to a wall, they confiscated every piece
of equipment in the room, including his toy telephone. Joe was placed under
arrest and taken to the city jail where he was forced to spend the night
since he had no money and knew no one in Memphis to call. It is not clear
who told Joe what that night, but someone told him that the phone company
had an open-and-shut case against him because of revelations of illegal
activity he had made to a phone-company undercover agent. By morning Joe
had become convinced that the reporter from Esquire, with whom he had spoken
two weeks ago, was the undercover agent. He probably had ugly thoughts
about someone he couldn't see gaining his confidence, listening to him
talk about his personal obsessions and dreams, while planning all the while
to lock him up. "I really thought he was a reporter," Engressia told the
Memphis Press-Seminar. "I told him everything...." Feeling betrayed, Joe
proceeded to confess everything to the press and police. As it turns out,
the phone company did use an undercover agent to trap Joe, although it
was not the Esquire reporter. Ironically, security agents were alerted
and began to compile a case against Joe because of one of his acts of love
for the system: Joe had called an internal service department to report
that he had located a group of defective long-distance trunks, and to complain
again about the New Hampshire/Missouri WATS problem. Joe always liked Ma
Bell's lines to be clean and responsive. A suspicious switchman reported
Joe to the security agents who discovered that Joe had never had a long-distance
call charged to his name. Then the security agents learned that Joe was
planning one of his phone trips to a local switching office. The security
people planted one of their agents in the switching office. He posed as
a student switchman and followed Joe around on a tour. He was extremely
friendly and helpful to Joe, leading him around the office by the arm.
When the tour was over he offered Joe a ride back to his apartment house.
On the way he asked Joe -- one tech man to another -- about "those blue
boxers" he'd heard about. Joe talked about them freely, talked about his
blue box freely, and about all the other things he could do with the phones.
The next day the phone-company security agents slapped a monitoring tape
on Joe's line, which eventually picked up an illegal call. Then they applied
for the search warrant and broke in. In court Joe pleaded not guilty to
possession of a blue box and theft of service. A sympathetic judge reduced
the charges to malicious mischief and found him guilty on that count, sentenced
him to two thirty-day sentences to be served concurrently and then suspended
the sentence on condition that Joe promise never to play with phones again.
Joe promised, but the phone company refused to restore his service. For
two weeks after the trial Joe could not be reached except through the pay
phone at his apartment house, and the landlord screened all calls for him.
Phone-phreak Carl managed to get through to Joe after the trial, and reported
that Joe sounded crushed by the whole affair. "What I'm worried about,"
Carl told me, "is that Joe means it this time. The promise. That he'll
never phone-phreak again. That's what he told me, that he's given up phone-phreaking
for good. I mean his entire life. He says he knows they're going to be
watching him so closely for the rest of his life he'll never be able to
make a move without going straight to jail. He sounded very broken up by
the whole experience of being in jail. It was awful to hear him talk that
way. I don't know. I hope maybe he had to sound that way. Over the phone,
you know." He reports that the entire phone-phreak underground is up in
arms over the phone company's treatment of Joe. "All the while Joe had
his hopes pinned on his application for a phone-company job, they were
stringing him along getting ready to bust him. That gets me mad. Joe spent
most of his time helping them out. The bastards. They think they can use
him as an example. All of sudden they're harassing us on the coast. Agents
are jumping up on our lines. They just busted ------'s mute yesterday and
ripped out his lines. But no matter what Joe does, I don't think we're
going to take this lying down." Two weeks later my phone rings and about
eight phone phreaks in succession say hello from about eight different
places in the country, among them Carl, Ed, and Captain Crunch. A nationwide
phone-phreak conference line has been reestablished through a switching
machine in --------, with the cooperation of a disgruntled switchman. "We
have a special guest with us today," Carl tells me. The next voice I hear
is Joe's. He reports happily that he has just moved to a place called Millington,
Tennessee, fifteen miles outside of Memphis, where he has been hired as
a telephone-set repairman by a small independent phone company. Someday
he hopes to be an equipment troubleshooter. "It's the kind of job I dreamed
about. They found out about me from the publicity surrounding the trial.
Maybe Ma Bell did me a favor busting me. I'll have telephones in my hands
all day long." "You know the expression, 'Don't get mad, get even'?" phone-phreak
Carl asked me. "Well, I think they're going to be very sorry about what
they did to Joe and what they're trying to do to us."
151.The History
of British Phreaking by Lex Luthor
Note: The British post office, is the
US equivalent of Ma Bell. In Britain, phreaking goes back to the early
fifties, when the technique of 'toll a drop back' was discovered. Toll
a was an exchange near St.Pauls which routed calls between London and nearby
non-London exchanges. The trick was to dial an unallocated number, and
then depress the receiver-rest for « second. This flashing initiated
the 'clear forward' signal, leaving the caller with an open line into the
toll a exchange. They could then dial 018, which forwarded him to the trunk
exchange at that time, the first long distance exchange in Britain and
follow it with the code for the distant exchange to which he would be connected
at no extra charge. The signals needed to control the UK network today
were published in the "Institution of Post Office Engineers Journal" and
reprinted in the Sunday times (15 Oct. 1972). The signaling system they
use: Signaling system No.3 uses pairs of frequencies selected from 6 tones
separated by 120hz. With that info, the phreaks made "bleepers" or as they
are called here in the US "blue box", but they do utilize different MF
tones then the US, thus, your US blue box that you smuggled into the UK
will not work, unless you change the frequencies. In the early seventies,
a simpler system based on different numbers of pulses with the same frequency
(2280hz) was used. For more info on that, try to get a hold of: Atkinson's
"Telephony and Systems Technology". In the early days of British phreaking,
the Cambridge university Titan computer was used to record and circulate
numbers found by the exhaustive dialing of local networks. These numbers
were used to create a chain of links from local exchange to local exchange
across the country, bypassing the trunk circuits. Because the internal
routing codes in the UK network are not the same as those dialed by the
caller, the phreaks had to discover them by 'probe and listen' techniques
or more commonly known in the US -- scanning. What they did was put in
likely signals and listened to find out if they succeeded. The results
of scanning were circulated to other phreaks. Discovering each other took
time at first, but eventually the phreaks became organized. The "tap" of
Britain was called "undercurrents" which enabled British phreaks to share
the info on new numbers, equipment etc. To understand what the British
phreaks did, think of the phone network in three layers of lines: Local,
trunk, and international. In the UK, subscriber trunk dialing (std), is
the mechanism which takes a call from the local lines and (legitimately)
elevates it to a trunk or international level. The UK phreaks figured that
a call at trunk level can be routed through any number of exchanges, provided
that the right routing codes were found and used correctly. They also had
to discover how to get from local to trunk level either without being charged
(which they did with a bleeper box) or without using (std). Chaining has
already been mentioned but it requires long strings of digits and speech
gets more and more faint as the chain grows, just like it does when you
stack trunks back and forth across the US. The way the security reps snagged
the phreaks was to put a simple 'printermeter' or as we call it: A pen
register on the suspects line, which shows every digit dialed from the
subscribers line. The British prefer to get onto the trunks rather than
chaining. One way was to discover where local calls use the trunks between
neighboring exchanges, start a call and stay on the trunk instead of returning
to the local level on reaching the distant switch. This again required
exhaustive dialing and made more work for titan; it also revealed 'fiddles',
which were inserted by post office engineers. What fiddling means is that
the engineers rewired the exchanges for their own benefit. The equipment
is modified to give access to a trunk without being charged, an operation
which is pretty easy in step by step (SxS) electro-mechanical exchanges,
which were installed in Britain even in the 1970's (Note: I know of a back
door into the Canadian system on a 4A Co., so if you are on SxS or a 4A,
try scanning 3 digit exchanges, i.e.: dial 999,998,997 etc. And listen
for the beep-kerchink, if there are no 3 digit codes which allow direct
access to a tandem in your local exchange and bypasses the AMA so you won't
be billed, not have to blast 2600 every time you wish to box a call. A
famous British 'fiddler' revealed in the early 1970's worked by dialing
173. The caller then added the trunk code of 1 and the subscribers local
number. At that time, most engineering test services began with 17X, so
the engineers could hide their fiddles in the nest of service wires. When
security reps started searching, the fiddles were concealed by tones signaling:
'Number unobtainable' or 'Equipment engaged' which switched off after a
delay. The necessary relays are small and easily hidden. There was another
side to phreaking in the UK in the sixties. Before STD was widespread,
many 'ordinary' people were driven to. Occasional phreaking from sheer
frustration at the inefficient operator controlled trunk system. This came
to a head during a strike about 1961 when operators could not be reached.
Nothing complicated was needed. Many operators had been in the habit of
repeating the codes as they dialed the requested numbers so people soon
learnt the numbers they called frequently. The only 'trick' was to know
which exchanges could be dialed through to pass on the trunk number. Callers
also needed a pretty quiet place to do it, since timing relative to clicks
was important. The most famous trial of British phreaks was called the
old Baily trial. Which started on Oct. 3rd, 1973. What the phreaks did
was dial a spare number at a local call rate, but involving a trunk to
another exchange then they sent a 'clear forward' to their local exchange,
indicating to it that the call was finished; but the distant exchange doesn't
realize because the caller's phone is still off the hook. They now have
an open line into the distant trunk exchange and sent to it a 'seize' signal:
'1' which puts him onto its outgoing lines now, if they know the codes,
the world is open to them. All other exchanges trust his local exchange
to handle the billing; they just interpret the tones they hear. Meanwhile,
the local exchange collects only for a local call. The investigators discovered
the phreaks holding a conference somewhere in England surrounded by various
phone equipment and bleeper boxes, also printouts listing 'secret' post
office codes. (They probably got them from trashing?) The judge said: "Some
take to heroin, some take to telephones." for them phone phreaking was
not a crime, but a hobby to be shared with phellow enthusiasts and discussed
with the post office openly over dinner and by mail. Their approach and
attitude to the worlds largest computer, the global telephone system, was
that of scientists conducting experiments or programmers and engineers
testing programs and systems. The judge appeared to agree, and even asked
them for phreaking codes to use from his local exchange!!!
152.Bad as Shit
by The Jolly Roger
Recently, a telephone fanatic in the
northwest made an interesting discovery. He was exploring the 804 area
code (Virginia) and found out that the 840 exchange did something strange.
In the vast majority of cases, in fact in all of the cases except one,
he would get a recording as if the exchange didn't exist. However, if he
dialed 804-840 and four rather predictable numbers, he got a ring! After
one or two rings, somebody picked up. Being experienced at this kind of
thing, he could tell that the call didn't "supe", that is, no charges were
being incurred for calling this number. (Calls that get you to an error
message, or a special operator, generally don't supervise.) A female voice,
with a hint of a Southern accent said, "Operator, can I help you?" "Yes,"
he said, "What number have I reached?" "What number did you dial, sir?"
He made up a number that was similar. "I'm sorry that is not the number
you reached." Click. He was fascinated. What in the world was this? He
knew he was going to call back, but before he did, he tried some more experiments.
He tried the 840 exchange in several other area codes. In some, it came
up as a valid exchange. In others, exactly the same thing happened -- the
same last four digits, the same Southern belle. Oddly enough, he later
noticed, the areas worked in seemed to travel in a beeline from Washington
DC to Pittsburgh, PA. He called back from a payphone. "Operator, can I
help you?" "Yes, this is the phone company. I'm testing this line and we
don't seem to have an identification on your circuit. What office is this,
please?" "What number are you trying to reach?" "I'm not trying to reach
any number. I'm trying to identify this circuit." "I'm sorry, I can't help
you." "Ma'am, if I don't get an ID on this line, I'll have to disconnect
it. We show no record of it here." "Hold on a moment, sir." After about
a minute, she came back. "Sir, I can have someone speak to you. Would you
give me your number, please?" He had anticipated this and he had the payphone
number ready. After he gave it, she said, "Mr. XXX will get right back
to you." "Thanks." He hung up the phone. It rang. INSTANTLY! "Oh my God,"
he thought, "They weren't asking for my number -- they were confirming
it!" "Hello," he said, trying to sound authoritative. "This is Mr. XXX.
Did you just make an inquiry to my office concerning a phone number?" "Yes.
I need an identi--" "What you need is advice. Don't ever call that number
again. Forget you ever knew it." At this point our friend got so nervous
he just hung up. He expected to hear the phone ring again but it didn't.
Over the next few days he racked his brains trying to figure out what the
number was. He knew it was something big -- that was pretty certain at
this point. It was so big that the number was programmed into every central
office in the country. He knew this because if he tried to dial any other
number in that exchange, he'd get a local error message from his CO, as
if the exchange didn't exist. It finally came to him. He had an uncle who
worked in a federal agency. He had a feeling that this was government related
and if it was, his uncle could probably find out what it was. He asked
the next day and his uncle promised to look into the matter. The next time
he saw his uncle, he noticed a big change in his manner. He was trembling.
"Where did you get that number?!" he shouted. "Do you know I almost got
fired for asking about it?!? They kept wanting to know where I got it."
Our friend couldn't contain his excitement. "What is it?" he pleaded. "What's
the number?!" "IT'S THE PRESIDENT'S BOMB SHELTER!" He never called the
number after that. He knew that he could probably cause quite a bit of
excitement by calling the number and saying something like, "The weather's
not good in Washington. We're coming over for a visit." But our friend
was smart. He knew that there were some things that were better off unsaid
and undone.
153.Telenet by
The Mad Max
It seems that not many of you know
that Telenet is connected to about 80 computer-networks in the world. No,
I don't mean 80 nodes, but 80 networks with thousands of unprotected computers.
When you call your local Telenet-gateway, you can only call those computers
which accept reverse-charging-calls. If you want to call computers in foreign
countries or computers in USA which do not accept R-calls, you need a Telenet-ID.
Did you ever notice that you can type ID XXXX when being connected to Telenet?
You are then asked for the password. If you have such a NUI (Network-User-ID)
you can call nearly every host connected to any computer-network in the
world. Here are some examples: 026245400090184 :Is a VAX in Germany (Username:
DATEXP and leave mail for CHRIS) 0311050500061 :Is the Los Alamos Integrated
computing network (One of the hosts connected to it is the DNA (Defense
Nuclear Agency)!!!) 0530197000016 :Is a BBS in New Zealand 024050256 :Is
the S-E-Bank in Stockholm, Sweden (Login as GAMES !!!) 02284681140541 :CERN
in Geneva in Switzerland (one of the biggest nuclear research centers in
the world) Login as GUEST 0234212301161 :A Videotex-standard system. Type
OPTEL to get in and use the ID 999_ with the password 9_ 0242211000001
:University of Oslo in Norway (Type LOGIN 17,17 to play the Multi-User-Dungeon
!) 0425130000215 :Something like ITT Dialcom, but this one is in Israel
! ID HELP with password HELP works fine with security level 3 0310600584401
:Is the Washington Post News Service via Tymnet (Yes, Tymnet is connected
to Telenet, too !) ID and Password is: PETER You can read the news of the
next day! The prefixes are as follows: 02624 is Datex-P in Germany 02342
is PSS in England 03110 is Telenet in USA 03106 is Tymnet in USA 02405
is Telepak in Sweden 04251 is Isranet in Israel 02080 is Transpac in France
02284 is Telepac in Switzerland 02724 is Eirpac in Ireland 02704 is Luxpac
in Luxembourg 05252 is Telepac in Singapore 04408 is Venus-P in Japan ...and
so on... Some of the countries have more than one packet-switching-network
(USA has 11, Canada has 3, etc). OK. That should be enough for the moment.
As you see most of the passwords are very simple. This is because they
must not have any fear of hackers. Only a few German hackers use these
networks. Most of the computers are absolutely easy to hack !!! So, try
to find out some Telenet-ID's and leave them here. If you need more numbers,
leave e-mail. I'm calling from Germany via the German Datex-P network,
which is similar to Telenet. We have a lot of those NUI's for the German
network, but none for a special Tymnet-outdial-computer in USA, which connects
me to any phone number. Call 026245621040000 and type ID INF300 with password
DATACOM to get more Informations on packet-switching-networks! The new
password for the Washington Post is KING !!!!
154.Fucking with
the Operator by The Jolly Roger
Ever get an operator who gave you a
hard time, and you didn't know what to do? Well if the operator hears you
use a little Bell jargon, she might wise up. Here is a little diagram (excuse
the artwork) of the structure of operators /--------\ /------\ /-----\
!Operator!-- > ! S.A. ! --->! BOS ! \--------/ \------/ \-----/ ! ! V /-------------\
! Group Chief ! \-------------/ Now most of the operators are not bugged,
so they can curse at you, if they do ask INSTANTLY for the "S.A." or the
Service Assistant. The operator does not report to her (95% of them are
hers) but they will solve most of your problems. She MUST give you her
name as she connects & all of these calls are bugged. If the SA gives
you a rough time get her BOS (Business Office Supervisor) on the line.
S/He will almost always back her girls up, but sometimes the SA will get
tarred and feathered. The operator reports to the Group Chief, and S/He
will solve 100% of your problems, but the chances of getting S/He on the
line are nill. If a lineman (the guy who works out on the poles) or an
installation man gives you the works ask to speak to the Installation Foreman,
that works wonders. Here is some other bell jargon, that might come in
handy if you are having trouble with the line. Or they can be used to lie
your way out of situations.... An Erling is a line busy for 1 hour, used
mostly in traffic studies A Permanent Signal is that terrible howling you
get if you disconnect, but don't hang up. Everyone knows what a busy signal
is, but some idiots think that is the *Actual* ringing of the phone, when
it just is a tone "beeps" when the phone is ringing, wouldn't bet on this
though, it can (and does) get out of sync. When you get a busy signal that
is 2 times as fast as the normal one, the person you are trying to reach
isn't really on the phone, (he might be), it is actually the signal that
a trunk line somewhere is busy and they haven't or can't reroute your call.
Sometimes you will get a Recording, or if you get nothing at all (Left
High & Dry in fone terms) all the recordings are being used and the
system is really overused, will probably go down in a little while. This
happened when Kennedy was shot, the system just couldn't handle the calls.
By the way this is called the "reorder signal" and the trunk line is "blocked".
One more thing, if an overseas call isn't completed and doesn't generate
any money for AT&T, is called an "Air & Water Call".
155.Phrack Magazine
- Vol. 1, Issue 1 by The Iron Soldier
"Vengeance is mine", says the Phreak.
METHOD 1-PHONE LINE PHUN Call up the business office. It should be listed
at the front of the white pages. Say you wanted to disconnect Scott Korman's
line. DIAL 800-xxx-xxxx. "Hello, this is Mr. Korman, I'm moving to California
and would like to have my phone service disconnected. I'm at the airport
now. I'm calling from a payphone, my number is [414] 445 5005. You can
send my final bill to: (somewhere in California). Thank you." METHOD 2-PHONE
BOOKS Call up the business office from a pay phone. Say : "Hello, I'd like
to order a Phone Book for Upper Volta (or any out-of-the way area with
Direct Dialing). This is Scott Korman, ship to 3119 N. 44th St. Milwaukee,
WI 53216. Yes, I under stand it will cost $xx($25-$75!!). Thank you." METHOD
3-PHONE CALLS Call up a PBX, enter the code and get an outside line. Then
dial 0+ the number desired to call. You will hear a bonk and then an operator.
Say, "I'd like to charge this to my home phone at 414-445-5005. Thank you."
A friend and I did this to a loser, I called him at 1:00 AM and we left
the fone off the hook all night. I calculated that it cost him $168. METHOD
4-MISC. SERVICES Call up the business office once again from a payfone.
Say you'd like call waiting, forwarding, 3 way, etc. Once again you are
the famed loser Scott Korman. He pays-you laugh. You don't know how funny
it was talking to him, and wondering what those clicks he kept hearing
were. METHOD 5-CHANGED & UNPUB Do the same as in #4, but say you'd
like to change and unlist your (Scott's) number. Anyone calling him will
get: "BEW BEW BEEP. The number you have reached, 445-5005, has been changed
to a non-published number. No further....." METHOD 6-FORWARDING This required
an accomplice or two or three. Around Christmas time, go to Toys 'R' Us.
Get everyone at the customer service or manager's desk away ("Hey, could
you help me"). Then you get on their phone and dial (usually dial 9 first)
and the business office again. This time, say you are from Toys 'R' Us,
and you'd like to add call forwarding to 445-5005. Scott will get 100-600
calls a day!!! METHOD 7-RUSSIAN CALLER Call a payphone at 10:00 PM. Say
to the operator that you'd like to book a call to Russia. Say you are calling
from a payphone, and your number is that of the loser to fry (e.g. 445-5005).
She will say that she'll have to call ya back in 5 hours, and you OK that.
Meanwhile the loser (e.g.) Scott, will get a call at 3:00 AM from an operator
saying that the call he booked to Russia is ready.
156.International
Country Code Listing by The Jolly Roger
*UNITED KINGDOM/IRELAND ------------------------------------
IRELAND.........................353
UNITED KINGDOM...................44
*EUROPE ------------------------------------
ANDORRA..........................33
AUSTRIA..........................43
BELGIUM..........................32
CYPRUS..........................357
CZECHOLSLOVAKIA..................42
DENMARK..........................45
FINLAND.........................358
FRANCE...........................33
GERMAN DEMOCRATIC REPUBLIC.......37
GERMANY, FEDERAL REPUBLIC OF.....49
GIBRALTAR.......................350
GREECE...........................30
HUNGARY..........................36
ICELAND.........................354
ITALY............................39
LIECHTENSTEIN....................41
LUXEMBOURG......................352
MONACO...........................33
NETHERLANDS......................31
NORWAY...........................47
POLAND...........................48
PORTUGAL........................351
ROMANIA..........................40
SAN MARINO.......................39
SPAIN............................34
SWEDEN...........................46
SWITZERLAND......................41
TURKEY...........................90
VATICAN CITY.....................39
YUGOSLAVIA.......................38
*CENTRAL AMERICA ------------------------------------
BELIZE.........................«01
COSTA RICA.....................«06
EL SALVADOR....................«03
GUATEMALA......................«02
HONDURAS.......................«04
NICARAGUA......................«05
PANAMA.........................«07
*AFRICA ------------------------------------
ALGERIA.........................213
CAMEROON........................237
EGYPT............................20
ETHIOPIA........................251
GABON...........................241
IVORY COAST.....................225
KENYA...........................254
LESOTHO.........................266
LIBERIA.........................231
LIBYA...........................218
MALAWI..........................265
MOROCCO.........................212
NAMIBIA.........................264
NIGERIA.........................234
SENEGAL.........................221
SOUTH AFRICA.....................27
SWAZILAND.......................268
TANZANIA........................255
TUNISIA.........................216
UGANDA..........................256
ZAMBIA..........................260
ZIMBABWE........................263
*PACIFIC ------------------------------------
AMERICAN SAMOA..................684
AUSTRALIA........................61
BRUNEI..........................673
FIJI............................679
FRENCH POLYNESIA................689
GUAM............................671
HONG KONG.......................852
INDONESIA........................62
JAPAN............................81
KOREA, REPUBLIC OF...............82
MALAYSIA.........................60
NEW CALEDONIA...................687
NEW ZEALAND......................64
PAPUA NEW GUINEA................675
PHILIPPINES......................63
SAIPAN..........................670
SINGAPORE........................65
TAIWAN..........................886
THAILAND.........................66
*INDIAN OCEAN ------------------------------------
PAKISTAN.........................92
SRI LANKA........................94
*SOUTH AMERICA ------------------------------------
ARGENTINA.......................«4
BOLIVIA........................«91
BRAZIL..........................«5
CHILE...........................«6
COLOMBIA........................«7
ECUADOR........................«93
GUYANA.........................«92
PARAGUAY.......................«95
PERU............................«1
SURINAM........................«97
URUGUAY........................«98
VENEZUELA.......................«8
*NEAR EAST ------------------------------------
BAHRAIN.........................973
IRAN.............................98
IRAQ............................964
ISRAEL..........................972
JORDAN..........................962
KUWAIT..........................965
OMAN............................968
QATAR...........................974
SAUDI ARABIA....................966
UNITED ARAB EMIRATES............971
YEMEN ARAB REPUBLIC.............967
*CARIBBEAN/ATLANTIC ------------------------------------
FRENCH ANTILLES................«96
GUANTANAMO BAY (US NAVY BASE)...«3
HAITI..........................«09
NETHERLANDS ANTILLES...........«99
ST. PIERRE AND MIQUELON........«08
*INDIA ------------------------------------
INDIA............................91
*CANADA ------------------------------------
TO CALL CANADA, DIAL 1 + AREA CODE + LOCAL NUMBER. *MEXICO ------------------------------------
TO CALL MEXICO, DIAL 011 + 52 + CITY CODE+ LOCAL NUMBER. To dial international
calls: International Access Code + Country code + Routing code
Example :
To call Frankfurt, Germany, you would
do the following: 011 + 49 + 611 + (# wanted) + # sign(octothrope) The
# sign at the end is to tell Bell that you are done entering in all the
needed info.
157.The Infinity
Transmitter: by <<
FROM THE BOOK BUILD YOUR OWN LASER,
PHASER, ION RAY GUN & OTHER WORKING SPACE-AGE PROJECTS BY ROBERT IANNINI
(TAB BOOKS INC.) Description: Briefly, the Infinity Transmitter is a device
which activates a microphone via a phone call. It is plugged into the phone
line, and when the phone rings, it will immediately intercept the ring
and broadcast into the phone any sound that is in the room. This device
was originally made by Information Unlimited, and had a touch tone decoder
to prevent all who did not know the code from being able to use the phone
in its normal way. This version, however, will activate the microphone
for anyone who calls while it is in operation. NOTE: It is illegal to use
this device to try to bug someone. It is also pretty stupid because they
are fairly noticeable. Parts List: Pretend that uF means micro Farad, cap
= capacitor Part # Description ---- - ----------- R1,4,8 3 390 k ¬
watt resistor R2 1 5.6 M ¬ watt resistor R3,5,6 3 6.8 k ¬ watt
resistor R7/S1 1 5 k pot/switch R9,16 2 100 k ¬ watt resistor R10 1
2.2 k ¬ watt resistor R13,18 2 1 k ¬ watt resistor R14 1 470 ohm
¬ watt resistor R15 1 10 k ¬ watt resistor R17 1 1 M ¬ watt
resistor C1 1 .05 uF/25 V disc cap C2,3,5,6,7 5 1 uF 50 V electrolytic
cap or tant (preferably non-polarized) C4,11,12 3 .01 uF/50 V disc cap
C8,10 2 100 uF @ 25 V electrolytic cap C9 1 5 uF @ 150 V electrolytic cap
C13 1 10 uF @ 25 V electrolytic cap TM1 1 555 timer dip A1 1 CA3018 amp
array in can Q1,2 2 PN2222 npn sil transistor Q3 1 D4OD5 npn pwr tab transistor
D1,2 2 50 V 1 amp react. 1N4002 T1 1 1« k/500 matching transformer
M1 1 large crystal microphone J1 1 Phono jack optional for sense output
WR3 (24") #24 red and black hook up wire WR4 (24") #24 black hook up wire
CL3,4 2 Alligator clips CL1,2 2 6" battery snap clips PB1 1 1 3/4x4 «x.1
perfboard CA1 1 5 ¬x3x2 1/8 grey enclosure fab WR15 (12") #24 buss
wire KN1 1 small plastic knob BU1 1 small clamp bushing B1,2 2 9 volt transistor
battery or 9V ni-cad Circuit Operation: Not being the most technical guy
in the world, and not being very good at electronics (yet), I'm just repeating
what Mr. Iannini's said about the circuit operation. The Transmitter consists
of a high grain amplifier fed into the telephone lines via transformer.
The circuit is initiated by the action of a voltage transient pulse occurring
across the phone line at the instant the telephone circuit is made (the
ring, in other words). This transient immediately triggers a timer whose
output pin 3 goes positive, turning on transistors Q2 and Q3. Timer TM1
now remains in this state for a period depending on the values of R17 and
C13 (usually about 10 seconds for the values shown). When Q3 is turned
on by the timer, a simulated "off hook" condition is created by the switching
action of Q3 connecting the 500 ohm winding of the transformer directly
across the phone lines. Simultaneously, Q2 clamps the ground of A1, amplifier,
and Q1, output transistor, to the negative return of B1, B2, therefore
enabling this amplifier section. Note that B2 is always required by supplying
quiescent power to TM1 during normal conditions. System is off/on controlled
by S1 (switch). A crystal mike picks up the sounds that are fed to the
first two transistors of the A1 array connected as an emitter follower
driving the remaining two transistors as cascaded common emitters. Output
of the array now drives Q1 capacitively coupled to the 1500 ohm winding
of T1. R7 controls the pick up sensitivity of the system. Diode D1 is forward
biased at the instant of connection and essentially applies a negative
pulse at pin 2 of TM1, initiating the cycle. D2 clamps any high positive
pulses. C9 dc-isolates and desensitizes the circuit. The system described
should operate when any incoming call is made without ringing the phone.
Schematic Diagram: Because this is text, this doesn't look too hot. Please
use a little imagination! I will hopefully get a graphics drawing of this
out as soon as I can on a Fontrix graffile. To be able to see what everything
is, this character: | should appear as a horizontal bar. I did this on
a ][e using a ][e 80 column card, so I'm sorry if it looks kinda weird
to you. Symbols: resistor: -/\/\/- switch: _/ _ battery: -|!|!- capacitor
(electrolytic): -|(- capacitor (disc): -||- _ _ transistor:(c) > (e) Transformer:
)||( \_/ )||( |(b) _)||(_ diode: |< chip: ._____. !_____! (chips are
easy to recognize!) Dots imply a connection between wires. NO DOT, NO CONNECTION.
i.e..: _!_ means a connection while _|_ means no connection. ---------------------------------------------------------------------------¼-
.________________________to GREEN wire phone line | | .______________________to
RED wire phone line | | | | ._________(M1)______________. | | | | | | |
R1 | | | !__________/\/\/____________! | | | _!_ C1 | | |this wire is the
amp ___ | | |<=ground | R2 | | | !___________________/\/\/_____________.
| | | ._______!_______. | | | !___________________!4 9 11!_____________________________!
| | | | | | | | !___________________!7 12._____________________________!
| | | | A1 | R3 | | | !___________________!10 ____*8!_______.____/\/\/____________!
| | | | / | | | | | | C4 | / | \ |2ma | | !____||______. | / | /R4 B1 +
| | | || | | / | \ | | | | R7 | C2 | / | / | | | !____/\/\/___!__)|__!8*_/
| | S1 | | | | ^ | 6!_______! neg<__/.__! | | | | C3 | | | C5 return
| | | | !_____|(___.__!3 | '-|(-| | | | | | | 5 1!____________! | | | |
\ !_______._______! | B2| | | !________. R8 / | | + | | | \ | | R6 |3ma
| | | !__________!____________________|_____/\/\/______! | | | R5 | | |
| | !__/\/\/___________|____________________! | | | | | | | | | | | | |
| C6 | | | | | |-)|-' R9 | | | | !_________________/\/\/_______. | | |
| | | | | | | Q1 _!_ | R10 | | | !____________/ \____________________________!__/\/\/_____!
| | | | | | | | | | | | | C8 | | | | !__________)|_______________________________|____________!
| | ! | | | | / | | | | -----| | | | | | \ | | | | | > | | | | | | | |
| | | | | | | | | !_____________. | | | | | | | | | | !__________. | |
| | | | | | | | !________. | | ._____! | | | | | | | | | | | | | | | |
| | C7 | | | | | '-|(-| | | |_________|_________!_______.T1._________________|
| | | | 1500 )||( 500 | | | | ohm )||( ohm | | | !______.)||(.__. | | |
| | | | | | | | | | | > | | | | |/ | | | | +----| Q3 | | | | | |\ | !____________________|_________|_______|______!__.
D1 C9 | | | | '-|<---|(------| | .______________! | | | | | | | | |
| .________________! | | | | | | | | \ | .________________! C11 | | / |
| .___||____________! | R13 \ | | | || | | / | | | | | \ !___.___|_______________________!
| | | | | | | R16 | R15 | | v | | !___/\/\/\________!___/\/\/_! | neg |
| | D2 | | | return | | !_____|<__________! | | B1,B2 | \ | | | | |
/ | .____________!_. | | | \R14 |C12 | TM1 2 | | | | / !_||_!5 4!_______!
| | \ | || | | | | | | !____!1 8!_______! | | | | | 7 6 3 | | | | | | !_____._.____._!
| | | | | | | | | | | | | C13 | |als of the battery!! The batteries will
look something like this when hooked up: <-v_____. .______. ._____.
.____-> | | | | | | __!___!__ | | __!___!__ | + - | !_/ _! | + - | | |
switch ^ | | | 9volts| | | 9volts| !_______! neg return !_______! To hook
this up to the phone line, there are three ways, depending upon what type
of jack you have. If it is the old type (non modular) then you can just
open up the wall plate and connect the wires from the transmitter directly
to the terminals of the phone. If you have a modular jack with four prongs,
attach the red to the negative prong (don't ask me which is which! I don't
have that type of jack... I've only seen them in stores), and the green
to the positive prong, and plug in. Try not to shock yourself... If you
have the clip-in type jack, get double male extension cord (one with a
clip on each end), and chop off one clip. Get a sharp knife and splice
off the gray protective material. You should see four wires, including
one green and one red. You attach the appropriate wires from the IT to
these two, and plug the other end into the wall. Getting the IT to work:
If you happen to have a problem, you should attempt to do the following
(these are common sense rules!!) Make sure that you have the polarity of
all the capacitors right (if you used polarized capacitors, that is). Make
sure that all the soldering is done well and has not short circuited something
accidentally (like if you have a glob touching two wires which should not
be touching.) Check for other short circuits. Check to see if the battery
is in right. Check to make sure the switch is closed. If it still doesn't
work, drop me a line on one of the Maryland or Virginia BBSs and I'll try
to help you out. The sense output: Somehow or other, it is possible to
hook something else up to this and activate it by phone (like an alarm,
flashing lights, etc.)
158.LSD by The
Jolly Roger
I think, of all the drugs on the black
market today, LSD is the strangest. It is the most recent major drug to
come to life in the psychedelic subculture. (Blah blah blah... let's get
to the good stuff: How to make it in your kitchen!!) Grind up 150 grams
of Morning Glory seeds or baby Hawaiian wood rose seeds. In 130 cc. of
petroleum ether, soak the seeds for two days. Filter the solution through
a tight screen. Throw away the liquid, and allow the seed mush to dry.
For two days allow the mush to soak in 110 cc. of wood alcohol. Filter
the solution again, saving the liquid and labeling it "1." Resoak the mush
in 110 cc. of wood alcohol for two days. Filter and throw away the mush.
Add the liquid from the second soak to the solution labeled "1." Pour the
liquid into a cookie tray and allow it to evaporate. When all of the liquid
has evaporated, a yellow gum remains. This should be scraped up and put
into capsules. 30 grams of Morning Glory seeds = 1 trip 15 Hawaiian wood
rose seeds = 1 trip Many companies, such as Northop-King have been coating
their seeds with a toxic chemical, which is poison. Order seeds from a
wholesaler, as it is much safer and cheaper. Hawaiian wood rose seeds can
be ordered directly from: Chong's Nursery and Flowers P.O. Box 2154 Honolulu,
Hawaii LSD DOSAGES The basic dosages of acid vary according to what kind
of acid is available and what medium of ingestion is used. Chemically,
the potency of LSD-25 is measured in micrograms, or mics. If you're chemically
minded or making your own acid, then computing the number of micrograms
is very important. Usually between 500 and 800 mics is plenty for an 8
hour trip, depending on the quality of the acid, of course. I have heard
of people taking as much as 1,500-2,000 mics. This is not only extremely
dangerous, it is extremely wasteful. LSD comes packaged in many different
forms. The most common are listed below: The brown spot, or a piece of
paper with a dried drop of LSD on it, is always around. Usually one spot
equals one trip. Capsuled acid is very tricky, as the cap can be almost
any color, size, or potency. Always ask what the acid is cut with, as a
lot of acid is cut with either speed or strychnine. Also note dosage. Small
white or colored tablets have been known to contain acid, but, as with
capsuled acid, it's impossible to tell potency, without asking.
159.Bananas by
The Jolly Roger
Believe it or not, bananas do contain
a small quantity of _Musa Sapientum bananadine_, which is a mild, short-lasting
psychedelic. There are much easier ways of getting high, but the great
advantage to this method is that bananas are legal. Obtain 15 lbs. of ripe
yellow bananas. Peel all 15 lbs. and eat the fruit. Save the peels. With
a sharp knife, scrape off the insides of the peels and save the scraped
material. Put all of the scraped material in a large pot and add water.
Boil for three to four hours until it has attained a solid paste consistency.
Spread this paste on cookie sheets, and dry in an over for about 20 minutes
to a half hour. This will result in a fine black powder. Makes about one
pound of bananadine powder. Usually one will feel the effects of bananadine
after smoking three or four cigarettes. Table of Weights PoundsOuncesGramsKilos116453.60.45360.0625128.350.02830.00220.035210.0012.20535.271,0001
160.Yummy Marihuana
Recipes by The Jolly Roger
Acapulco Green 3 ripe avocados «
cup chopped onions 2 teaspoons chili powder 3 tablespoons wine vinegar
« cup chopped marihuana (grass) Mix the vinegar, grass, and chili
powder together and let the mixture stand for one hour. Then add avocados
and onions and mash it all together. It can be served with tacos or as
a dip. Pot Soup 1 can condensed beef broth 3 tablespoons grass 3 tablespoons
lemon juice « can water 3 tablespoons chopped watercress Combine
all ingredients in a saucepan and bring to a boil over medium heat. Place
in a refrigerator for two to three hours, reheat, and serve. Pork and Beans
and Pot 1 large can (1 lb. 13 oz.) pork and beans « cup grass 4 slices
bacon « cup light molasses « teaspoon hickory salt 3 pineapple
rings Mix together in a casserole, cover top with pineapple and bacon,
bake at 350ø for about 45 minutes. Serves about six. The Meat Ball
1 lb. hamburger ¬ cup chopped onions 1 can cream of mushroom soup ¬
cup bread crumbs 3 tablespoons grass 3 tablespoons India relish Mix it
all up and shape into meat balls. Brown in frying pan and drain. Place
in a casserole with soup and « cup water, cover and cook over low
heat for about 30 minutes. Feeds about four people. Spaghetti Sauce 1 can
(6 oz.) tomato paste 2 tablespoons olive oil « cup chopped onions
« cup chopped grass 1 pinch pepper 1 can (6 oz.) water « clove
minced garlic 1 bay leaf 1 pinch thyme « teaspoon salt Mix in large
pot, cover and simmer with frequent stirring for two hours. Serve over
spaghetti. Pot Loaf 1 packet onion soup mix 1 (16 oz.) can whole peeled
tomatoes « cup chopped grass 2 lbs. ground beef or chicken or turkey
1 egg 4 slices bread, crumbled Mix all ingredients and shape into a loaf.
Bake for one hour in 400ø oven. Serves about six. Chili Bean Pot
2 lbs. pinto beans 1 lb. bacon, cut into two-inch sections 2 cups red wine
4 tablespoons chili powder « clove garlic 1 cup chopped grass «
cup mushrooms Soak beans overnight in water. In a large pot pour boiling
water over beans and simmer for at least an hour, adding more water to
keep beans covered. Now add all other ingredients and continue to simmer
for another three hours. Salt to taste. Serves about ten. Bird Stuffing
5 cups rye bread crumbs 2 tablespoons poultry seasoning « cup each
of raisins and almonds « cup celery 1/3 cup chopped onions 3 tablespoons
melted butter « cup chopped grass 2 tablespoons red wine Mix it all
together, and then stuff it in. Apple Pot 4 apples (cored) « cup
brown sugar ¬ cup water 4 cherries 1/3 cup chopped grass 2 tablespoons
cinnamon Powder the grass in a blender, then mix grass with sugar and water.
Stuff cores with this paste. Sprinkle apples with cinnamon, and top with
a cherry. Bake for 25 minutes at 350ø. Pot Brownies « cup
flour 3 tablespoons shortening 2 tablespoons honey 1 egg (beaten) 1 tablespoon
water « cup grass pinch of salt ¬ teaspoon baking powder «
cup sugar 2 tablespoons corn syrup 1 square melted chocolate 1 teaspoon
vanilla « cup chopped nuts Sift flour, baking powder, and salt together.
Mix shortening, sugar, honey, syrup, and egg. Then blend in chocolate and
other ingredients, and mix well. Spread in an 8-inch pan and bake for 20
minutes at 350ø. Banana Bread « cup shortening 2 eggs 1 teaspoon
lemon juice 3 teaspoons baking powder 1 cup sugar 1 cup mashed bananas
2 cups sifted flour « cup chopped grass « teaspoon salt 1 cup
chopped nuts Mix the shortening and sugar, beat eggs, and add to mixture.
Separately mix bananas with lemon juice and add to the first mixture. Sift
flour, salt, and baking powder together, then mix all ingredients together.
Bake for 1 ¬ hours at 375ø. Sesame Seed Cookies 3 oz. ground
roast sesame seeds 3 tablespoons ground almonds ¬ teaspoon nutmeg ¬
cup honey « teaspoon ground ginger ¬ teaspoon cinnamon ¬
oz. grass Toast the grass until slightly brown and then crush it in a mortar.
Mix crushed grass with all other ingredients, in a skillet. Place skillet
over low flame and add 1 tablespoon of salt butter. Allow it to cook. When
cool, roll mixture into little balls and dip them into the sesame seeds.
If you happen to be in the country at a place where pot is being grown,
here's one of the greatest recipes you can try. Pick a medium-sized leaf
off of the marihuana plant and dip it into a cup of drawn butter, add salt,
and eat.
161.Peanuts by
the Jolly Roger
Try this sometime when you are bored!
Take one pound of raw peanuts (not roasted!) Shell them, saving the skins
and discarding the shells. Eat the nuts. Grind up the skins and roll them
into a cigarette, and smoke! You'll have fun, believe me!
162.Chemical Fire
Bottle by the Jolly Roger
This incendiary bottle is self-igniting
on target impact. Materials Required MaterialHow UsedCommon SourceSulphuric
AcidStorage BatteriesMotor Vehicles Material ProcessingIndustrial
PlantsGasolineMotor FuelGas Station Motor VehiclesPotassium
ChlorateMedicineDrug StoresSugarSweetening FoodsFood Store Glass
bottle with stopper (roughly 1 quart size) Small Bottle or jar with lid.
Rag or absorbent paper (paper towels, newspaper) String or rubber bands
Procedure: Sulphuric Acid MUST be concentrated. If battery acid or other
dilute acid is used, concentrate it by boiling until dense white fumes
are given off. Container used to boil should be of enamel-ware or oven
glass. CAUTION: Sulphuric Acid will burn skin and destroy clothing. If
any is spilled, wash it away with a large quantity of water. Fumes are
also VERY dangerous and should not be inhaled. Remove the acid from heat
and allow to cool to room temperature. Pour gasoline into the large 1 quart
bottle until it is approximately 1/3 full. Add concentrated sulphuric acid
to gasoline slowly until the bottle is filled to within 1" to 2" from top.
Place the stopper on the bottle. Wash the outside of the bottle thoroughly
with clear water. CAUTION: If this is not done, the fire bottle may be
dangerous to handle during use! Wrap a clean cloth or several sheets of
absorbent paper around the outside of the bottle. Tie with string or fasten
with rubber bands. Dissolve « cup (100 grams) of potassium chlorate
and « cup (100 grams) of sugar in one cup (250 cc) of boiling water.
Allow the solution to cool, pour into the small bottle and cap tightly.
The cooled solution should be approx. 2/3 crystals and 1/3 liquid. If there
is more than this, pour off excess before using. CAUTION: Store this bottle
separately from the other bottle! How To Use: Shake the small bottle to
mix contents and pour onto the cloth or paper around the large bottle.
Bottle can be used wet or after solution is dried. However, when dry, the
sugar-Potassium chlorate mixture is very sensitive to spark or flame and
should be handled accordingly. Throw or launch the bottle. When the bottle
breaks against a hard surface (target) the fuel will ignite.
163.Igniter from
Book Matches by The Jolly Roger
This is a hot igniter made from paper
book matches for use with molotov cocktail and other incendiaries. Material
Required: Paper book matches Adhesive or friction tape Procedure: Remove
the staple(s) from match book and separate matches from cover. Fold and
tape one row of matches (fold in thirds) Shape the cover into a tube with
striking surface on the inside and tape. Make sure the folder cover will
fit tightly around the taped match heads. Leave cover open at opposite
end for insertion of the matches. Push the taped matches into the tube
until the bottom ends are exposed about 3/4 in. (2 cm) Flatten and fold
the open end of the tube so that it laps over about 1 in. (2-« cm);
tape in place. Use with a Molotov Cocktail: Tape the "match end tab" of
the igniter to the neck of the molotov cocktail. Grasp the "cover and tab"
and pull sharply or quickly to ignite. General Use: The book match igniter
can be used by itself to ignite flammable liquids, fuse cords, and similar
items requiring hot ignition. CAUTION: Store matches and completed igniters
in moistureproof containers such as rubber or plastic bags until ready
for use. Damp or wet paper book matches will not ignite.
164."Red or White
Powder" Propellant by the Jolly Roger
"Red or White Powder" Propellant may
be prepared in a simple, safe manner. The formulation described below will
result in approximately 2 « pounds of powder. This is a small arms
propellant and should only be used in weapons with « in. diameter
or less (but not pistols!). Material Required: Heat Source (Kitchen Stove
or open fire) 2 gallon metal bucket Measuring cup (8 ounces) Wooden spoon
or rubber spatula Metal sheet or aluminum foil (at least 18 in. sq.) Flat
window screen (at least 1 foot square) Potassium Nitrate (granulated) 2-1/3
cups White sugar (granulated) 2 cups Powdered ferric oxide (rust) 1/8 cup
(if available) Clear water, 1-« cups Procedure: Place the sugar,
potassium nitrate, and water in the bucket. Heat with a low flame, stirring
occasionally until the sugar and potassium nitrate dissolve. If available,
add the ferric oxide (rust) to the solution. Increase the flame under the
mixture until it boils gently. NOTE: The mixture will retain the rust coloration.
Stir and scrape the bucket sides occasionally until the mixture is reduced
to one quarter of its original volume, then stir continuously. As the water
evaporates, the mixture will become thicker until it reaches the consistency
of cooked breakfast cereal or homemade fudge. At this stage of thickness,
remove the bucket from the heat source, and spread the mass on the metal
sheet. While the material cools, score it with a spoon or spatula in crisscrossed
furrows about 1 inch apart. Allow the material to dry, preferably in the
sun. As it dries, restore it accordingly (about every 20 minutes) to aid
drying. When the material has dried to a point where it is moist and soft
but not sticky to the touch, place a small spoonful on the screen. Rub
the material back and forth against the screen mesh with spoon or other
flat object until the material is granulated into small worm-like particles.
After granulation, return the material to the sun to allow to dry completely.
165.Pipe Hand
Grenade by the Jolly Roger
Hand Grenades can be made from a piece
of iron pipe. The filler can be of plastic or granular military explosive,
improvised explosive, or propellant from shotgun or small arms ammunition.
Material Required: Iron Pipe, threaded ends, 1-«" to 3" diameter,
3" to 8" long. Two (2) iron pipe caps Explosive or propellant Nonelectric
blasting cap (Commercial or military) Fuse cord Hand Drill Pliers Procedure:
Place blasting cap on one end of fuse cord and crimp with pliers. NOTE:
To find out how long the fuse cord should be, check the time it takes a
known length to burn. If 12 inches burns in 30 seconds, a 6 inch cord will
ignite the grenade in 15 seconds. Screw pipe cap to one end of the pipe.
Place fuse cord with blasting cap into the opposite end so that the blasting
cap is near the center of the pipe. NOTE: If plastic explosive is to be
used, fill pipe BEFORE inserting blasting cap. Push a round stick into
the center of the explosive to make a hole and then insert the blasting
cap. Pour explosive or propellant into pipe a little bit at a time. Tap
the base of the pipe frequently to settle filler. Drill a hole in the center
of the unassembled pipe cap large enough for the fuse cord to pass through.
Wipe pipe threads to remove any filler material. Slide the drilled pipe
cap over the fuse and screw hand tight onto the pipe.
166.European Credit
Card Fraud by Creditman!
UK credit card fraud is a lot easier
than over in the States. The same basic 3 essentials are needed: A safehouse.
Credit card numbers with Exp. date and address. Good suppliers of next
day delivery goods. The Safehouse The safehouse should be on the ground
floor, so as not to piss off the delivery man when he comes to drop off
your freshly stolen gear. If he has to go up 10 flights in a complete dive
and some 14 year old kid signs for an A2000 then he's gonna wonder! Make
sure there are no nosy neighbors, a good area is one full of yuppies 'cos
they all go to work during daytime. Safehouses are usually obtained by
paying a month's rent in advance or putting down a deposit of say, $200.
Either that or break into a place and use that. Credit Card Numbers The
card number, expiry date, start date (if possible), full name (including
middle initial), phone number and full address with postcode are ideal.
If you can only get the sirname, and no postcode, you shouldn't have any
real hassle. Just say you moved recently to your new address. Phone number
is handy, if it just rings and rings but if it doesn't, then make sure
it's ex-directory. You CANNOT get away with giving them a bullshit phone
number. Some fussy companies want phone numbers just to cross-check on
CARDNET but generally it's not needed. To recap, here's a quick check-list:
Card number and expiry date. Name and address of card holder. First name/initials
(OPTIONAL) Start date (OPTIONAL) Postcode (OPTIONAL) Phone number (OPTIONAL)
If you have all 6, then you shouldn't have any hassle. Start date is the
rarest item you could be asked for, postcode and initials being more common.
If you are missing 3-6 then you need one helluva smooth- talking bastard
on the phone line!!!! The Ordering Not everyone can order $1000's of stuff
- it's not easy. You have to be cool, smooth and have some good answers
to their questions. I advise that you only order up to $500 worth of stuff
in one go, but if you have details 1-6 and the phone number will NOT be
answered from 9 to 5.30 P.M. then go up to $1000 (make sure it's a GOLD
card!). When getting ready to order make sure you have at least 3 times
the amount of suppliers you need e.g. if you want to card 5 hard-drives,
make sure you have 15 suppliers. A lot of the time, they are either out
stock, can't do next day delivery or won't deliver to a different address.
Quick check list of what you must ask before handing over number: Next
day delivery, OK? Ordered to different address to card, OK? Do you have
item in stock (pretty obvious, eh?) Make sure you ask ALL of these questions
before handing over your precious number. Excuses Usual excuses for a different
address are that it's a present or you're on business here for the next
5 weeks etc. Any old bullshit why it won't go to the proper address. WARNING!
Invoices! WARNING! Invoices are sometimes sent out with the actual parcel
but they are also sent out to the card owners (why do you think they need
the address for?) so using a safehouse for more than 2 days is risky. A
1 day shot is safe, if they catch on then they'll stop the goods before
getting a search warrant. Credit Limits Limits on cards reach from $500
to $4000 on Gold cards. Your average card will be about $1000-$1500. It
takes a while to build up a good credit rating in order to have large limits
so don't think every card will hold 12 IBM 386's! Visa and Access are always
used - American Express etc. are USELESS. Access = Eurocard, Mastercard
(begins with 5) Visa = (begins with 4, 16 digit is a Gold) A general rule
is, always confirm an order to make sure credit is cleared. As the month
goes on, credit is used up - the bad times are from 27th - 3rd which is
when all the bills come in. Best time to card is around 11th or 12th, when
the poor guy has paid off his last bill so you can run up a new one (he,
he, he!). Ideal items to card The best stuff is always computer hard-ware
as it's next-day. Amigas, ST's, PC's - anything really. Blank discs are
a waste of time, they're too heavy. External drives, monitors - good stuff
basically. Don't order any shit like VCR's, Hi-Fi, video-cameras, music
keyboards, computer software, jewerely or anything under $300. You'll find
the listed items are difficult to get next day delivery and usually won't
deliver to a different address - bastards, eh? You're wasting your time
with little items under $300, try to keep deliveries under 10 a day. The
drop - Two ways of doing the drop Sign for all the gear (make sure you're
there between 9.00 and 5.30 P.M.) Don't turn up till around 6.30 P.M. and
collect all the cards that the delivery man has left. These usually say
'you were out at XX time so could you please arrange new time for delivery
or pick up from our depot'. In that case, piss off to the depot and get
all the gear (need a big car!). Remember, carding is ILLEGAL kiddies, so
don't get caught.
167.Potassium
Bomb by Exodus
This is one of my favorites. This creates
a very unstable explosive in a very stable container. You will need: A
two-ended bottle. These are kinda hard to find, you have to look around,
but if you cant find one, you will need a similar container in which there
are two totally separate sides that are airtight and accessible at the
ends, like this: !airtight separator! ________________!_________________
| | | / | \ ---- | ---- | c | | |c | | a | | | a | |___p| | |__p_| \ |
/ | | | -----------------|------------------ the separator MUST remain
airtight/watertight so this doesn't blow off your arm in the process (Believe
me. It will if you are not exact.) Pure potassium. Not Salt Peter, or any
shit like that. This must be the pure element. This again may prove hard
to find. Try a school chemistry teacher. Tell her you need it for a project,
or some shit like that. Try to get the biggest piece you can, because this
works best if it a solid chuck, not a powder. You can also try Edmund Scientific
Co. at: Dept. 11A6 C929 Edscorp Bldg. Barrington, NJ 08007 or call 1-(609)-547-8880
Cotton Water Instructions: Take the cotton and stuff some into one end
of the container lining one side of the separator. Place some potassium,
about the size of a quarter or bigger (CAREFULLY, and make sure your hands
are PERFECTLY DRY, this stuff reacts VERY VIOLENTLY with water) into that
side and pack it in tightly with all the cotton you can fit. Now screw
the cap on TIGHTLY. On the other side of the separator, fill it with as
much water as will fit, and screw that cap on TIGHTLY. You are now in possession
of a compact explosive made somewhat stable. To explode, throw it at something!
The water will react with the potassium, and BBBOOOOOOMMMM!!! Works great
on windows or windshields, because the glass fragments go everywhere (stand
back) and rip stuff apart. The bigger the piece, the bigger the boom. If
no potassium can be found, try looking for PURE Sodium, it works well too.
PS: You could also place this little sucker under the wheel of a car of
someone you hate...(Wait till' they back over that one!!!)
168.Your Legal
Rights by Exodus
Because you possess this little collection
of mostly illegal concepts, you should be aware of your legal rights IF
arrested (hey, it happens to the worst of us). Your Legal Rights are: Have
a hearing before a magistrate or judge, as soon as possible after you are
arrested. Be notified of the charges against you. Have a reasonable bail
set, if bail is granted. Have a FAIR, IMPARTIAL trial by jury. Be present
at all stages of the trial. Confront your accusers. (without the baseball
bat) Have your lawyer cross-examine the witnesses. Have your lawyer call
on witnesses on your behalf. Be tried for a crime only once. Receive neither
cruel nor unusual punishment if you are convicted of a crime and sentenced.
NOTE!!!: These rights are for after you are arrested, and do not include
the reading of the rights, etc. If these rights are violated in ANY way,
that may be cause for a mistrial, or even total release.
169.How The Law
Protects Juvenile Offenders by Exodus
Juveniles accused of breaking the law
are granted some special rights intended to protect the, because of their
age. If a juvenile is charged with a crime punishable by a term in a reform
school or juvenile detention facility, he is assured the right to: Remain
silent, and not incriminate himself/herself. Be placed in quarters separate
from adult offenders while being held in custody. Be notified before a
hearing of the charges against him. Be released to his parents or guardians
after signing a written promise to appear at his trial (unless the child
is likely to run away and not come back to court unless he is dangerous
or may himself be in danger if sent back home). Be tried at proceedings
that are closed to the public. Have a record of the proceedings made, in
case one is needed for a future appeal. Be represented by a lawyer. Have
a lawyer appointed by the court if he cannot afford one. Confront his accusers.
Have his lawyer cross-examine witnesses. Again, these rights are for after
you have been arrested.
170.Down the Road'
Missile by Exodus
This missile is aptly named because
it travels best down a street or road. This is nothing more that harmless
phun intended to scare the living shit out of oncoming cars. How To Make
A Missile All you need are: Hairspray can, or something else with flammable
propellant (don't use spraypaint dipshit, it makes a big mess!) book of
ordinary matches tape (clear if possible, its thinner) BB or pellet gun
(use BB's if possible) Instructions: Tape the book of matches to the bottom
of the can, y'know, the CONCAVE part. You might want to arrange the matches
so that they are spread over a wide area of the bottom of the can, but
close together. Shake the can up vigorously. Now place the can on its side
with the nozzle of the can pointed in the direction you want it to go,
down a road, off a ramp, at your sister, etc.. Now stand back a bit, and
shoot at the matches. It should take off at about 30 ft per sec!! What
happens in case you couldn't tell, is the BB hits the matches and causes
a spark, and at roughly the same time, punctures the weak bottom of the
can. As the propellant sprays out, it hopefully comes in contact with the
spark, and presto. If you don't do it right you'll blow a lot of money
because each can only be used once, so experiment to find best results.
In The Air Missile: Compile the rocket as stated before, and put it vertical
on a stand of some sort with the bottom accessible. Place a section of
PVC pipe 95ø preferred and shoot into the PVC pipe which should
direct the BB upward, and the can should take off. Experiment w/ different
cans, its hard to find ones that work perfectly, and still go higher than
30 ft.
171.Phun With
Shotgun Shells by Exodus
This phile is for those have no concern
for themselves or the person they wanna fuck over with this. (in short,
a fucking MANIAC!!!) DoorBlams Shotgun shells are wonderful. They can be
used in almost any situation where pain or amputation of limbs is concerned
(including your own if you are not EXTREMELY careful. The best way to use
shells, is the DoorBlam. The DoorBlam is a simple concoction of a shell
taped to the back of a door with the ignition button facing away from the
door (so it blows out against the door). Now position it somewhere where
it will do the damage you want. i.e.- near the top for decapitation, middle
for slow death, or low to make the victims kneecaps fly across the room.
Now tape a thumbtack against a wall or something that that part of the
door bumps up against. Tape it to the wall so that the point pokes through
the tape, and position it so it will hit the ignite button upon impact...
Its that simple. Instant pain! Long Range Explosives These are THE most
difficult explosive I have ever tried to make (people I know have lost
fingers and hands to this little fucker) IF you have a VVVVERY still hand,
it might be accomplished. Ignite buttons usually take some force to make
it blow, so CAREFULLY & LIGHTLY push a tack through tape and tape it
to the back of the shell, with the tip of the tack LIGHTLY touching the
button. Add more tape to the back to hold the pin in place. If you still
have hands at this point, consider yourself lucky. Now you need to add
a weight to the tack-end part to make sure it hits the ground first. Taping
small rocks or making the shell by putting heavy loads towards the button
helps. Placing a cracker (yes a cracker (Saltines, anyone ?)) between the
tack-point and the button helps prevent detonation upon THROWING, which
DOES happen. Now toss it up high and AWAY from you, and RUN LIKE SHIT does
after you eat Mexican.
172.Electronic
Accessories by Exodus
Some phreaks believe in the down-n-dirty
customizing of equipment by crafting it themselves...not me! I believe
that the other guy should build the stuff, and I'll steal it and use it
later. This is a list of places where one can obtain the devices that would
other wise have to be built by hand. But after all, a good phreak can take
a pre-made item and adapt it to his needs..... Radar Jammers: The "Eclipse"
$199.00 T.E.K. Distributors PO Box 32287 Fridley, MN 55432 (612)-783-1666
Surveillance: fone bugging, fone recording sys., etc... EDE catalog $5
PO Box 337 Buffalo, NY 14226 (716)-691-3476 USI Corp., catalog: $2 PO Box
PM-2052 Melbourne, FL 32902 (407)-725-1000 Protector catalog $5 PO Box
520294-M Salt Lake City, UT 84152 (801)-487-3823 FREE catalog: 1-800-732-5000
SpyMart catalog $4 PO Box 340-M Morehead City, NC 28557 MICRO-VIDEO: SUPERCIRCUITS
catalog $3 13552 Research Blvd. #B-2 Austin, TX 78750 Scanners: CRB FREE
catalog PO Box 56 Commack, NY 11725 HPR PO Box 19224PM Denver, CO 80219
(request information, I guess!?) MISC: INFORMATION UNLIMITED <<<---REALLY
COOL SHIT, THE GOOD STUFF. PO Box 716, Dept. PM294 (kinda expensive, so
get ready to Amherst, NH 03031 CARD!!) FREE catalog (w/order, otherwise
$1.00) EDMUND SCIENTIFIC (always a fucking GREAT place to find the little
Dept. 14D2, nitty-gritty electronics that make up C908 EdsCorp Bldg. colored
boxes, and the like) Barrington, NJ 08007
173.Drip Timer
by Exodus
Another method of time delay for explosives
that are detonated by electric means, is the drip timer. Fill a 'baggy'
with water and then add as much salt as the water will hold. Seal it, leaving
some air inside. Then, tape the two contact wires from which the circuit
has been broken, to the inside of a large cup. Place the baggy on the cup.
Poke a hole in the top of the 'baggy', where there is air, and then make
a hole in the bottom to let the water drain into the cup. As any Einstein
figures, the salt water level in the cup will eventually conduct electricity
at the moment both wires touch water, thus completing the circuit. I have
yet to try this timer out, and I got the plans from a total idiot, phreaker
nonetheless, and doubt it would work with any power source under 12v.
174.Stealing by
Exodus
It is strange just how many files there
are out there that try to document the art of stealing. After all, it IS
an art. You have to be calm, smooth, persistent, patient. Stealing is not
an overnight-planned operation. You should try to prepare for at least
a week or more when planning to steal from a house, and even LONGER when
from a business. Story time, kiddies: A long time ago, well, in the past
year, my friends and I noticed that the building complex in our town was
the perfect place to obtain unpaid-for items. We learned all we could about
the complex, which was about 365,000 sqft, and each company consisted of
an office (fully furnished with cool computer stuff), and a 10,000 sqft
(roughly) warehouse, all interconnected, and all one level. This information
was obtained through several calls to the town committee (board of development,
or some shit like that, the place that you call for building permits, and
the like.), and we obtained the blueprints for the whole complex. We planned
a route from the side entrance through the warehouse, and into the offices,
where all the good stuff is usually located. Now that we had our route,
all we needed was a plan to get inside. Since this was our first major
job, we spent a few good weeks on preparation. During the snow weather,
we worked w/ a company to shovel the sidewalks of the complex. One night,
at about 11 PM, we stopped shoveling in front of our planned job site,
Campbell's Soup, Co. There was nobody there except the janitors that cleaned
up the place (or so we thought). I asked the janitor if I could use the
bathroom (I did have to go too) and he let me in. I must have surprised
him when I knew exactly where the bathroom was! As I walked to it, I scanned
for video cams, infrared guns/receivers (little boxes at entrances with
a black glass square about 1" sq. at about knee height on each side). Nothing.
The doors all had security magnetic detection at the tops, and also the
windows. To think someone would break in through an obvious place like
a large window, stupid. To my surprise, there were a few losers working
late, and didn't really care that I was there at all. Take another Viverin'
guys, I won't be here long. The smell of black coffee was stifling. The
bathroom was located back by the office's entrance to the warehouse, and
to my surprise, it was unlocked! The lights were on, and the place was
totally empty, except for a few cardboard remains, and shelves, and that
blessed side door. I walked over to the door to examine it. No security,
no video cams in the warehouse, no nothing. Odd, usually these warehouses
were kept tight as a hookers pussy. But it looked like they were packing
up to move somewhere. Boxes on the office desks, etc.. The door was locked
with a key deadbolt (pain to pick) and a regular door-knob key lock. No
problem. I needed to stop that deadbolt from being locked, so I looked
around for something to use....aha! There was some strange material like
alum. foil on the ground, pliable, yet of a black color. I took out a small
allen key (a thief never goes ANYWHERE without a small lockpicking tool)
and crammed enough of the stuff into the keyhole so that a key could not
be inserted far enough to turn, and the stuff was in to far to be pulled
out. Viola! Back to the point of this story. When the time came to make
our move, something strange happened. The place was abandoned for 3 days
straight, most office equipment removed, and the front door left ajar,
for all 3 days. We still decided to enter via our planned route. At 1:30
AM we went to the side door, and what a surprise, the deadbolt lock was
open. Now to the knob lock. It was still locked, but not a problem. Knob
locks usually look like this: |-wall socket> --------------------------
| ) d -------------------------------| o | | o | ) r | ) | ) -------------------------
| |-wall socket> The top sliding piece is about ¬" wide on popular
locks, with the bar facing you, if the door swings outward. With the smallest
allen key you can get, stick it in and repetitively push and slide it back
towards the knob, but don't let go, because it is spring loaded and will
snap back into place again. Now for the larger bar. Take another key and
wedge it into the slot where the bar enters the other wall (without the
knob on it)! and do the same thing. This will be considerably harder to
do than with the small tongue, but if you practiced like you should have,
it will open with minimum effort. Now we were inside. We ran through the
warehouse though the warehouse/office door (these are rarely locked, but
try to prepare for it ahead of time by "cramming the lock" like I did)
and into the office. The place was empty, no shelves, just desks, chairs,
and boxes. The boxes contained modems, motherboards, bus cards, printers,
cables, fone cable, and one contained a Zenith laptop computer! No shit,
this is a true story! We took everything we could carry (5 people). We
took all the above mentioned, as well as printer toner, fones, fone jacks,
documents, desk chairs, insulated boxes and bags (static-free kind), even
the little shit things, like outlet plates, light bulbs, ANYTHING!!! We
went really crazy, and were out in 2 min 30 sec.(always set a time limit)
We wound up throwing half the shit away, but it felt great just to take
anything that was not ours!! I have since then done other "jobs" with much
more precision, and effort, as well as better rewards. Here are some tips
that should be followed when attempting to steal: WEAR GLOVES!!!!!!!!!!
Backpacks for everyone to put the loot in. Always case the joint for at
least a week and keep documented records of who leaves when, what time
it closes, timed lights, etc... Have at least 4 phriends with you, and
,please, make sure they know what they are doing, no idiots allowed! Bring
tools :small allen keys, both types of screwdrivers, standard size, and
tiny, hacksaw blade, wire cutters and strippers, spraypaint-to leave your
handle on the wall, hammer, mace, gun-if available, flashlights (duh),
wire-good for re-routing door security, and bolt cutters. Designate a person
to carry all the tools ONLY-don't have him pickup stuff and mix it with
the tools, this will only slow you down later if you need to look fir a
tool quickly. Designate a person to STAY PUT by the door and keep watch.
Designate a timer, one who has a lighted stopwatch. Make runs NO LONGER
THAT 3 MIN. EVEN THIS TIME IS EXTREMELY HIGH-TRY TO KEEP AS LOW AS POSSIBLE.
Getaway vehicle (preferably NOT a van or pickup truck, these will be very
suspicious to the pigs..er.I mean cops. And don't speed, or anything, this
just attracts attention. Cover license plates till just before you get
your asses going, so no one can report the plates to the pigs..oops!, damn,
did it again, cops. Make sure you remove covering before leaving. Always
keep flashlights pointed DOWN unless necessary, crawl under windows, no
shouting, even if you find some phucking cool shit, on second thought,
maybe painting your handle is a little stupid, so forget that, wear dark
clothes OVER regular, non-suspicious clothes (get changed first thing in
the car) Never brag about your findings in public, only on modem, or on
BBS, and never give names of places, phriends, and exact names of things
taken, (just say you 'borrowed' a 486DX 33 motherboard, don't say is a
Intel 486DX 33 MHz for an IBM PS/1 model 50, serial #XXXXXXXXXXXX. that
is just plain dumb) Have phun!! and never steal from your neighborhood.
If you break into houses, never move stuff around; the longer it takes
the yuppie family to realize that you were there, the better. WEAR GLOVES!!!!!!!!!!!!!
To get in windows: shoot window with BB gun, and place clear, sticky hard-cover
book covering on the window over the hole, hopefully the impact of the
shot was enough to crack the glass, and LEAN OR PUSH on the covered glass,
do not hit or kick, and you will see that the majority of the glass will
stick to the covering, and will make considerably less noise. Enter through
basement windows preferably under a deck or steps. MAKE SURE THE PEOPLE
WILL BE GONE FOR THE NIGHT AND THE NEIGHBORS ARE ASLEEP (GO FOR AROUND
2:30 AM) Take stuff that will sell easily to friends, and don't waste time
taking things that look neat, just take the basics: electronic, computer,
TV, VCR, some jewelry-things you could easily hock, preferably without
inscriptions, raid the fridge, take good quality fones, stereo equip.,
speakers, etc.. Always case the outside of the house looking for security
stickers that yuppie families like to place in full view. Do mischievous
shit like cut all fone lines in house, cut up couch cushions, and flip
them over so they look perfectly normal!; shoot a hole in their fish tank,
(all yuppies own fish); slash clothes, then put them back into the drawer;
unplug fridge; set thermostat way up to 99.9ø; leave drain plugged
and let the faucet run just a little, (for 6 hours!!); whatever you can't
take or carry out, destroy in a subtle way, -if you can't carry out those
130 lb. wood case stereo speakers, slash the cones; break ball-point pens
open and rub them into the carpet with their shoes; run a magnet over audio
and VCR cassettes and floppies, and anything else subtle that would brighten
their day.
175.MISCELLANEOUS
INFORMATION by Exodus
Easy explosive: Fill Kodak film case
(y'know, the black cylinder with the gray cap) with explosive of your choice.
Drill hole in gray lid, insert fuse, and tape it back together very tightly.
Light. -or- Poke a hole it the gray cap facing outwards, and insert an
M-80 with fuse going through the hole and reseal, taping it tightly ALL
AROUND the case. Place in plastic mailbox, light, close door, and get the
hell away! Because of the tight airspace, the destructive power of the
explosion is increased 5X. Works under water too, with a drop of wax, or
preferably rubber cement around where the cap and wick meet. -and- Fill
a GLASS coke/pepsi bottle with 1 part gas, 1 part sugar, & 1 part water.
Wedge an M-80 into the top about halfway. Shake the container, place in
mailbox (hopefully with mail {hehe!}) light, and get the fuck away. This
thing sends glass shrapnel EVERYWHERE, including through their mail. Doorknob
Shocker: Run a wire from one slot in wall outlet to the bracket in the
wall that the knob's tongue inserts into. Run another wire from the other
slot to an inconspicuous spot on the DOORKNOB. How does that one *grab*
you? Phone Loops: (remember, tone + silence = connection) NUMBER | Tone/Silence
(T/S) End | STATUS (on connection) ---------------------------------------------------------------------
?-???-???-???? S no match 1-619-748-0002 T definite tone x-xxx-749-xxxx
T definite tone ?-???-???-???? S no match 1-619-739-0002 T definite tone
x-xxx-xxx-xxx1 S not sure of match x-xxx-738-0002 T definite x-xxx-xxx-0020
S definite x-xxx-7xx-0002 T definite ?-???-???-???? S no match Actually,
any 1-619-7x9-000x gives tone detect, finding the other silent connection
is a wee bit harder. If anyone manages to complete some of these, or any
loops, please let me know. The only bad thing about loop lines, is that
eventually the Gestapo finds out about the over-use of the line, and assigns
the number to anyone who wants a new number for their fone. Then when phreaks
begin to use the line again, thinking it is a loop, they get a pissed off
yuppie who then has the call traced, and that's like putting your balls
right in a door and slamming it. The operator will complain in your face,
and say some bullshit like she has your number and will report any disturbances
to the fone co. if she sees it again. Simple Virus/Easy Way To Return A
Copied Program (hehe!) When you buy a game, or something from a computer
store, copy it, and want to return it (I know all of you do this), sometimes
all the store does is re-cellophane it and it goes back on the shelves
without being re-tested. If the original floppies have an AUTOEXEC.BAT
file on them to initiate the copying/decompression at boot-up, simply edit
it to say: cd\ del c:*.* y That'll make someone's day real funny, especially
if the store tries to test it. Or, in most cases the store will not accept
returned merchandise if it is not defective, so DEFECT IT. This is done
by using a program that shows the date and time the originals were last
modified (check for this BEFORE installing the program!!!!!!) such as DosShell,
or XTGold. Then set the date and time on your computer to match the originals
date and time (approx). Install the program, and/or copy the originals
and manuals. Now fuck around with the decompression file (usually PKUNZIP),
the installation file, and any others you see. Now the store has no reason,
and MUST accept the product as a return, or sometimes they will give you
a return check for the $$, and send the program back to the manufacturer,
which is good, because it will then be recopied, resealed, and put back
on the shelves somewhere for another phreaker to HACK!! (If the above date/time
matching is too much of a pain for the really retarded out there, set your
computer date/time to any past ones close to the originals, and fuck with
ALL the files, thus making them all match.) Battery Bombs: Batteries like
Duracell, Eveready, Energizer, etc... are specially made for home use and
will not under any condition, explode when simply connected to each other.
Therefore, generic batteries are required. These batteries can be obtained
in hick country, or from a shitty wholesaler. I've heard of phriends putting
9Vs in the fucking microwave for a minute or so, and this is supposed to
disable the "exploder protector", but anyone who puts batteries in a microwave,
should have the batteries explode on them. I never found out if 2 9v batts
connected really do explode. I hope so. Any Blue Boxers?? Not many people
use blue boxes these days. They've become an eminent danger to phreakers.
Ma Bell has new equipment to detect the use of tone-emitting boxes, and
about the only safe place to box calls from is the handy-dandy pay phone
at the end of the block. The only way to box calls today is to switch off
to another switching system with another number: i.e.- Call a store like
Toys-'R'-Us, (1-908-322-6065 Livingston, NJ) and ask for the technical
(video game) department. This switches the number from the above to the
extension of the department, usually and extension, but it can be a totally
different # you are sent to while you are on hold. This is VERY good. Bullshit
the employee at the tech dept., and wait for HIM to hang up first. That
disconnects you from his department, but not from the interconnections
of the store. (It might even be possible to dial a number and get another
department at this point). This is like 'stacking' trunks. Their dialtone
(inside the store) may have a slightly higher/lower pitch than a dialtone
at your house. This is what you want. Now, blow 2600 across the line, and
you should have access to a trunk, and Bell Labs think that the store did
it, and it is not usually questioned because the computer might think that
it is part of their paging system. (not 100% sure, test around) When someone
(preferably who you don't give a shit about) calls, dial *69 to ring him
back(If your area subscribes to this feature). What should happen is that
the *69 tone asks the Bell computer to call back the person. The COMPUTER
does the calling at this point. Now when your friend picks up, bullshit
him into hanging up first. Now the computer is getting the dialtone first,
then it passes it on to you. If you blow 2600 at this point, the computer
may think it is its own equipment doing the calling. I'm REALLY not sure
about this one. Hopefully this one works, but I can't test it because some
fucked up, shit full, douche nozzle, pig fucker broke my MF box.
176.Shaving Cream
Bomb by Exodus
This may not really be what we would
consider a bomb, but it is a helluva great idea to phuck someone over.
You will need: (1) Person you hate who has a car. (1)-Container of liquid
nitrogen (try a science shop, or Edmund Scientific, mentioned in several
places in this Cookbook) (6-10)-Cans of generic shaving cream. (1)-Free
afternoon (preferably in FREEZING temperatures outside) (1-or more)-Pairs
of pliers, for cutting and peeling. Some phriends. Directions: Find someone
who owns a small compact car, and manage to find out where he keeps it
at night (or while he is away!) Be able to open the car repeatedly.. Place
a can in the liquid nitrogen for about 30 sec. Take it out and carefully
and QUICKLY peel off the metal outside container, and you should have a
frozen "block" of shaving cream. (It helps to have more than one container,
and more phriends) Toss it into the car and do the same with all the cans.
A dozen or more "blocks" like this can fill and lightly PRESSURIZE a small
car. When he opens the door (hopefully he doesn't realize the mess inside
due to the foggy windows), he will be covered with pounds of shaving cream
that is a bitch to get out of upholstery. PS!- Try to get one is his glove
compartment!!!!!
177.Another good
way to rip off a change or drink machine by d lsh
You first get a nice new dollar to
work with. Make sure there are no rips in it. Now, you get a thin piece
of transparent plastic about 3/4 the width of the actual dollar. It must
be a good 6" or longer. Next, you need some transparent tape. Scotch magic
tape will work the best. You simply tape the plastic strip to the dollar.
But, you must be careful not to tape it more than «" up the side
of the dollar. Tape it on both sides (front and back, not top and bottom)
of the dollar. Now, all you have to do is use it: Walk casually up to the
secluded machine. Take out your dollar, and put it into the machine. BE
CAREFUL! Some of the more modern change machines have alarms! Most likely,
though, drink or candy machines will not. Now, the machine starts taking
your dollar.... You wait until your plastic strip is almost all the way
into the machine, and then you pull with sufficient force to get the dollar
out of the machine, but not rip it. If you did it correctly, you should
have gotten whatever you bought, and still have your dollar for later use.
On candy machines, though, make your selection, and then wait and pull
the dollar out. Don't worry if you don't get it on the first few tries.
It took me about 5 tries to master it. It DOES, I repeat DOES work for
a fact if done correctly. If you just can't get it, though, either the
machine is too sophisticated, or you put the tape up too high on the dollar.
Have fun!!!!
178.Lockpicking
for the EXTREME beginner... by d lsh
This is really a good method for opening
doors that are locked. The only problem with this, though, is that it only
works for outward opening doors. OK, here we go.... Realize you are not
working with the actual lock, but that thing that sticks between the door
and the wall. See how that thing is curved on one side? Well, that is what
we will be making use of. Acquire a large paper-clip. If it is too short,
it won't work. You have to also have a shoelace. Now, onto the construction...
Straighten the paper-clip. Loop one end of the paper clip around the shoelace.
The shoelace should be about 4/5 on one side of the clip and 1/5 on the
other. Let's see if I can draw it. ------------------*************************************
-* ******* --- is the paper clip *** is the shoelace That's not very good,
but I hope you get the picture. All you have to do now is curve the paper
clip (no, I won't draw it) With the curved paper-clip, stick it between
the door and the wall, behind the metal thing that sticks between. Feed
it through with you hand, until you can grip both sides of the shoelace.
Now, simply pull the lace and the door at the same time, and VIOLA! the
door is open. I prefer this over regular lock-picking if the door opens
outward, because it is a lot quicker. Lock picking can take 5 minutes...
When done correctly this only takes 30 seconds! So, if you can, use this.
179.ANARCHY 'N'
EXPLOSIVES - PRELUDE VOLUME by Exodus
For you people that like blowing things
up and shit like that, here's something that's not as dangerous or as difficult
as more of the explosives available (or able to create)... It's called
the LNý Bomb (Short for Liquid Nitrogen Bomb). Very easy to make:
Ingredients: 1 Plastic Two Liter Bottle Enough Liquid Nitrogen To Fill
The Bottle Instructions: Fill the bottle with liquid nitrogen. Then cap
as tightly as possible. The vaporization of the nitrogen will create enough
pressure in the bottle (within 5-15 minutes) to break it with a quite strong
explosive force... Very Easy... USE AT YOUR OWN RISK.... 800 #'s to phuck
with Compiled by The Duelist CALL JYER INC. xxx-xxx-xxxx Numbers with a
? either call forward to take you on some trip through switches, but I'm
sure if you fuck around with it enough you will get there tone somewhere.
Have fun....... Later! 800- 4261244 ? 6456561 VMS 2471753 ? 5244040 ? 6348026
? 6677827 ? 8723425 ? (Extension dialer) 9928911 ? Modem 6242367 VMS (#)
4262468 ? 3389549 VMS 2220400 ? 5376001 ? 3439255 VMS (#) 8326979 ? 2339558
VMS 7299000 ? 5335545 ? 3332222 ? 3335555 VMS 3338888 ? =========== TOLL-FREE
NUMBERS AND ON-LINE DATABASES ========== There are many toll-free assistance
numbers and on-line databases available to federal, state, local, and private
sector personnel. Some may be available through a federal or state agency,
while others are publicly available on commercial systems or through private
organizations. Except for their own, neither DOT nor FEMA endorses the
following toll-free telephone numbers or on-line databases. Federal and
State Toll Free Technical Assistance Sources Private Sector Toll Free Technical
Assistance Federal and State Agency Online Databases Commercial and Private
Online Databases FEDERAL AND STATE TOLL FREE TECHNICAL ASSISTANCE SOURCES
US Coast Guard - National Response Center: 1-800-424-8802 in Washington,
DC - (202)426-2675 (202)267-2675 EPA REGIONAL HOTLINES EPA has now established
a Hotline in each of it's regional offices to handle Title III reporting.
Please make note of the number for the office in your area. Nation-wide
- (800) 535-0202 In Alaska and DC - (202) 479-2449 In the Regional Offices:
Region I - Boston, MA - (617) 565-3273 Region II - Edison, NJ - (201) 321-6765
Region III - Philadelphia, PA - (215) 597-1260 Region IV - Atlanta, GA
- (404) 347-3222 Region V - Chicago, IL - (312) 886-6418 Region VI - Dallas,
TX - (214) 655-7244 Region VII - Kansas City, KS - (913) 236-2806 Region
VIII - Denver, CO - (303) 293-1730 Region IX - San Francisco, CA - (415)
974-7054 Region X - Seattle, WA - (206) 442-1270 Remember to report all
hazardous materials releases to your Local Emergency Planning Committee
representative and to your State Emergency Response Commission immediately!
TOXIC RELEASE INVENTORY REPORTING CENTER EPA has established a reading
room in the Toxic Inventory Reporting Center (TRC) located at 470 L'Enfant
Plaza East, SW, Suite 7103, Washington, DC 20024. The reading room provides
a place for concerned citizens to review release data as supplied to the
Environmental Protection Agency (through section 313 reporting). To date,
the center has received more than 50,000 of the 300,000 release reports
anticipated. The TRC's is intended to serve as a central receipt point,
aid in the sorting recording and storage of release data reported under
Title III. Additionally the TRC is to provide an easy method to facilitate
public inquiries. Anyone can access the chemical information by logging
onto a data base and calling the information up by using CAS number, state,
city and/or facility name. Staff from Computer Based Systems, Inc. (EPA
contractor) are on-hand to assist with system inquiries between 8:00 am
and 4:00 PM, Monday through Friday. To schedule an appointment, please
call (202)488-1501. CHEMICAL EMERGENCY PREPAREDNESS PROGRAM (CEPP) - 1-(800)
535-0202 (202) 479-2449 Contact: Chemical Emergency Preparedness Program
(CEPP) Office of Solid Waste and Emergency Preparedness US Environmental
Protection Agency (WH-548A) 401 M Street, SW Washington, DC 20460 EMERGENCY
MANAGEMENT INFORMATION CENTER (EMIC) - 1-800-638-1821 (301) 447-6771 ext
6032 Contact: EMIC Librarian, Learning Resource Center National Emergency
Training Center 16825 South Seton Avenue Emmitsburg, Maryland 21727 FEMA
established EMIC (Emergency Management Information Center) to assist faculty,
staff, students and off-campus users of the National Emergency Training
Center Learning Resource Center with their research and information needs.
EMIC is a special collection of natural and technological case study documents
that can be requested for loan to state level fire and emergency management
officials by applying in writing, on official letterhead, to the EMIC librarian.
Other requests will be referred back to appropriate states for handling.
SUPERFUND AND RESOURCE CONSERVATION AND RECOVERY ACT - 1-800-424-9346 (202)
382-3000 Contact: For Superfund -- Office of Emergency and Remedial Response
US Environmental Protection Agency 401 M Street, SW Washington, DC 20460
For CERCLA -- Office of Waste Programs Enforcement US Environmental Protection
Agency 401 M Street, SW Washington, DC 20460 EPA established the toll free
technical assistance hotline in 1980 to answer questions and provide documents
to those needing information on the Superfund and Resource Conservation
and Recovery Act. TOXIC SUBSTANCES CONTROL ACT (TSCA) - (202) 554-1404
Contact: Toxic Substances Control Act Assistance Office Office of Toxic
Substances US Environmental Protection Agency PRIVATE SECTOR TOLL FREE
TECHNICAL ASSISTANCE SUPPORT CHEMTREC: 1-(800) 424-9300. Alaska, Hawaii
and DC (202) 483-7616 Contact: Chemical Manufacturers Association 2501
M Street, NW Washington, DC 20037. The Chemical Manufacturers Association
set up the Chemical Transportation Emergency Center (CHEMTREC) to provide
immediate assistance to those at the scene of accident, 24 hours a day,
seven days a week. CHEMTREC maintains an online database on the chemical,
physical, and toxicological properties and health effects of the thousands
of products of the member companies. CHEMTREC operates in two stages: first,
staff provide chemical information for use in onsite decision making involving
handling the early stages of the problem and, second, notifies the manufacturer
of the product of the accident for more detailed information and appropriate
follow-up. CHEMNET is activated by a call to CHEMTREC. If a member shipper
cannot respond promptly to an incident and a chemical expert is required
at a site, then the shipper can authorize a CHEMNET-contracted emergency
response company to go in its place. CHLOREP: Emergency contact through
CHEMTREC above. Contact: Chlorine Institute 342 Madison Avenue New York,
NY 10017. The Chlorine Institute in 1972 established its Chlorine Emergency
Plan (CHLOREP), a mutual-aid response network of chlorine manufacturers
and packagers, to provide assistance at chlorine emergencies in the United
States and Canada through telephone instructions to on-scene personnel
or the dispatching of trained teams to sites. Response is activated by
a call to CHEMTREC which in turn calls the designated CHLOREP contact,
who notifies the appropriate team leader based upon CHLOREP's geographical
sector team assignments. CAER: Community Awareness and Emergency Response
information line. This is a 2 minute recorded message informing callers
of upcoming events related to coordinated emergency response planning.
The CAER information number is (202) 463-1599 and is updated twice a month.
To submit an event to be publicized, send the materials to: Todd Miller
CMA Communications Dept. 2501 M Street, NW Washington, DC 20037 The Center
for Fire Research in the National Bureau of Standards has established a
public access computer bulletin board. Contact: Doug Walton System Operator
U(301) 975-6872 Information on the bulletin board includes: A listing of
the most recent reports from the Center for Fire Research; Information
on upcoming activities at the Center for Fire Research such as conferences,
seminars and workshops; and Information on FIREDOC, the Center's fire research
bibliographic system. FEDERAL AND STATE AGENCY ONLINE DATABASES The Office
of Solid Waste and Emergency Response (OSWER) bulletin board is intended
to store communications and technology transfer among the Regions and with
Headquarters staff involved in solid or hazardous waste regulation, permitting,
or enforcement and with ORD scientists and engineers in Headquarters and
laboratories who are supporting OSWER. The OWSER is operated under contract
to the Office of Program Management Technology (OPMT). The OSWER BBS offers
messages, bulletins, files and computer programs, databases, and conferences.
Bulletins include OSWER technical training opportunities and ORD technology
transfer seminars nationwide, new ORD technical publications, the top 25
compounds found at Superfund Sites, and the current status of the SITE
technology demonstrations. Conferences include: Executive (for EPA managers
only), Ground-Water Workstation, Ground-Water Monitoring and Remediation,
Risk Management/Assessment, and Expert Systems/Geographic Information Systems.
The BBS is primarily intended for EPA Regional, Headquarters, and ORD personnel,
however, OSWER welcomes state and local government agencies and authorized
EPA contractors. The BBS telephone number is (301) 589-8366, the voice
line is (301) 589-8368. The Hazardous Materials Information Systems (HMIS)
offers two menu-driven programs to assist state, local and Federal agencies.
The US Department of Transportation (DOT), Research and Special Programs
Administration's (RSPA) project offers quick access to both exemptions
information and informal interpretations. The exemptions menu provides
access to the following: exemption numbers, exemption holders, expiration
dates, container type and DOT specification, hazardous material, shipping
name and class, and regulations affected. The interpretations menu provides
access to informal interpretations issued by the Standards Division, Office
of Hazardous Materials Transportation. Each search provides: requester,
subject, commodity, container and regulations affected. This service is
provided FREE to state, local, and federal agencies. Private sector organizations
cannot get an account on the HMIS but can call to receive printouts on
information they need (there is a fee for the printout). In order to gain
access to the HMIS you must FIRST ESTABLISH AN ACCOUNT by contacting: Lessie
Graves Office of Hazardous Materials Transportation Information Services
Unit FTS/COMM: (202) 366-4555 Occupational Safety and Health Administration's
(OSHA) Computerized Information System (OCIS) is designed to aid OSHA,
State OSHA Program, and OSHA Area Office staff in responding to employers'
and employees' occupational safety and health problems by maintaining quick
access to various computerized information files. OCIS files are maintained
on a Digital Vax 11/750 computer at the Salt Lake City Laboratory; BASIS
is the database management software; system is accessed from OSHA and State
Program offices only; files are menu driven; and new capabilities are under
development. Questions and comments can be directed to: OCIS Help Desk
(801) 524-5366 or 524-5896 FTS 588-5366 or 588-5896 The National Library
of Medicine's (NLM) Toxicology Data Network (TOXNET) is a computerized
system of toxicologically oriented data banks, offering a sophisticated
search and retrieval package which permits efficient access to information
on known chemicals and identifies unknown chemicals based on their characteristics.
TOXNET files include: Hazardous Substances Data Bank (HSDB), Toxicology
Data Bank (TDB), and Chemical Carcinogenesis Research Information ,System
(CCRIS). Registered NLM users can access TOXNET by direct dial or through
TELENET or TYMNET telecommunications networks. The nations average search
charges (per hour) are $75.00 for prime time. For detailed information
on TOXNET contact: National Library of Medicine Specialized Information
Services Biomedical Files Implementation Branch 8600 Rockville Pike Bethesda,
MD 20894 (301) 496-6531 or 496-1131 COMMERCIAL AND PRIVATE ONLINE DATABASES
FIREDOC: Nations available From NBS The Center for Fire Research in the
National Bureau of Standards has made its computerized bibliographic system,
FIREDOC, available for searching on-line. The system can be accessed by
telephone using a computer as a terminal. About 7,000 items from the Center's
collection are currently entered in the FIREDOC system. For further information
including instructions on access and use of FIREDOC, contact: Nora Jason
Technical Information Specialist Center for Fire Research (301) 975-6862
CFRBBS is a public access computer bulletin board sponsored by: the Center
for Fire Research, National Bureau of Standards, US Department of Commerce,
in Gaithersburg, MD 20899. It features computer programs developed by the
Center of Fire Research. Contents of the board include: fire simulation
programs, information on FIREDOC (the Center for Fire Research bibliographic
search system; FIREDOC users guide; and FIREDOC compatible communications
package), information on upcoming activities at the Center for Fire Research,
and a listing of the most recent year's reports from the center. There
is no connect fee for using the board; however the user pays for the phone
call. For more information contact Doug Walton, System Operator, at (301)
975-6872. Public Health Foundation's Public Health Network (PHN) users
have full access turnal (800) 327-8351 (except FA) Sports Illustrated
(800) 621-8200 (except IL) Book Digest Magazine (800) 228-9700 (except
Nebraska) Money (800) 621-8200 (except IL) Mail Order =-=-=-=-=- (bowling
equip.) (800) 323-1812 (except IL) Edd the Florist, Inc. (800) 247-1075
(except IA) Golf Mail Order Co. (800) 327-1760 (except FA) Inflate-a-bed
(800) 835-2246 (except KS) International Male (800) 854-2795 (except CA)
Porta Yoga (c.c. orders)(800) 327-8912 (except FA) Unique Products Co.
(800) 228-2049 (except Nebraska) Ski Resorts =-=-=-=-=-= HN Concord (800)
431-2217 (only New England States) Mt. Snow (800) 451-4211 (Eas orrn Seabord)
Ski Us at Franconia (800) 258-0366 (Eastern Seabord) Stevensville (800)
431-2211 (New England States) Mannequins =-=-=-=-=- Dann-Dee (800) 621-3904
(except IL) Car Rentals =-=-=-=-=-= A-Aaron, Inc. (800) 327-7513 (except
FA) Airlines Rent-A/Car (800) 228-9650 (FA only) Dollar-A-Day (800) 421-6868
(except FA) Hertz (800) 261-1311 (Canada only) Sears Rent-A-Car (800) 228-2800
(except Nebraska) Thrifty Rent-A-Car (800) 331-4200 (except Oklahoma) Newspapers
=-=-=-=-=- Globe Gazette (800) 392-6622 (IA only) Oil Daily (800) 223-6635
(except NY) Christian Science Motor (800) 225-7090 (except MS) Wall Street
Journal (800) 257-0300 (except NJ) The National Observer (800) 325-5990
(except MO) FBI raids major Ohio computer bulletin board; action follows
joint investigation with SPA. The Federation Bureau of Investigation on
Saturday, Jan. 30, 1993, raided "Rusty & Edie's," a computer bulletin
board located in Boardman, Ohio, which has allegedly been illegally distributing
copyrighted software programs. Seized in the raid on the Rusty & Edie's
bulletin board were computers, hard disk drives and telecommunications
equipment, as well as financial and subscriber records. For the past several
months, the Software Publishers Association ("SPA") has been working with
the FBI in investigating the Rusty & Edie's bulletin board, and as
part of that investigation has downloaded numerous copyrighted business
and entertainment programs from the board. The SPA investigation was initiated
following the receipt of complaints from a number of SPA members that their
software was being illegally distributed on the Rusty & Edie's BBS.
The Rusty & Edie's bulletin board was one of the largest private bulletin
boards in the country. It had 124 nodes available to callers and over 14,000
subscribers throughout the United States and several foreign countries.
To date, the board has logged in excess of 3.4 million phone calls, with
new calls coming in at the rate of over 4,000 per day. It was established
in 1987 and had expanded to include over 19 gigabytes of storage housing
over 100,000 files available to subscribers for downloading. It had paid
subscribers throughout the United States and several foreign countries,
including Canada, Luxembourg, France, Germany, Finland, the Netherlands,
Spain, Sweden and the United Kingdom. A computer bulletin board allows
personal computer users to access a host computer by a modem-equipped telephone
to exchange information, including messages, files, and computer programs.
The systems operator is generally responsible for the operation of the
bulletin board and determines who is allowed to access the bulletin board
and under what conditions. For a fee of $89.00 per year, subscribers to
the Rusty & Edie's bulletin board were given access to the board's
contents including many popular copyrighted business and entertainment
packages. Subscribers could "download" or receive these files for use on
their own computers without having to pay the copyrighted owner anything
for them. "The SPA applauds the FBI's action today," said Ilene Rosenthal,
general counsel for the SPA. "This shows that the FBI recognizes the harm
that theft of intellectual property causes to one of the USs most vibrant
industries. It clearly demonstrates a trend that the government understands
the seriousness of software piracy." The SPA is actively working with the
FBI in the investigation of computer bulletin boards, and similar raids
on other boards are expected shortly. Whether it's copied from a program
purchased at a neighborhood computer store or downloaded from a bulletin
board thousands of miles away, pirated software adds to the cost of computing.
According to the SPA, in 1991, the software industry lost $1.2 billion
in the US alone. Losses internationally are several billion dollars more.
"Many people may not realize that software pirates cause prices to be higher,
in part, to make up for publisher losses from piracy," says Ken Wasch,
executive director of the SPA. In addition, they ruin the reputation of
the hundreds of legitimate bulletin boards that serve an important function
for computer users." The Software Publishers Association is the principal
trade association of the personal computer software industry. It's over
1,000 members represent the leading publishers in the business, consumer
and education software markets. The SPA has offices in Washington DC, and
Paris, France. CONTACT: Software Publishers Association, Washington Ilene
Rosenthal.. 202/452-1600 Ext. 318 Terri Childs..... 202/452-1600 Ext. 320
181.ANARCHY 'N'
EXPLOSIVES - VOLUME 2 by Exodus
This volume defines a few varieties
of misc. explosives, charges, and whatever I had in mind at that time.
Anyway, these formulas are not as precise in measurements for they were
given in brief summary. However, they will work, and if used correctly
can be safe and "fun". FRENCH AMMONAL [Low Explosive]: Ingredients: 86%
Ammonium Nitrate 6% Stearic Acid 8% Aluminum Powder Description: French
ammonal is an easily improvised low explosive mixture. It is generally
less effective than an equal weight of TNT. The material is loaded by pressing
it into a suitable container. Initiation by an Engineer's special blasting
cap is recommended. Comments: This material was tested. It is effective.
References: TM 31-201-1, Unconventional Warfare Devices and Techniques,
para 1401. TETRYTOL [High Explosive]: Ingredients: 75% Tetrytol 25% TNT
Description: Tetrytol is a high explosive bursting charge. It is used as
a demolition explosive, a bursting charge for mines, and in artillery shells.
The explosive force of tetrytol is approximately the same as that of TNT.
It may be initiated by a blasting cap. Tetrytol is usually loaded by casting.
Comments: This material was tested. It is effective. References: TM 9-1900;
Ammunition, General, page 55. Military Explosives, page 188. IMPROVISED
PLASTIC EXPLOSIVE FILLER [High Explosive]: Ingredients: Finely Powdered
Potassium Chlorate Cdata bstals Petroleum Jelly **MIX THOUROUGHLY** Description:
This plastic explosive filler can be detonated with a No. 8 commercial
blasting cap or with any military blasting cap. The explosive must be stored
in a waterproof container until ready to use. Comments: This material was
tested. It is effective. References: TM 31-210, Improvised Munitions, sec
I, No. 1. FLAMMABILITY OF GASES [Gas Explosive]: Ingredients: Explosive
Gas Description: Under some conditions, common gases act as fuel. When
mixed with air, they will burn rapidly or even explode. For some fuel-air
mixtures, the range over which the explosion can occur is quite wide while
for others the limits are narrow. The upper and lower amounts of common
fuels that will cause an ignitable mixture are shown in the table below.
The quantity shown is the percentage by volume of air. If the fuel-air
mixture is too lean or too rich, it will not ignite. The amounts shown
are therefore called limits of inflammability. Gases (% by volume of air)
Fuel (Gas)Lower LimitUpper LimitWater Gas Or Blue Gas7.072Natural
Gas4.715Hydrogen4.075Acetylene2«81Propane2.210Butane1.99
Comments: These fuels have been tested under laboratory conditions. They
are effective. Ignition depends on method of initiation, uniformity of
mixture, and physical conditions. References: Bulletin 29, Limits of Inflammability
of Gases and Vapors H.F. Coward and G.W. Jones, Bureau of Mines, US Government
Printing Office, 1939.
182.ANARCHY 'N'
EXPLOSIVES - VOLUME 3 by Exodus
This is the MOST important or one of
the most important volumes regarding the various mixtures of anarchy that
I will be "publishing" to the "public". Also, it may as well be the MOST
DANGEROUS to prepare, the substance we will be dealing with is Trinitrotoluene,
or short - TNT. This high explosive is a VERY DANGEROUS, slightly unstable
substance. The crystallized crude TNT is about the color of brown sugar
and feels greasy to the touch. It is suitable for many uses as a high-explosive,
but not for the use in high-explosive shells. It is also highly reactive
to many other chemical substances. It can be incorporated into dynamite
and many other explosives that will be explained in further detail later,
in other volumes of ANARCHY. WARNING: DO NOT ATTEMPT TO FINISH THIS PROJECT
UNLESS YOU ARE FULLY CAPABLE SAFELY EXECUTING THE PROCESSES IN A SAFE ENVIRONMENT!
IF YOU CHOOSE TO CONTINUE, READ THE INSTRUCTIONS COMPLETELY THROUGH BEFORE
BEGINNING AND HAVE ALL MATERIALS AND TOOLS (INCLUDING SAFETY/EMERGENCY
EQUIPMENT) READY FOR USE WHEN OR IF THEY ARE NEEDED. THIS IS NOT A JOKE!
USE AT YOUR OWN RISK!!!!! Preparation of Trinitrotoluene (Three Stages).
A mixture of 294 grams of concentrated sulfuric acid (density 1.84) and
147 grams of nitric acid (density 1.42) is added slowly from a dropping
funnel to 100 grams of toluene in a tall 600-cc. beaker, while the liquid
is stirred vigorously with an electric stirrer and it's temperature is
maintained at 30øC to 40øC by running cold water in the vessel
in which the beaker is standing. The addition of acid will require from
an hour to an hour and a half. The stirring is then continued for half
an hour longer without cooling; the mixture is allowed to stand over night
in a separatory funnel; the lower layer of spent acid is drawn off; and
the crude mononitrotoluene is weighed. One-half of it, corresponding to
50 grams of toluene, is taken for the dinitration. The mononitrotoluene
(MNT) is dissolved in 109 grams of concentrated sulfuric acid (d. 1.84)
while the mixture is cooled in running water. The solution in a tall beaker
is warmed to 50ø and a mixed acid, composed of 54« grams each
of nitric acid (d. 1«0) and sulfuric acid (d. 1.84), is added slowly
drop by drop from a dropping funnel while the mixture is stirred mechanically.
The heat generated by the reaction raises the temperature, and the rate
of addition of the acid is regulated so that the temperature of the mixture
lies always between 90ø and 100ø. The addition of the acid
will require about 1 hour. After the acid has been added, the mixture is
stirred for 2 hours longer at 90ø-100ø to complete the nitration.
Two layers separate on standing. The upper layer consists largely of dinitrotoluene
(DNT), but probably contains a certain amount of TNT. The trinitration
in the laboratory is conveniently carried out without separating the DNT
from the spent acid. While the dinitration mixture is stirred actively
at a temperature of about 90ø, 145 grams of fuming sulfuric acid
(petroleum containing 15% free SO3) is added slowly by pouring from a beaker.
A mixed acid, composed of 72« grams each of nitric acid (d. 1«0)
and the 15% petroleum, is now added drop by drop with good agitation while
the heat of the reaction maintains the temperature at 100-115ø.
After about three-quarters of the acid has been added, it will be found
necessary to apply external heat to maintain the temperature. After all
the acid has been added (taking 1 « to 2 hours), the heating and
stirring are continued for 2 hours longer at 100-115ø. After the
material has stood overnight, the upper TNT layer will be found to have
solidified to a hard cake, and the lower layer of spent acid to be filled
with cdata bstals. The acid is filtered through a Buchner funnel (without
filter paper), and the cake is broken up and washed with water on the same
filter to remove excess of acid. The spent acid contains considerable amounts
of TNT in solution; this is precipitated by pouring the acid into a large
volume of water, filtered off, rinsed with water, and added to the main
batch. All the of the product is washed three or four times by agitating
it vigorously with hot water under which it is melted. After the last washing,
the TNT is granulated by allowing it to cool slowly under hot water while
the stirring is continued. The product, filtered off and dried at ordinary
room temperature, is equal to a good commercial sample of crude TNT. It
may be purified by dissolving in warm alcohol at 60ø and allowing
to cool slowly, or it may be purified by digesting with 5 times its weight
of 5% sodium hydrogen sulfite solution at 90ø for half an hour with
vigorous stirring, washing with hot water until the washings are colorless,
and finally granulating as before. The product of this last treatment is
equal to a good commercial sample of purified TNT. Pure ALPHA-TNT, melting
point 80.8ø, may be procured by recrystallizing this material once
from nitric acid (d. 1.42) and once from alcohol. Well, that's it... AND
REMEMBER MY WARNING!
183.ANARCHY 'N'
EXPLOSIVES - VOLUME 4 by Exodus
In this particular volume, we will
be discussing types of Dynamite, these high-explosives being one of the
more important or destructive of the anarchist's formulas. Note that some
of these mixtures are very unstable or shock ignited, and that care should
be observed when handling these unstable mixtures. Some of these formulae
deal with Trinitrotoluene (TNT) and the preparation for that is given under
the volume 3, within this series. WARNING: THESE ARE REAL EXPLOSIVES AND
MAY CAUSE SERIOUS INJURY OR DEATH UPON MISUSE. DO NOT ATTEMPT TO PREPARE
ANY AS SAMPLE IF YOU ARE NOT FULLY CAPABLE OF UNDERSTANDING THE DANGERS
AND PRECAUTIONS OF THESE PRODUCTS. THESE FORMULAE ARE THE TRUE FORMULAE
TO CREATE THESE MIXTURES AND ARE THEREFORE VERY DANGEROUS. USE AT YOUR
OWN RISK!!! Guhr Dynamite: Ingredients 1 part Kieselguhr 3 parts Nitroglycerin
Description This dynamite is primarily used in blasting. It is fairly stable,
in the drop test, it exploded by the fall of a 1 kg weight through 12 to
15 cm., or by the fall of a 2 kg weight through 7 cm. The frozen material
is less sensitive: a drop of more than 20 cm. with a 1 kg weight is needed
to explode it, and the 2 kg weight is necessary to explode it. Frozen or
unfrozen, it can be detonated by shooting at it with a military rifle,
when held in a paper cartridge. Generally, it is detonated with a steel-on-steel
blow. Velocity of detonation vary from 6650 to 6800 meters per second at
a density loading of 1«0. Extra-Dynamite: FORMULA 1FORMULA 271%
Nitroglycerin62% Ammonium Nitrate23% Ammonium Nitrate25% Nitroglycerin4%
Collodion12% Charcoal2% Charcoal1% Collodion Description: This material
is crumbly and plastic between the fingers. This material can be detonated
with any detonating cap. Table Of Dynamite Formulae: INGREDIENTSTRENGTH
15%20%25%30%35%40%45%50%55%60%Nitroglycerin15%20%25%30%35%40%45%50%55%60%Combustible
Material20%19%18%17%16%15%14%14%15%16%Sodium Nitrate64%60%56%52%48%44%40%35%29%23%Calcium
or Magnesium Carbonate1%1%1%1%1%1%1%1%1%1% Table Of More Dynamite
Formulae: INGREDIENTSTRENGTH ORDINARYLOW FREEZING 30%35%40%50%60%30%35%40%50%60%Nitroglycerin15%20%22%27%35%13%17%17%21%27%Nitrosubstitution
Compounds0%0%0%0%0%3%4%4%5%6%Ammonium Nitrate15%15%20%25%30%15%15%20%25%30%Sodium
Nitrate51%48%42%36%24%53%49%45%36%27%Combustible Material18%16%15%11%10%15%14%13%12%9%Calcium
Carbonate or Zinc Oxide1%1%1%1%1%1%1%1%1%1% Master Table Of
Dynamites: INGREDIENTFORMULA 123456789101112Ammonium Nitrate52536061667378830000Potassium
Nitrate2100002.85730«3400Sodium Nitrate0125300000030«24«Barium
Nitrate000000024100Na or K Chloride002120«2215800000Hyd
Ammonium Oxalate16190000000000Ammonium Chloride600000000000Cereal
or Wood Meal0447«2152038«39«40«Glycerin000400000000Spent
Tan Bark Meal0000000040100Potassium Dichromate000000000055Sodium
Carbonate00000000««00Powdered Coal000040000000Nitrotoluene006100000000Dinitrotoluene000005000000Trinitrotoluene060000020000Nitroglycerin554443.24425252530All
measurements in percents Well, that's it for now... have fun.... hehehehehe!
USE AT YOUR OWN RISK!!!!
184.ANARCHY 'N'
EXPLOSIVES - VOLUME 5 by Exodus
Well, hasn't it been long since Volume
4 of Anarchy 'n' Explosives? Well, I finally got around to typing up another
volume. This one will be dedicated to the extremely simple and more accessible
explosives and incendiaries to be prepared at home, or laboratory; depending
upon the environment you have access to or are accustomed to. For further
information and/or comments on this series of ever popular explosives,
contact me (I don't sign these "publications") on the Knavery BBS at xxx-xxx-xxxx
on the public message base, I should be reading some requests if you leave
them. And, volume number 6 should be coming out sooner than the time between
4 and 5, but don't count on it. BULK POWDERS: Bulk powders are types of
gunpowder consisting of nitrocellulose and a mixture of other chemically
explosive solutions. These nitrocellulose fibers are stuck together, but
are not completely collided. Some contain little else but nitrocellulose;
others contain, in addition to potassium and barium nitrates, camphor,
vaseline, paraffin, lampblack, starch, dextrin, potassium dichromate or
other oxidizing or deterrent salts, and diphenylamine for stabilization,
and are colored in a variety of brilliant hues by means of coltar dyes.
Three typical bulk powders are made up according to the approximate formulas
tabulated below: Nitrocellulose84.087.089.0% N in nitrocellulose13.212.912.9Potassium
nitrate7«6.06.0Barium nitrate7«2.03.0Starch0.00.01.0Paraffin
oil0.04.00.0Diphenylamine1.01.01.0 The mixture is mixed in warm
water and dried thoroughly. Then either granulated or made into powder
by crushing with a wooden block and screened through a 12-mesh sieve. The
material is then stored in a moisture-resistant container for future or
immediate use. MERCURY FULMINATE: Mercury fulminate is an initiating explosive,
commonly appearing as white or gray crystals. It is extremely sensitive
to initiation by heat, friction, spark or flame, and impact. It detonates
when initiated by any of these means. It is pressed into containers, usually
at 3000 psi, for use in detonators and blasting caps. However, when compressed
at greater and greater pressure (up to 30,000 psi), it becomes "dead pressed."
In this condition, it can only be detonated by another initial detonating
agent. Mercury fulminate gradually becomes inert when stored continuously
above 100øF. A dark colored product of deterioration gives evidence
of this effect. Mercury exfulminate is stored underwater except when there
is danger of freezing. Then it is stored under a mixture of water and alcohol.
Preparation of Mercury Fulminate. Five grams of mercury is added Ext 55
cc. of nitric acid (specific gravity 1.42) in a 100-cc. Erlenmeyer flask,
and the mixture is allowed to stand without shaking until the mercury has
gone into solution. The acid liquid is then poured into 50 cc. of 90% alcohol
in a 500-cc. beaker in the hood. The temperature of the mixture rises,
a vigorous reaction commences, white fumes come off, and cdata bstals of
fulminate soon begin to precipitate. Red fumes appear and the precipitation
of the fulminate becomes more rapid, then white fumes again as the reaction
moderates. After about 20 minutes, the reaction is over; water is added,
and the cdata bstals are washed with water repeatedly by decantation until
the washings are no longer acid to litmus. The product consists of grayish-yellow
cdata bstals, and corresponds to a good grade of commercial fulminate.
It may be obtained white and entirely pure by dissolving in strong ammonia
water, filtering, and reprecipitating by the addition of 30% acetic acid.
The pure fulminate is filtered off, washed several times with cold water,
and stored under water, or, if a very small amount is desired for experimental
purposes, it is dried in a desiccator. AMATOL: Description: amatol is a
high explosive, white to buff in color. It is a mixture of ammonium nitrate
and TNT, with a relative effectiveness slightly higher than that of TNT
alone. Common compositions vary from 80% ammonium nitrate and 20% TNT to
40% ammonium nitrate and 60% TNT. Amatol is used as the main bursting charge
in artillery shells and bombs. Amatol absorbs moisture and can form dangerous
compounds with copper and brass. Therefore, it should not be housed in
containers of such metals. BLACK POWDERS: Black powders burn either quickly
or very slowly depending on the composition of such a mixture; however,
these powders produce smoke, often great amounts, and is most useful in
applications where smoke is no object. It is the best for communicating
fire and for producing a quick, hot flame. Black powder is used in both
propellant charges for shrapnel shells, in saluting and blank fire charges,
as the bursting charge of practice shells and bombs, as a propelling charge
in certain pyrotechnic pieces, and, either with or without the admixture
of other substances which modify the rate of burning, in the time-train
rings and in other parts of fuses. Below is a list of black powders and
their compositions. NameSaltpeter(Brown) CharcoalSulfurEngland79(18)3England77.4(17.6)5Germany78(19)3Germany80(20)0France78(19)3Forte721513Lente403030Ordinaire621820
185.Explosives
and Propellants by Exodus
Almost any city or town of reasonable
size has a gun store and one or more pharmacies. These are two of the places
that potential terrorists visit in order to purchase explosive material.
All that one has to do is know something about the non- explosive uses
of the materials. Black powder, for example, is used in blackpowder firearms.
It comes in varying "grades", with each different grade being a slightly
different size. The grade of black powder depends on what the caliber of
the gun that it is used in; a fine grade of powder could burn too fast
in the wrong caliber weapon. The rule is: the smaller the grade, the faster
the burn rate of the powder. BLACK POWDER Black powder is generally available
in three grades. As stated before, the smaller the grade, the faster the
powder burns. Burn rate is extremely important in bombs. Since an explosion
is a rapid increase of gas volume in a confined environment, to make an
explosion, a quick-burning powder is desirable. The three common grades
of black powder are listed below, along with the usual bore width (caliber)
of what they are used in. Generally, the fastest burning powder, the FFF
grade is desirable. However, the other grades and uses are listed below:
GRADEBORE WIDTHEXAMPLE OF GUNF«0 or GreaterModel Cannon; some
RiflesFF.36 - «0Large Pistols; Small RiflesFFF.36 or SmallerPistols;
Derringers The FFF grade is the fastest burning, because the smaller
grade has more surface area or burning surface exposed to the flame front.
The larger grades also have uses which will be discussed later. The price
range of black powder, per pound, is about $8«0 - $9.00. The price
is not affected by the grade, and so one saves oneself time and work if
one buys the finer grade of powder. The major problems with black powder
are that it can be ignited accidentally by static electricity, and that
it has a tendency to absorb moisture from the air. To safely crush it,
a one would use a plastic spoon and a wooden salad bowl. Taking a small
pile at a time, he or she would apply pressure to the powder through the
spoon and rub it in a series of strokes or circles, but not too hard. It
is fine enough to use when it is about as fine as flour. The fineness,
however, is dependent on what type of device one wishes to make; obviously,
it would be impractical to crush enough powder to fill a 1 foot by 4 inch
radius pipe. Any adult can purchase black powder, since anyone can own
black powder firearms in the United States. PYRODEX Pyrodex is a synthetic
powder that is used like black powder. It comes in the same grades, but
it is more expensive per pound. However, a one pound container of pyrodex
contains more material by volume than a pound of black powder. It is much
easier to crush to a very fine powder than black powder, and it is considerably
safer and more reliable. This is because it will not be set off by static
electricity, as black can be, and it is less inclined to absorb moisture.
It costs about $10.00 per pound. It can be crushed in the same manner as
black powder, or it can be dissolved in boiling water and dried. ROCKET
ENGINE POWDER One of the most exciting hobbies nowadays is model rocketry.
Estes is the largest producer of model rocket kits and engines. Rocket
engines are composed of a single large grain of propellant. This grain
is surrounded by a fairly heavy cardboard tubing. One gets the propellant
by slitting the tube length- wise, and unwrapping it like a paper towel
roll. When this is done, the gray fire clay at either end of the propellant
grain must be removed. This is usually done gently with a plastic or brass
knife. The material is exceptionally hard, and must be crushed to be used.
By gripping the grain in the widest setting on a set of pliers, and putting
the grain and powder in a plastic bag, the powder will not break apart
and shatter all over. This should be done to all the large chunks of powder,
and then it should be crushed like black powder. Rocket engines come in
various sizes, ranging from 1/4 A-2T to the incredibly powerful D engines.
The larger the engine, the more expensive. D engines come in packages of
three, and cost about $5.00 per package. Rocket engines are perhaps the
single most useful item sold in stores to a terrorist, since they can be
used as is, or can be cannibalized for their explosive powder. RIFLE/SHOTGUN
POWDER Rifle powder and shotgun powder are really the same from a practical
standpoint. They are both nitrocellulose based propellants. They will be
referred to as gunpowder in all future references. Smokeless gunpowder
is made by the action of concentrated nitric and sulfuric acid upon cotton
or some other cellulose material. This material is then dissolved by solvents
and then reformed in the desired grain size. When dealing with smokeless
gunpowder, the grain size is not nearly as important as that of black powder.
Both large and small grained smokeless powder burn fairly slowly compared
to black powder when unconfined, but when it is confined, gunpowder burns
both hotter and with more gaseous expansion, producing more pressure. Therefore,
the grinding process that is often necessary for other propellants is not
necessary for smokeless powder. Powder costs about $9.00 per pound. In
most states any citizen with a valid driver's license can buy it, since
there are currently few restrictions on rifles or shotguns in the US There
are now ID checks in many states when purchasing powder at a retail outlet.
Mail-orders aren't subject to such checks. Rifle powder and pyrodex may
be purchased by mail order, but UPS charges will be high, due to DOT regulations
on packaging. 186.Lockpicking III by Exodus If it becomes necessary to
pick a lock to enter a lab, the world's most effective lockpick is dynamite,
followed by a sledgehammer. There are unfortunately, problems with noise
and excess structural damage with these methods. The next best thing, however,
is a set of professional lockpicks. These, unfortunately, are difficult
to acquire. If the door to a lab is locked, but the deadbolt is not engaged,
then there are other possibilities. The rule here is: if one can see the
latch, one can open the door. There are several devices which facilitate
freeing the latch from its hole in the wall. Dental tools, stiff wire (
20 gauge ), specially bent aluminum from cans, thin pocket knives, and
credit cards are the tools of the trade. The way that all these tools and
devices are uses is similar: pull, push, or otherwise move the latch out
of its recess in the wall, thus allowing the door to open. This is done
by sliding whatever tool that you are using behind the latch, and forcing
the latch back into the door. Most modern doorknob locks have two fingers.
The larger finger holds the door closed while the second (smaller) finger
only prevents the first finger from being pressed in when it (the second
finger) is pressed in by the catchplate of the door. If you can separate
the catch plate and the lock sufficiently far, the second finger will slip
out enough to permit the first finger to be slipped. (Ill. 2.11) ___ |
} < Small -> (| } <--- The large (first) finger second |___} <
finger Some methods for getting through locked doors are: Another method
of forced entry is to use an automobile jack to force the frame around
the door out of shape, freeing the latch or exposing it to the above methods.
This is possible because most door frames are designed with a slight amount
of "give". Simply put the jack into position horizontally across the frame
in the vicinity of the latch, and jack it out. If the frame is wood it
may be possible to remove the jack after shutting the door, which will
relock the door and leave few signs of forced entry. This technique will
not work in concrete block buildings, and it's difficult to justify an
auto jack to the security guards. Use a screwdriver or two to pry the lock
and door apart. While holding them apart, try to slip the lock. Screwdrivers,
while not entirely innocent, are much more subtle than auto jacks, and
much faster if they work. If you're into unsubtle, I suppose a crowbar
would work too, but then why bother to slip the lock at all? Find a set
of double doors. They are particularly easy to pry apart far enough to
slip. If the lock is occasionally accessible to you while open, "adjust"
or replace the catchplate to make it operate more suitably (i.e., work
so that it lets both fingers out, so that it can always be slipped). If
you want, disassembling the lock and removing some of the pins can make
it much easier to pick. If, for some odd reason, the hinges are on your
side (i.e., the door opens outward), remove the hinge pins, provided they
aren't stopped with welded tabs. Unfortunately, this too lacks subtlety,
in spite of its effectiveness. If the door cannot be slipped and you will
want to get through regularly, break the mechanism. Use of sufficient force
to make the first finger retreat while the second finger is retreated will
break some locks (e.g., Best locks) in such a way that they may thereafter
be slipped trivially, yet otherwise work in all normal ways. Use of a hammer
and/or screwdriver is recommended. Some care should be used not to damage
the door jamb when attempting this on closed and locked doors, so as not
to attract the attention of the users or owners or locksmith or police
exc. Look around in desks. People very often leave keys to sensitive things
in them or other obvious places. Especially keys to shared critical resources,
like supply rooms, that are typically key-limited but that everyone needs
access to. Take measurements with a micrometer, or make a tracing (lay
key under paper and scribble on top), or be dull and make a wax impression.
Get blanks for the key type (can be very difficult for better locks; I
won't go into methods, other than to say that if you can get other keys
made from the same blank, you can often work wonders with a little ingenuity)
and use a file to reproduce the key. Using a micrometer works best: keys
made from mic measurements are more likely to work consistently than keys
made by any other method. If you us tracings, it is likely to take many
tries before you obtain a key that works reliably. Also, if you can 'borrow'
the cylinder and disassemble it, pin levels can be obtained and keys constructed.
Simple locks, like desks, can be picked fairly easily. Many desks have
simple three or four pin locks of only a few levels, and can be consistently
picked by a patient person in a few minutes. A small screwdriver and a
paper clip will work wonders in practiced hands. Apply a slight torque
to the lock in the direction of opening with the screwdriver. Then 'rake'
the pins with the unfolded paper clip. With practice, you'll apply enough
pressure with the screwdriver that the pins will align properly (they'll
catch on the cylinder somewhere between the top and bottom of their normal
travel), and once they're all lined up, additional pressure on the screwdriver
will then open the lock. This, in conjunction with (7) can be very effective.
This works better with older or sloppily machined locks that have a fair
amount of play in the cylinder. Even older quality locks can be picked
in this manner, if their cylinders have been worn enough to give enough
play to allow pins to catch reliably. Even with a well worn quality lock,
though, it generally takes a *lot* of patience. Custodial services often
open up everything in sight and then take breaks. Make the most of your
opportunities. No matter what you're doing, look like you belong there.
Nothing makes anyone more suspicious than someone skulking about, obviously
trying to look inconspicuous. If there are several of you, have some innocuous
and normal seeming warning method ("Hey, dummy! What time is it?") so that
they can get anything suspicious put away. Don't travel in large groups
at 3AM. Remember, more than one car thief has managed to enlist a cop's
aid in breaking into a car. Remember this. Security people usually *like*
to help people. Don't make them suspicious or annoy them. If you do run
into security people, try to make sure that there won't be any theft or
break-ins reported there the next day... Consider the possibilities of
master keys. Often, every lock in a building or department will have a
common master (building entrance keys are a common exception). Take apart
some locks from different places that should have common masters, measure
the different pin lengths in each, and find lengths in common. Experiment.
Then get into those places you're *really* curious about. Control keys
are fun, too. These keys allow the user to remove the lock's core, and
are generally masters. (A pair of needle nose pliers or similar tool can
then be used to open the lock, if desired.) SLIPPING A LOCK The best material
we've found for slips so far is soft sheet copper. It is quite flexible,
so it can be worked into jambs easily, and can be pre-bent as needed. In
the plane of the sheet, however, it is fairly strong, and pulls nicely.
Of course, if they're flexible enough, credit cards, student Ids, etc.,
work just fine on locks that have been made slippable if the door jamb
is wide enough. Wonderfully subtle, quick, and delightfully effective.
Don't leave home without one. (Ill. #1) The sheet should then be folded
to produce an L, J, or U shaped device that looks like this: ________________________________________
/________________________________________| | | | | L-shaped | | | | |_|
(Ill. #2) _____________________________ / ___________________________|
| | | | J-shaped | | | |________ \________| (Ill. #3) _____________________
/ ___________________| | | | | | | U-shaped | | | |____________________
\____________________| We hasten to add here that many or most colleges
and universities have very strict policies about unauthorized possession
of keys. At most, it is at least grounds for expulsion, even without filing
criminal charges. Don't get caught with keys!!! The homemade ones are particularly
obvious, as they don't have the usual stamps and marks that the locksmiths
put on to name and number the keys.] We should also point out that if you
make a nuisance of yourself, there are various nasty things that can be
done to catch you and/or slow you down. For instance, by putting special
pin mechanisms in, locks can be made to trap any key used to open them.
If you lose one this way, what can I say? At least don't leave fingerprints
on it. Or make sure they're someone else's. Too much mischief can also
tempt the powers that be to rekey.
187.Chemical Equivalent
List II by Exodus
Anyone can get many chemicals from
hardware stores, supermarkets, and drug stores to get the materials to
make explosives or other dangerous compounds. A would-be terrorist would
merely need a station wagon and some money to acquire many of the chemicals
named here. ChemicalUsed InAvailable atAlcohol, EthylAlcoholic BeveragesLiquor
Stores Solvents: 95% min for bothHardware StoresAmmoniaCLEAR Household
AmmoniaSupermarkets or 7-ElevenAmmonium NirateInstant-Cold PaksDrug
Stores FertilizersMedical Supply StoresNitrous OxidePressurizing
Whip CreamParty Supply Stores Poppers (like COý ctgs.)Head
ShopsMagnesiumFirestartersSurplus or Camping StoresLecithinVitaminsPharmacies
or Drug StoresMineral OilCooking, LaxativeSupermarket or Drug StoresMercuryMercury
ThermometersSupermarkets Hardware StoresSulfuric AcidUncharged
Car BatteriesAutomotive StoresGlycerine Pharmacies or Drug StoresSulfurGardeningGarden
or Hardware StoreCharcoalCharcoal GrillsSupermarkets Gardening
StoresSodium NitrateFertilizerGardening StoresCellulose (Cotton)First
AidDrug Stores Medical Supply StoresStrontium NitrateRoad FlaresSurplus
or Auto StoresFuel OilKerosene StovesSurplus or Camping StoresBottled
GasPropane StovesSurplus Camping StoresPotassium PermanganateWater
PurificationPurification PlantsHexamine or MethenamineHexamine StovesSurplus
or Camping StoresNitric Acid *Cleaning PrintingPrinting Shops PlatesPhotography
StoresIodine +Disinfectant (tinture)Pharmacy, OSCOSodium PerchlorateSolidox
PelletsHardware Stores Cutting Torches (IMPURE) * Nitric acid is
very difficult to find nowadays. It is usually stolen by bomb makers, or
made by the process described in a later section. A desired concentration
for making explosives about 70%. + The iodine sold in drug stores is usually
not the pure crystalline form that is desired for producing ammonium triiodide
crystals. To obtain the pure form, it must usually be acquired by a doctor's
prescription, but this can be expensive. Once again, theft is the means
that terrorists result to.
188.Nitroglycerin
II by Exodus
Nitroglycerin is one of the most sensitive
explosives, if it is not the most sensitive. Although it is possible to
make it safely, it is difficult. Many a young anarchist has been killed
or seriously injured while trying to make the stuff. When Nobel's factories
make it, many people were killed by the all-to-frequent factory explosions.
Usually, as soon as it is made, it is converted into a safer substance,
such as dynamite. An idiot who attempts to make nitroglycerin would use
the following procedure: MATERIAL: Distilled Water Table Salt Sodium Bicarbonate
Concentrated Nitric Acid (13 mL) Concentrated Sulfuric Acid (39 mL) Glycerin
EQUIPMENT: Eye-Dropper 100 mL Beaker 200-300 mL Beakers (2) Ice Bath Container
(A plastic bucket serves well) Centigrade Thermometer Blue Litmus Paper
Place 150 mL of distilled water into one of the 200-300 mL beakers. In
the other 200-300 mL beaker, place 150 mL of distilled water and about
a spoonful of sodium bicarbonate, and stir them until the sodium bicarbonate
dissolves. Do not put so much sodium bicarbonate in the water so that some
remains undissolved. Create an ice bath by half filling the ice bath container
with ice, and adding table salt. This will cause the ice to melt, lowering
the overall temperature. Place the 100 mL beaker into the ice bath, and
pour the 13 mL of concentrated nitric acid into the 100 mL beaker. Be sure
that the beaker will not spill into the ice bath, and that the ice bath
will not overflow into the beaker when more materials are added to it.
Be sure to have a large enough ice bath container to add more ice. Bring
the temperature of the acid down to about 20øC or less. When the
nitric acid is as cold as stated above, slowly and carefully add the 39
mL of concentrated sulfuric acid to the nitric acid. Mix the two acids
together, and cool the mixed acids to 10øC. It is a good idea to
start another ice bath to do this. With the eyedropper, slowly put the
glycerin into the mixed acids, one drop at a time. Hold the thermometer
along the top of the mixture where the mixed acids and glycerin meet. DO
NOT ALLOW THE TEMPERATURE TO GET ABOVE 30ø CENTIGRADE IF THE TEMPERATURE
RISES ABOVE THIS TEMPERATURE, WATCH OUT !! The glycerin will start to nitrate
immediately, and the temperature will immediately begin to rise. Add glycerin
until there is a thin layer of glycerin on top of the mixed acids. It is
always safest to make any explosive in small quantities. Stir the mixed
acids and glycerin for the first ten minutes of nitration, adding ice and
salt to the ice bath to keep the temperature of the solution in the 100
mL beaker well below 30øC. Usually, the nitroglycerin will form
on the top of the mixed acid solution, and the concentrated sulfuric acid
will absorb the water produced by the reaction. When the reaction is over,
and when the nitroglycerin is well below 30øC, slowly and carefully
pour the solution of nitroglycerin and mixed acid into the distilled water
in the beaker in step 1. The nitroglycerin should settle to the bottom
of the beaker, and the water-acid solution on top can be poured off and
disposed of. Drain as much of the acid- water solution as possible without
disturbing the nitroglycerin. Carefully remove the nitroglycerin with a
clean eye-dropper, and place it into the beaker in step 2. The sodium bicarbonate
solution will eliminate much of the acid, which will make the nitroglycerin
more stable, and less likely to explode for no reason, which it can do.
Test the nitroglycerin with the litmus paper until the litmus stays blue.
Repeat this step if necessary, and use new sodium bicarbonate solutions
as in step 2. When the nitroglycerin is as acid-free as possible, store
it in a clean container in a safe place. The best place to store nitroglycerin
is far away from anything living, or from anything of any value. Nitroglycerin
can explode for no apparent reason, even if it is stored in a secure cool
place.
189.Cellulose
Nitrate by Exodus
I used to make nitrocellulose, though.
It was not guncotton grade, because I didn't have petroleum (H2SO4 with
dissolved SO3); nevertheless it worked. At first I got my H2SO4 from a
little shop in downtown Philadelphia, which sold soda-acid fire extinguisher
refills. Not only was the acid concentrated, cheap and plentiful, it came
with enough carbonate to clean up. I'd add KNO3 and a little water (OK,
I'd add the acid to the water - but there was so little water, what was
added to what made little difference. It spattered concentrated H2SO4 either
way). Later on, when I could purchase the acids, I believe I used 3 parts
H2SO4 to 1 part HNO3. For cotton, I'd use cotton wool or cotton cloth.
Runaway nitration was commonplace, but it is usually not so disastrous
with nitrocellulose as it is with nitroglycerin. For some reason, I tried
washing the cotton cloth in a solution of lye, and rinsing it well in distilled
water. I let the cloth dry and then nitrated it. (Did I read this somewhere?)
When that product was nitrated, I never got a runaway reaction. By the
way, water quenched the runaway reaction of cellulose. The product was
washed thoroughly and allowed to dry. It dissolved (or turned into mush)
in acetone. It dissolved in alcohol/ether. WARNINGS All usual warnings
regarding strong acids apply. H2SO4 likes to spatter. When it falls on
the skin, it destroys tissue - often painfully. It dissolves all manner
of clothing. Nitric also destroys skin, turning it bright yellow in the
process. Nitric is an oxidant - it can start fires. Both agents will happily
blind you if you get them in your eyes. Other warnings also apply. Not
for the novice. Nitrocellulose decomposes very slowly on storage if it
isn't stabilized. The decomposition is autocatalyzing, and can result in
spontaneous explosion if the material is kept confined over time. The process
is much faster if the material is not washed well enough. Nitrocellulose
powders contain stabilizers such as diphenyl amine or ethyl centralite.
DO NOT ALLOW THESE TO COME INTO CONTACT WITH NITRIC ACID!!!! A small amount
of either substance will capture the small amounts of nitrogen oxides that
result from decomposition. They therefore inhibit the autocatalysis. NC
eventually will decompose in any case. Again, this is inherently dangerous
and illegal in certain areas. I got away with it. You may kill yourself
and others if you try it. Commercially produced Nitrocellulose is stabilized
by: Spinning it in a large centrifuge to remove the remaining acid, which
is recycled. Immersion in a large quantity of fresh water. Boiling it in
acidulated water and washing it thoroughly with fresh water. If the NC
is to be used as smokeless powder it is boiled in a soda solution, then
rinsed in fresh water. The purer the acid used (lower water content) the
more complete the nitration will be, and the more powerful the nitrocellulose
produced. There are actually three forms of cellulose nitrate, only one
of which is useful for pyrotechnic purposes. The mononitrate and dinitrate
are not explosive, and are produced by incomplete nitration. If nitration
is allowed to proceed to complete the explosive trinatrate is formed. (Ill.
3.22.2) CH OH CH ONO | 2 | 2 2 | | C-----O HNO C-----O /H \ 3 /H \ -CH
CH-O- --> -CH CH-O- \H H/ H SO \H H/ C-----C 2 4 C-----C | | | | OH OH
ONO ONO 2 2 CELLULOSE CELLULOSE TRINITRATE 190.Starter Explosives by Exodus
There are nearly an infinite number of fuel-oxidizer mixtures that can
be produced by a misguided individual in his own home. Some are very effective
and dangerous, while others are safer and less effective. A list of working
fuel- oxidizer mixtures will be presented, but the exact measurements of
each compound are debatable for maximum effectiveness. A rough estimate
will be given of the percentages of each fuel and oxidizer: Oxidizer%
by weightFuel% by weightSpeed Notes Potassium Chlorate67%Sulfur33%5Friction
or Impact Sensitive & UnstablePotassium Chlorate50%Sugar35%5Fairly
Slow BurningCharcoal15%UnstablePotassium Chlorate50%Sulfur25%8Extremely
Unstable! Magnesium or25%Aluminum Dust25%Potassium Chlorate67%Magnesium33%8Unstable
Aluminum Dust33%Sodium Nitrate65%Magnesium Dust30%?Unpredictable
Sulfur5% Potassium Permanganate60%Glycerin40%4Delay Before
Ignition depends upon Grain SizePotassium Permanganate67%Sulfur33%5UnstablePotassium
Permanganate60%Sulfur20%5Unstable Magnesium or20% Aluminum
Dust20%Potassium Permanganate50%Sugar50%3?Potassium Nitrate75%Charcoal15%7This
is Black Powder! Sulfur10% Potassium Nitrate60%Powdered Iron
or40%1Burns Very Hot Magnesium40%Potassium Chlorate75%Phosphorus
Sesquisulfide25%8Used to make strike-anywhere matchesAmmonium Perchlorate70%Aluminum
Dust30%6Solid Fuel for Space Shuttle Small amount of Iron OxidePotassium
Perchlorate67%Magnesium or33%10Flash Powder(Sodium Perchlorate)
Aluminum Dust33%Potassium Perchlorate60%Magnesium or20%8Alternate(Sodium
Perchlorate) Aluminum Dust20% Flash Powder Sulfur20%Barium
Nitrate30%Aluminum Dust30%9Alternate Potassium Perchlorate30%
Flash PowderBarium Peroxide90%Magnesium Dust5%10Alternate
Aluminum Dust5% Flash PowderPotassium Perchlorate50%Sulfur25%8Slightly
Unstable Magnesium or25% Aluminum Dust25%Potassium Chlorate67%Red
Phosphorus27%7Very Unstable Impact Sensitive Calcium Carbonate3%
Sulfur3%Potassium Permanganate50%powdered sugar25%7Unstable
Aluminum or25% Ignites if it gets wet! Magnesium Dust25%Potassium
Chlorate75%Charcoal Dust15%6Unstable Sulfur10% WARNING:
POTASSIUM PERMANGANATE IGNITES SPONTANEOUSLY WITH GLYCERIN!!! NOTE: Mixtures
that uses substitutions of sodium perchlorate for potassium perchlorate
become moisture-absorbent and less stable. The higher the speed number,
the faster the fuel-oxidizer mixture burns AFTER ignition. Also, as a rule,
the finer the powder, the faster the rate of burning. As one can easily
see, there is a wide variety of fuel-oxidizer mixtures that can be made
at home. By altering the amounts of fuel and oxidizer(s), different burn
rates can be achieved, but this also can change the sensitivity of the
mixture.
191.Flash Powder
By Dr. Tiel
Here are a few basic precautions to
take if you're crazy enough to produce your own flash powder: Grind the
oxidizer (KNO3, KClO3, KMnO4, KClO4 etc.) separately in a clean vessel.
NEVER grind or sift the mixed composition. Mix the composition on a large
paper sheet, by rolling the composition back and forth. Do not store flash
compositions, especially any containing Mg. Make very small quantities
at first, so you can appreciate the power of such mixtures. KNO3 50% (by
weight) Mg 50% It is very important to have the KNO3 very dry, if evolution
of ammonia is observed then the KNO3 has water in it. Very pure and dry
KNO3 is needed. KClO3 with Mg or Al metal powders works very well. Many
hands, faces and lives have been lost with such compositions. KMnO4 with
Mg or Al is also an extremely powerful flash composition. KClO4 with Al
is generally found in commercial fireworks, this does not mean that it
is safe, it is a little safer than KClO3 above. KýCrýO7 can
also be used as an oxidizer for flash powder. The finer the oxidizer and
the finer the metal powder the more powerful the explosive. This of course
will also increase the sensitivity of the flash powder. For a quick flash
small quantities can be burnt in the open. Larger quantities (50g or more)
ignited in the open can detonate, they do not need a container to do so.
NOTE: Flash powder in any container will detonate. Balanced equations of
some oxidizer/metal reactions. Only major products are considered. Excess
metal powders are generally used. This excess burns with atmospheric oxygen.
4 KNO3 + 10 Mg --> 2 KýO + 2 Ný + 10 MgO + Energy KClO3 +
2 Al --> KCl + AlýO3 + Energy 3 KClO4 + 8 Al --> 3 KCl + 4 AlýO3
+ Energy 6 KMnO4 + 14 Al --> 3 KýO + 7 AlýO3 + 6 Mn + Energy
Make Black Powder first if you have never worked with pyrotechnic materials,
then think about this stuff. Dr. Van Tiel - Ph.D. Chemistry Potassium perchlorate
is a lot safer than sodium/potassium chlorate. 192.The Explosive Pen by
Blue Max Here's a GREAT little trick to play on your best fiend (no that's
not a typo) at school, or maybe as a practical joke on a friend! Materials
Needed: One Ball Point "Click" pen Gun Powder 8 or 10 match heads 1 Match
stick a sheet of sand paper (1 «" X 2") Directions: Unscrew pen and
remove all parts but leave the button in the top. Stick the match stick
in the part of the pen clicker where the other little parts and the ink
fill was. Roll sand paper up and put around the match stick that is in
the clicker. Put the remaining Match Heads inside the pen, make sure that
they are on the inside on the sand paper. Put a small piece of paper or
something in the other end of the pen where the ball point comes out. Fill
the end with the piece of paper in it with gun powder. The paper is to
keep the powder from spilling. Ther to err on the side of caution. BASIC
SAFETY RULES DON'T SMOKE! (Don't laugh - an errant cigarette wiped out
the Weathermen) GRIND ALL INGREDIENTS SEPARATELY. It's surprising how friction
sensitive some supposedly "safe" explosives really are. ALLOW for a 20%
margin of error - Just because the AVERAGE burning rate of a fuse is 30
secs/foot, don't depend on the 5 inches sticking out of your pipe bomb
to take exactly 2« minutes. OVERESTIMATE THE RANGE OF YOUR SHRAPNEL.
The cap from a pipe bomb can often travel a block or more at high velocities
before coming to rest - If you have to stay nearby, remember that if you
can see it, it can kill you. When mixing sensitive compounds (such as flash
powder) avoid all sources of static electricity. Mix the ingredients by
the method below: HOW TO MIX INGREDIENTS The best way to mix two dry chemicals
to form an explosive is to do as the small-scale fireworks manufacturer's
do: Ingredients: 1 large sheet of smooth paper (for example a page from
a newspaper that does not use staples) The dry chemicals needed for the
desired compound. Measure out the appropriate amounts of the two chemicals,
and pour them in two small heaps near opposite corners of the sheet. Pick
up the sheet by the two corners near the powders, allowing the powders
to roll towards the middle of the sheet. By raising one corner and then
the other, roll the powders back and forth in the middle of the open sheet,
taking care not to let the mixture spill from either of the loose ends.
Pour the powder off from the middle of the sheet, and use immediately.
If it must be stored use airtight containers (35mm film canisters work
nicely) and store away from people, houses, and valuable items.
195.Ammonium TriIodide
Crystals by Exodus
Ammonium triiodide crystals are foul-smelling
purple colored crystals that decompose under the slightest amount of heat,
friction, or shock, if they are made with the purest ammonia (ammonium
hydroxide) and iodine. Such crystals are said to detonate when a fly lands
on them, or when an ant walks across them. Household ammonia, however,
has enough impurities, such as soaps and abrasive agents, so that the crystals
will detonate when thrown, crushed, or heated. Ammonia, when bought in
stores comes in a variety of forms. The pine and cloudy ammonias should
not be bought; only the clear ammonia should be used to make ammonium triiodide
crystals. Upon detonation, a loud report is heard, and a cloud of purple
iodine gas appears about the detonation site. Whatever the unfortunate
surface that the crystal was detonated upon will usually be ruined, as
some of the iodine in the crystal is thrown about in a solid form, and
iodine is corrosive. It leaves nasty, ugly, permanent brownish-purple stains
on whatever it contacts. Iodine gas is also bad news, since it can damage
lungs, and it settles to the ground and stains things there also. Touching
iodine leaves brown stains on the skin that last for about a week, unless
they are immediately and vigorously washed off. While such a compound would
have little use to a serious terrorist, a vandal could utilize them in
damaging property. Or, a terrorist could throw several of them into a crowd
as a distraction, an action which would possibly injure a few people, but
frighten almost anyone, since a small crystal that may not be seen when
thrown produces a rather loud explosion. Ammonium triiodide crystals could
be produced in the following manner: Materials: Iodine crystals Clear ammonia
(ammonium hydroxide, for the suicidal) Equipment: Funnel and filter paper
Paper towels Two throw-away glass jars Place about two teaspoons of iodine
into one of the glass jars. The jars must both be throw away because they
will never be clean again. Add enough ammonia to completely cover the iodine.
Place the funnel into the other jar, and put the filter paper in the funnel.
The technique for putting filter paper in a funnel is taught in every basic
chemistry lab class: fold the circular paper in half, so that a semi-circle
is formed. Then, fold it in half again to form a triangle with one curved
side. Pull one thickness of paper out to form a cone, and place the cone
into the funnel. After allowing the iodine to soak in the ammonia for a
while, pour the solution into the paper in the funnel through the filter
paper. While the solution is being filtered, put more ammonia into the
first jar to wash any remaining crystals into the funnel as soon as it
drains. Collect all the purplish crystals without touching the brown filter
paper, and place them on the paper towels to dry for about an hour. Make
sure that they are not too close to any lights or other sources of heat,
as they could well detonate. While they are still wet, divide the wet material
into eight pieces of about the same size. After they dry, gently place
the crystals onto a one square inch piece of duct tape. Cover it with a
similar piece, and gently press the duct tape together around the crystal,
making sure not to press the crystal itself. Finally, cut away most of
the excess duct tape with a pair of scissors, and store the crystals in
a cool dry safe place. They have a shelf life of about a week, and they
should be stored in individual containers that can be thrown away, since
they have a tendency to slowly decompose, a process which gives off iodine
vapors, which will stain whatever they settle on. One possible way to increase
their shelf life is to store them in airtight containers. To use them,
simply throw them against any surface or place them where they will be
stepped on or crushed.
196.Sulfuric Acid
& Amm. Nitrate III by Exodus
Sulfuric acid is far too difficult
to make outside of a laboratory or industrial plant. However, it is readily
available in an uncharged car battery. A person wishing to make sulfuric
acid would simply remove the top of a car battery and pour the acid into
a glass container. There would probably be pieces of lead from the battery
in the acid which would have to be removed, either by boiling or filtration.
The concentration of the sulfuric acid can also be increased by boiling
it; very pure sulfuric acid pours slightly faster than clean motor oil.
AMMONIUM NITRATE Ammonium nitrate is a very powerful but insensitive high-order
explosive. It could be made very easily by pouring nitric acid into a large
flask in an ice bath. Then, by simply pouring household ammonia into the
flask and running away, ammonium nitrate would be formed. After the materials
have stopped reacting, one would simply have to leave the solution in a
warm place until all of the water and any unneutralized ammonia or acid
have evaporated. There would be a fine powder formed, which would be ammonium
nitrate. It must be kept in an airtight container, because of its tendency
to pick up water from the air. The crystals formed in the above process
would have to be heated VERY gently to drive off the remaining water.
197.Black Powder
III by Exodus
First made by the Chinese for use in
fireworks, black powder was first used in weapons and explosives in the
12th century. It is very simple to make, but it is not very powerful or
safe. Only about 50% of black powder is converted to hot gasses when it
is burned; the other half is mostly very fine burned particles. Black powder
has one major problem... it can be ignited by static electricity. This
is very bad, and it means that the material must be made with wooden or
clay tools. Anyway, a misguided individual could manufacture black powder
at home with the following procedure: MATERIALS: Potassium Nitrate (75
g) -or- Sodium Nitrate (75 g) Sulfur (10 g) Charcoal (15 g) Distilled Water
EQUIPMENT: Clay grinding bowl and clay grinder -or- wooden salad bowl and
wooden spoon Plastic Bags (3) 300-500 mL Beaker (1) Coffee Pot or Heat
Source Place a small amount of the potassium or sodium nitrate in the grinding
bowl and grind it to a very fine powder. Do this to all of the potassium
or sodium nitrate, and store the ground powder in one of the plastic bags.
Do the same thing to the sulfur and charcoal, storing each chemical in
a separate plastic bag. Place all of the finely ground potassium or sodium
nitrate in the beaker, and add just enough boiling water to the chemical
to get it all wet. Add the contents of the other plastic bags to the wet
potassium or sodium nitrate, and mix them well for several minutes. Do
this until there is no more visible sulfur or charcoal, or until the mixture
is universally black. On a warm sunny day, put the beaker outside in the
direct sunlight. Sunlight is really the best way to dry black powder, since
it is never too hot, but it is hot enough to evaporate the water. Scrape
the black powder out of the beaker, and store it in a safe container. Plastic
is really the safest container, followed by paper. Never store black powder
in a plastic bag, since plastic bags are prone to generate static electricity.
198.NitroCellulose
by Exodus
Nitrocellulose is usually called "gunpowder"
or "guncotton". It is more stable than black powder, and it produces a
much greater volume of hot gas. It also burns much faster than black powder
when it is in a confined space. Finally, nitrocellulose is fairly easy
to make, as outlined by the following procedure: MATERIALS: Cotton (Cellulose)
Concentrated Nitric Acid Concentrated Sulfuric Acid Distilled Water EQUIPMENT:
Two (2) 200-300 mL Beakers Funnel and Filter Paper Blue Litmus Paper Pour
10 cc of concentrated sulfuric acid into the beaker. Add to this 10 cc
of concentrated nitric acid. Immediately add 0« gm of cotton, and
allow it to soak for exactly 3 minutes. Remove the nitrocotton, and transfer
it to a beaker of distilled water to wash it in. Allow the material to
dry, and then re-wash it. After the cotton is neutral when tested with
litmus paper, it is ready to be dried and stored.
199.RDX II by
Exodus
RDX, also called Cyclonite, or composition
C-1 (when mixed with plasticisers) is one of the most valuable of all military
explosives. This is because it has more than 150% of the power of TNT,
and is much easier to detonate. It should not be used alone, since it can
be set off by a not-too severe shock. It is less sensitive than Mercury
Fulminate or Nitroglycerin, but it is still too sensitive to be used alone.
NO 2 | N / \ RDX MOLECULE / \ H C H C / 2 2 / | O N N--NO 2 \ / 2 \ / \
/ CH 2 RDX can be made by the surprisingly simple method outlined hereafter.
It is much easier to make in the home than all other high explosives, with
the possible exception of Ammonium Nitrate. MATERIALS: Hexamine -or- Methenamine
Fuel Tablets (50 g) Concentrated Nitric Acid (550 mL) Ammonium Nitrate
Distilled Water Table Salt Ice EQUIPMENT: 500 mL Beaker Glass Stirring
Rod Funnel and Filter Paper Ice Bath Container (Plastic Bucket) Centigrade
Thermometer Blue Litmus Paper Place the beaker in the ice bath, (see steps
3-4) and carefully pour 550 mL of concentrated Nitric Acid into the beaker.
When the acid has cooled to below 20øC, add small amounts of the
crushed fuel tablets to the beaker. The temperature will rise, and it must
be kept below 30øC, or dire consequences could result. Stir the
mixture. Drop the temperature below 0øC, either by adding more ice
and salt to the old ice bath, or by creating a new ice bath. Ammonium Nitrate
could be added to the old ice bath, since it becomes cold when it is put
in water. Continue stirring the mixture, keeping the temperature below
0øC for at least twenty minutes. Pour the mixture into a liter of
crushed ice. Shake and stir the mixture, and allow it to melt. Once it
has melted, filter out the crystals, and dispose of the corrosive liquid.
Place the crystals into one half a liter of boiling distilled water. Filter
the crystals, and test them with the blue litmus paper. Repeat steps 4
and 5 until the litmus paper remains blue. This will make the crystals
more stable and safe. Store the crystals wet until ready for use. Allow
them to dry completely using them. RDX is not stable enough to use alone
as an explosive. Composition C-1 can be made by mixing 88.3% RDX (by weight)
with 11.1% mineral oil, and 0.6% lecithin. Kneed these material together
in a plastic bag. This is one way to desensitize the explosive. HMX is
a mixture of TNT and RDX; the ratio is 50/50, by weight. It is not as sensitive,
and is almost as powerful as straight RDX. By adding ammonium nitrate to
the crystals of RDX after step 5, it should be possible to desensitize
the RDX and increase its power, since ammonium nitrate is very insensitive
and powerful. Sodium or potassium nitrate could also be added; a small
quantity is sufficient to stabilize the RDX. RDX detonates at a rate of
8550 meters/second when it is compressed to a density of 1«5 g/cubic
cm. 200.Black Gate BBS by Exodus ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
ÛÛÛÛÛ ÛÛÛÛÛ
ÛÛÛÛ áK Gç áá
ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ
ÛÛÛÛ ãåë 1 ÛÛÛÛ
ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ
ÛÛÛÛ ÛÛÛÛ ÛÛÛÛ
ÛÛÛÛÛ ÛÛÛÛÛ
ÛÛÛÛÛÛ ÛÛÛÛÛÛ
³ ³ ³ëç 3.90 ÛÛÛÛÛ
ÛÛÛÛÛ ë_ ëçù
ÀÄÁÄÙ ÛÛÛÛÛÛÛÛ
H ý ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ
ÛÛÛÛÛÛÛÛÛÛ
ÛÛÛÛ ÛÛÛÛÛÛÛÛÛÛ
ÛÛÛÛÛÛ ÛÛÛÛÛÛ
ÛÛÛÛÛÛ ÛÛ ÛÛÛÛÛÛ
ÛÛ ÛÛÛÛÛÛÛÛ
1* (20!)-YOU-SUCK ÛÛÛÛÛÛÛÛ
EliTe MaIL 2* (20!)-REAL-BAD ÛÛÛÛÛÛÛÛÛÛ
-=( NO LEECHES )=- ÛÛÛÛÛÛÛÛÛÛ
FL, PA, NY, CA 2 RinGdoWN 9600's ÛÛÛÛÛÛÛÛÛÛÛÛ
CoNNexioNs 1 LocAl 57000 !@ ÛÛÛÛÛÛÛÛÛÛÛÛ
-0+ DaY WarEZ ÛÛë_hÛÛ Sysop - Exodus
201.ANFOS by Dean S. ANFO is an acronym for Ammonium Nitrate - Fuel Oil
Solution. An ANFO solves the only other major problem with ammonium nitrate:
its tendency to pick up water vapor from the air. This results in the explosive
failing to detonate when such an attempt is made. This is rectified by
mixing 94% (by weight) ammonium nitrate with 6% fuel oil, or kerosene.
The kerosene keeps the ammonium nitrate from absorbing moisture from the
air. An ANFO also requires a large shockwave to set it off. About ANFO
Lately there was been a lot said about various ANFO mixtures. These are
mixtures of Ammonium Nitrate with Fuel Oil. This forms a reasonably powerful
commercial explosive, with its primary benefit being the fact that it is
cheap. Bulk ANFO should run somewhere around 9-12 cents the pound. This
is dirt cheap compared to 40% nitro gel dynamites at 1 to 2 dollars the
pound. To keep the cost down, it is frequently mixed at the borehole by
a bulk truck, which has a pneumatic delivery hopper of AN prills (that's
pellets to most of the world) and a tank of fuel oil. It is strongly recommended
that a dye of some sort, preferably red be added to the fuel oil to make
it easier to distinguish treated AN explosive from untreated oxidizer.
ANFO is not without its problems. To begin with, it is not that sensitive
to detonation. Number eight caps are not reliable when used with ANFO.
Booster charges must be used to avoid dud blast holes. Common boosters
include sticks of various dynamites, small pours of water gel explosives,
dupont's detaprime cast boosters, and Atlas's power primer cast explosive.
The need to use boosters raises the cost. Secondly, ANFO is very water
susceptible. It dissolves in it, or absorbs it from the atmosphere, and
becomes quite worthless real quick. It must be protected from water with
borehole liners, and still must be shot real quick. Third, ANFO has a low
density, somewhere around .85. This means ANFO sacks float, which is no
good, and additionally, the low density means the power is somewhat low.
Generally, the more weight of explosive one can place in a hole, the more
effective. ANFO blown into the hole with a pneumatic system fractures as
it is places, raising the density to about .9 or .92. The delivery system
adds to the cost, and must be anti static in nature. Aluminum is added
to some commercial, cartridge packaged ANFOs to raise the density---this
also raises power considerable, and a few of these mixtures are reliably
cap sensitive. Now than, for formulations. An earlier article mentioned
2« kilos of ammonium nitrate, and I believe 5 to 6 liters of diesel.
This mixture is extremely over fueled, and I'd be surprised if it worked.
Dupont recommends a AN to FO ratio of 93% AN to 7% FO by weight. Hardly
any oil at all. More oil makes the mixture less explosive by absorbing
detonation energy, and excess fuel makes detonation byproducts health hazards
as the mixture is oxygen poor. Note that commercial fertilizer products
do not work as well as the porous AN prills dupont sells, because fertilizers
are coated with various materials meant to seal them from moisture, which
keep the oil from being absorbed. Another problem with ANFO: for reliable
detonation, it needs confinement, either from a casing, borehole, etc,
or from the mass of the charge. Thus, a pile of the stuff with a booster
in it is likely to scatter and burn rather than explode when the booster
is shot. In boreholes, or reasonable strong casings (cardboard, or heavy
plastic film sacks) the stuff detonated quite well. So will big piles.
That's how the explosive potential was discovered: a small oil freighter
rammed a bulk chemical ship. Over several hours the cargoes intermixed
to some degree, and reached critical mass. Real big bang. A useful way
to obtain the containment needed is to replace the fuel oil with a wax
fuel. Mix the AN with just enough melted wax to form a cohesive mixture,
mold into shape. The wax fuels, and retains the mixture. This is what the
US military uses as a man placed cratering charge. The military literature
states this can be set off by a blasting cap, but it is important to remember
the military blasting caps are considerable more powerful than commercial
ones. The military rightly insists on reliability, and thus a strong cap
(maybe 70-80 percent stronger than commercial). They also tend to go overboard
when calculating demolition charges...., but hey, who doesn't... Two manuals
of interest: Duponts "Blaster's Handbook", $20 manual mainly useful for
rock and seismographic operations. Atlas's "Powder Manual" or "Manual of
Rock Blasting" (I forget the title, its in the office). This is a $60 book,
well worth the cash, dealing with the above two topics, plus demolitions,
and non-quarry blasting. Incidentally, combining fuel oil and ammonium
nitrate constitutes the manufacture of a high explosive, and requires a
federal permit to manufacture and store. Even the mines that mix it on
site require the permit to manufacture. Those who don't manufacture only
need permits to store. Those who don't store need no permits, which includes
most of us: anyone, at least in the US may purchase explosives, provided
they are 21 or older, and have no criminal record. Note they ought to be
used immediately, because you do need a license to store. Note also that
commercial explosives contain quantities of tracing agents, which make
it real easy for the FBI to trace the explosion to the purchaser, so please,
nobody blow up any banks, orphanages, or old folks homes, okay. 202.Picric
Acid by Exodus Picric acid, also known as Tri-Nitro-Phenol, or TNP, is
a military explosive that is most often used as a booster charge to set
off another less sensitive explosive, such as TNT. It's another explosive
that is fairly simple to make, assuming that one can acquire the concentrated
sulfuric and nitric acids. Its procedure for manufacture is given in many
college chemistry lab manuals, and is easy to follow. The main problem
with picric acid is its tendency to form dangerously sensitive and unstable
picrate salts, such as potassium picrate. For this reason, it is usually
made into a safer form, such as ammonium picrate, also called explosive
D. A social deviant would probably use a formula similar to the one presented
here to make picric acid. MATERIALS: Phenol (9« g) Concentrated Sulfuric
Acid (12« mL) Concentrated Nitric Acid (38 mL) Distilled Water EQUIPMENT:
500 mL Flask Adjustable Heat Source 1000 mL Beaker -or- other container
suitable for boiling in Filter Paper and Funnel Glass Stirring Rod Place
9« grams of phenol into the 500 mL flask, and carefully add 12«
mL of concentrated sulfuric acid and stir the mixture. Put 400 mL of tap
water into the 1000 mL beaker or boiling container and bring the water
to a gentle boil. After warming the 500 mL flask under hot tap water, place
it in the boiling water, and continue to stir the mixture of phenol and
acid for about thirty minutes. After thirty minutes, take the flask out,
and allow it to cool for about five minutes. Pour out the boiling water
used above, and after allowing the container to cool, use it to create
an ice bath, similar to the one used in steps 3-4. Place the 500 mL flask
with the mixed acid an phenol in the ice bath. Add 38 mL of concentrated
nitric acid in small amounts, stirring the mixture constantly. A vigorous
but "harmless" reaction should occur. When the mixture stops reacting vigorously,
take the flask out of the ice bath. Warm the ice bath container, if it
is glass, and then begin boiling more tap water. Place the flask containing
the mixture in the boiling water, and heat it in the boiling water for
1« to 2 hours. Add 100 mL of cold distilled water to the solution,
and chill it in an ice bath until it is cold. Filter out the yellowish-white
picric acid crystals by pouring the solution through the filter paper in
the funnel. Collect the liquid and dispose of it in a safe place, since
it is corrosive. Wash out the 500 mL flask with distilled water, and put
the contents of the filter paper in the flask. Add 300 mL of water, and
shake vigorously. Re-filter the crystals, and allow them to dry. Store
the crystals in a safe place in a glass container, since they will react
with metal containers to produce picrates that could explode spontaneously.
203.CHEMICAL FIRE
BOTTLE by Exodus
The chemical fire bottle is really
an advanced molotov cocktail. Rather than using the burning cloth to ignite
the flammable liquid, which has at best a fair chance of igniting the liquid,
the chemical fire bottle utilizes the very hot and violent reaction between
sulfuric acid and potassium chlorate. When the container breaks, the sulfuric
acid in the mixture of gasoline sprays onto the paper soaked in potassium
chlorate and sugar. The paper, when struck by the acid, instantly bursts
into a white flame, igniting the gasoline. The chance of failure to ignite
the gasoline is less than 2%, and can be reduced to 0%, if there is enough
potassium chlorate and sugar to spare. MATERIALS: Potassium Chlorate (2
teaspoons) Sugar (2 teaspoons) Concentrated Sulfuric Acid (4 oz.) Gasoline
(8 oz.) EQUIPMENT: 12 oz. glass bottle Cap for bottle, with plastic inside
Cooking Pan with raised edges Paper Towels Glass or Plastic Cup and Spoon
Test the cap of the bottle with a few drops of sulfuric acid to make sure
that the acid will not eat away the bottle cap during storage. If the acid
eats through it in 24 hours, a new top must be found and tested, until
a cap that the acid does not eat through is found. A glass top is excellent.
Carefully pour 8 oz. of gasoline into the glass bottle. Carefully pour
4 oz. of concentrated sulfuric acid into the glass bottle. Wipe up any
spills of acid on the sides of the bottle, and screw the cap on the bottle.
Wash the bottle's outside with plenty of water. Set it aside to dry. Put
about two teaspoons of potassium chlorate and about two teaspoons of sugar
into the glass or plastic cup. Add about « cup of boiling water,
or enough to dissolve all of the potassium chlorate and sugar. Place a
sheet of paper towel in the cooking pan with raised edges. Fold the paper
towel in half, and pour the solution of dissolved potassium chlorate and
sugar on it until it is thoroughly wet. Allow the towel to dry. When it
is dry, put some glue on the outside of the glass bottle containing the
gasoline and sulfuric acid mixture. Wrap the paper towel around the bottle,
making sure that it sticks to it in all places. Store the bottle in a place
where it will not be broken or tipped over. When finished, the solution
in the bottle should appear as two distinct liquids, a dark brownish-red
solution on the bottom, and a clear solution on top. The two solutions
will not mix. To use the chemical fire bottle, simply throw it at any hard
surface. NEVER OPEN THE BOTTLE, SINCE SOME SULFURIC ACID MIGHT BE ON THE
CAP, WHICH COULD TRICKLE DOWN THE SIDE OF THE BOTTLE AND IGNITE THE POTASSIUM
CHLORATE, CAUSING A FIRE AND/OR EXPLOSION. To test the device, tear a small
piece of the paper towel off the bottle, and put a few drops of sulfuric
acid on it. The paper towel should immediately burst into a white flame.
BOTTLED GAS EXPLOSIVES Bottled gas, such as butane for refilling lighters,
propane for propane stoves or for bunsen burners, can be used to produce
a powerful explosion. To make such a device, all that a simple-minded anarchist
would have to do would be to take his container of bottled gas and place
it above a can of Sterno or other gelatinized fuel, light the fuel and
run. Depending on the fuel used, and on the thickness of the fuel container,
the liquid gas will boil and expand to the point of bursting the container
in about five minutes. In theory, the gas would immediately be ignited
by the burning gelatinized fuel, producing a large fireball and explosion.
Unfortunately, the bursting of the bottled gas container often puts out
the fuel, thus preventing the expanding gas from igniting. By using a metal
bucket half filled with gasoline, however, the chances of ignition are
better, since the gasoline is less likely to be extinguished. Placing the
canister of bottled gas on a bed of burning charcoal soaked in gasoline
would probably be the most effective way of securing ignition of the expanding
gas, since although the bursting of the gas container may blow out the
flame of the gasoline, the burning charcoal should immediately re-ignite
it. Nitrous oxide, hydrogen, propane, acetylene, or any other flammable
gas will do nicely. During the recent gulf war, fuel/air bombs were touted
as being second only to nuclear weapons in their devastating effects. These
are basically similar to the above devices, except that an explosive charge
is used to rupture the fuel container and disperse it over a wide area.
A second charge is used to detonate the fuel. The reaction is said to produce
a massive shockwave and to burn all the oxygen in a large area, causing
suffocation. Another benefit of a fuel-air explosive is that the gas will
seep into fortified bunkers and other partially-sealed spaces, so a large
bomb placed in a building would result in the destruction of the majority
of surrounding rooms, rendering it structurally unsound.
204.Dry Ice by
Exodus
There is no standard formula for a
dry ice bomb, however a generic form is as follows: Take a 2-liter soda
bottle, empty it completely, then add about 3/4 Lb of Dry Ice (crushed
works best) and (optional) a quantity of water. Depending on the condition
of the bottle, the weather, and the amount and temperature of the bottle
the bomb will go off in 30 seconds - 5 minutes. Without any water added,
the 2-liter bottles will go often in 3-7 minutes if dropped into a warm
river, and in 45 minutes to 1 « hours in open air. The explosion
sounds equivalent to an M-100. _Plastic_ 16 oz. soda bottles and 1 liter
bottles work almost as well as do the 2-liters, however glass bottles aren't
nearly as loud, and can produce dangerous shrapnel. Remember, these are
LOUD! A classmate of mine set up 10 bottles in a nearby park without adding
water. After the first two went off (there was about 10 minutes between
explosions) the Police arrived and spent the next hour trying to find the
guy who they thought was setting off M-100's all around them... USES FOR
DRY ICE Time Bombs: Get a small plastic container with lid (we used the
small plastic cans that hold the coasters used for large-format Polaroid
film). A film canister would probably work; the key is, it should seal
tightly and take a fair amount of effort to open). Place a chunk of dry
ice in the can, put on the lid without quite sealing it. Put the assembled
bomb in your pocket, or behind your back. Approach the mark and engage
in normal conversation. When his attention is drawn away, quickly seal
the lid on the bomb, deposit it somewhere within a few feet of the mark,
out of obvious sight, then leave. Depending on variables (you'll want to
experiment first), you'll hear a loud "pop" and an even louder "Aarrgghhh!"
within a minute, when the COý pressure becomes sufficient to blow
off the lid. In a cluttered lab, this is doubly nasty because the mark
will probably never figure out what made the noise. Put 2-3 inches of water
in a 2-liter plastic pop bottle. Put in as many chunks of dry ice as possible
before the smoke gets too thick. Screw on the cap, place in an appropriate
area, and run like hell. After about a minute (your mileage may vary),
a huge explosion will result, spraying water everywhere, along with what's
left of the 2-liter bottle. More things to do with Dry Ice: Has anyone
ever thrown dry ice into a public pool? As long as you chuck it into the
bottom of the deep end, it's safe, and it's really impressive if the water
is warm enough "Fun stuff. It SCREAMS when it comes into contact with metal..."
"You can safely hold a small piece of dry ice in your mouth if you KEEP
IT MOVING CONSTANTLY. It looks like you're smoking or on fire." Editor's
Note: Dry ice can be a lot of fun, but be forewarned: Using anything but
plastic to contain dry ice bombs is suicidal. Dry ice is more dangerous
than TNT, because it's extremely unpredictable. Even a 2-liter bottle can
produce some nasty shrapnel: One source tells me that he caused an explosion
with a 2-liter bottle that destroyed a metal garbage can. In addition,
it is rumored that several kids have been killed by shards of glass resulting
from the use of a glass bottle. For some reason, dry ice bombs have become
very popular in the state of Utah. As a result, dry ice bombs have been
classified as infernal devices, and possession is a criminal offense.
205.Fuses / Ignitors
/ Delays by Exodus
There are many ways to ignite explosive
devices. There is the classic "light the fuse, throw the bomb, and run"
approach, and there are sensitive mercury switches, and many things in
between. Generally, electrical detonation systems are safer than fuses,
but there are times when fuses are more appropriate than electrical systems;
it is difficult to carry an electrical detonation system into a stadium,
for instance, without being caught. A device with a fuse or impact detonating
fuze would be easier to hide. FUSE IGNITION The oldest form of explosive
ignition, fuses are perhaps the favorite type of simple ignition system.
By simply placing a piece of waterproof fuse in a device, one can have
almost guaranteed ignition. Modern waterproof fuse is extremely reliable,
burning at a rate of about 2« seconds to the inch. It is available
as model rocketry fuse in most hobby shops, and costs about $3.00 for a
nine-foot length. Cannon Fuse is a popular ignition system for pipe bombers
because of its simplicity. All that need be done is light it with a match
or lighter. Of course, if the Army had fuses like this, then the grenade,
which uses fuse ignition, would be very impractical. If a grenade ignition
system can be acquired, by all means, it is the most effective. But, since
such things do not just float around, the next best thing is to prepare
a fuse system which does not require the use of a match or lighter, but
still retains its simplicity. One such method is described below: MATERIALS:
Strike-on-Cover type Matches Electrical Tape -or- Duct Tape Waterproof
Fuse To determine the burn rate of a particular type of fuse, simply measure
a 6 inch or longer piece of fuse and ignite it. With a stopwatch, press
the start button the at the instant when the fuse lights, and stop the
watch when the fuse reaches its end. Divide the time of burn by the length
of fuse, and you have the burn rate of the fuse, in seconds per inch. This
will be shown below: Suppose an eight inch piece of fuse is burned, and
its complete time of combustion is 20 seconds. 20 seconds / 8 inches =
2« seconds per inch. If a delay of 10 seconds was desired with this
fuse, divide the desired time by the number of seconds per inch: 10 seconds
/ 2« seconds per inch = 4 inches NOTE: THE LENGTH OF FUSE HERE MEANS
LENGTH OF FUSE TO THE POWDER. SOME FUSE, AT LEAST AN INCH, SHOULD BE INSIDE
THE DEVICE. ALWAYS ADD THIS EXTRA INCH, AND PUT THIS EXTRA INCH AN INCH
INTO THE DEVICE!!! After deciding how long a delay is desired before the
explosive device is to go off, add about « an inch to the premeasured
amount of fuse, and cut it off. Carefully remove the cardboard matches
from the paper match case. Do not pull off individual matches; keep all
the matches attached to the cardboard base. Take one of the cardboard match
sections, and leave the other one to make a second igniter. Wrap the matches
around the end of the fuse, with the heads of the matches touching the
very end of the fuse. Tape them there securely, making sure not to put
tape over the match heads. Make sure they are very secure by pulling on
them at the base of the assembly. They should not be able to move. Wrap
the cover of the matches around the matches attached to the fuse, making
sure that the striker paper is below the match heads and the striker faces
the match heads. Tape the paper so that is fairly tight around the matches.
Do not tape the cover of the striker to the fuse or to the matches. Leave
enough of the match book to pull on for ignition. _____________________
\ / \ / ------ match book cover \ / | M|f|M ---|------- match head | A|u|A
| | T|s|T | | C|e|C | |tapeH|.|Htape| | |f| | |#####|u|#####|-------- striking
paper |#####|s|#####| \ |e| / \ |.| / \ |f| / \ |u| / |ta|s|pe| |ta|e|pe|
|.| |.| |_| The match book is wrapped around the matches, and is taped
to itself. The matches are taped to the fuse. The striker will rub against
the matcheads when the match book is pulled. When ready to use, simply
pull on the match paper. It should pull the striking paper across the match
heads with enough friction to light them. In turn, the burning matcheads
will light the fuse, since it adjacent to the burning match heads. HOW
TO MAKE BLACKMATCH FUSE: Take a flat piece of plastic or metal (brass or
aluminum are easy to work with and won't rust). Drill a 1/16th inch hole
through it. This is your die for sizing the fuse. You can make fuses as
big as you want, but this is the right size for the pipe bomb I will be
getting to later. To about « cup of black powder add water to make
a thin paste. Add « teaspoon of corn starch. Cut some one foot lengths
of cotton thread. Use cotton, not silk or thread made from synthetic fibers.
Put these together until you have a thickness that fills the hole in the
die but can be drawn through very easily. Tie your bundle of threads together
at one end. Separate the threads and hold the bundle over the black powder
mixture. Lower the threads with a circular motion so they start curling
onto the mixture. Press them under with the back of a teaspoon and continue
lowering them so they coil into the paste. Take the end you are holding
and thread it through the die. Pull it through smoothly in one long motion.
To dry your fuse, lay it on a piece of aluminum foil and bake it in your
250ø oven or tie it to a grill in the oven and let it hang down.
The fuse must be baked to make it stiff enough for the uses it will be
put to later. Air drying will not do the job. If you used Sodium Nitrate,
it will not even dry completely at room temperatures. Cut the dry fuse
with scissors into 2 inch lengths and store in an air tight container.
Handle this fuse carefully to avoid breaking it. You can also use a firecracker
fuse if you have any available. The fuses can usually be pulled out without
breaking. To give yourself some running time, you will be extending these
fuses (blackmatch or firecracker fuse) with sulfured wick. Finally, it
is possible to make a relatively slow-burning fuse in the home. By dissolving
about one teaspoon of black powder in about 1/4 a cup of boiling water,
and, while it is still hot, soaking in it a long piece of all cotton string,
a slow-burning fuse can be made. After the soaked string dries, it must
then be tied to the fuse of an explosive device. Sometimes, the end of
the slow burning fuse that meets the normal fuse has a charge of black
powder or gunpowder at the intersection point to insure ignition, since
the slow-burning fuse does not burn at a very high temperature. A similar
type of slow fuse can be made by taking the above mixture of boiling water
and black powder and pouring it on a long piece of toilet paper. The wet
toilet paper is then gently twisted up so that it resembles a firecracker
fuse, and is allowed to dry. HOW TO MAKE SULFURED WICK Use heavy cotton
string about 1/8th inch in diameter. You can find some at a garden supply
for tying up your tomatoes. Be sure it's cotton. You can test it by lighting
one end. It should continue to burn after the match is removed and when
blown out will have a smoldering coal on the end. Put some sulfur in a
small container like a small pie pan and melt it in the oven at 250ø.
It will melt into a transparent yellow liquid. If it starts turning brown,
it is too hot. Coil about a one foot length of string into it. The melted
sulfur will soak in quickly. When saturated, pull it out and tie it up
to cool and harden. It can be cut to desired lengths with scissors. 2 inches
is about right. These wicks will burn slowly with a blue flame and do not
blow out easily in a moderate wind. They will not burn through a hole in
a metal pipe, but are great for extending your other fuse. They will not
throw off sparks. Blackmatch generates sparks which can ignite it along
its length causing unpredictable burning times. ---IMPACT IGNITION--- Impact
ignition is an excellent method of ignition for spontaneous terrorist activities.
The problem with an impact-detonating device is that it must be kept in
a very safe container so that it will not explode while being transported
to the place where it is to be used. This can be done by having a removable
impact initiator. The best and most reliable impact initiator is one that
uses factory made initiators or primers. A No. 11 cap for black powder
firearms is one such primer. They usually come in boxes of 100, and cost
about $2«0. To use such a cap, however, one needs a nipple that it
will fit on. Black powder nipples are also available in gun stores. All
that a person has to do is ask for a package of nipples and the caps that
fit them. Nipples have a hole that goes all the way through them, and they
have a threaded end, and an end to put the cap on. A cutaway of a nipple
is shown below: ________________ | | _ | | | | |/\/\/\/\/\/\/\/\| _______|
|^^^^^^^| | ___________| | | No. 11 |_______| percussion _______ -------
Threads for screwing cap : here |__________ nipple onto bomb |____ | |
|^^^^^^^^^| |_| |/\/\/\/\/\/\/\/\/| | | |_________________| When making
using this type of initiator, a hole must be drilled into whatever container
is used to make the bomb out of. The nipple is then screwed into the hole
so that it fits tightly. Then, the cap can be carried and placed on the
bomb when it is to be thrown. The cap should be bent a small amount before
it is placed on the nipple, to make sure that it stays in place. The only
other problem involved with an impact detonating bomb is that it must strike
a hard surface on the nipple to set it off. By attaching fins or a small
parachute on the end of the bomb opposite the primer, the bomb, when thrown,
should strike the ground on the primer, and explode. Of course, a bomb
with mercury fulminate in each end will go off on impact regardless of
which end it strikes on, but mercury fulminate is also likely to go off
if the person carrying the bomb is bumped hard. ---MAGICUBE IGNITOR---
A VERY SENSITIVE and reliable impact initiator can be produced from the
common MAGICUBE ($2.40 for 12) type flashbulbs. Simply crack the plastic
cover off, remove the reflector, and you will see 4 bulbs, each of which
has a small metal rod holding it in place. CAREFULLY grasp this rod with
a pair of needle-nose pliers, and pry gently upwards, making sure that
NO FORCE IS APPLIED TO THE GLASS BULB. Each bulb is coated with plastic,
which must be removed for them to be effective in our application. This
coating can be removed by soaking the bulbs in a small glass of acetone
for 30-45 minutes, at which point the plastic can be easily peeled away.
The best method to use these is to dissolve some nitrocellulose based smokeless
powder in acetone and/or ether, forming a thick glue-like paste. Coat the
end of the fuse with this paste, then stick the bulb (with the metal rod
facing out) into the paste. About half the bulb should be completely covered,
and if a VERY THIN layer of nitrocellulose is coated over the remainder
then ignition should be very reliable. To insure that the device lands
with the bulb down, a small streamer can be attached to the opposite side,
so when it is tossed high into the air the appropriate end will hit the
ground first. ---ELECTRICAL IGNITION--- Electrical ignition systems for
detonation are usually the safest and most reliable form of ignition. Electrical
systems are ideal for demolition work, if one doesn't have to worry so
much about being caught. With two spools of 500 ft of wire and a car battery,
one can detonate explosives from a "safe", comfortable distance, and be
sure that there is nobody around that could get hurt. With an electrical
system, one can control exactly what time a device will explode, within
fractions of a second. Detonation can be aborted in less than a second's
warning, if a person suddenly walks by the detonation sight, or if a police
car chooses to roll by at the time. The two best electrical igniters are
military squibs and model rocketry igniters. Blasting caps for construction
also work well. Model rocketry igniters are sold in packages of six, and
cost about $1.00 per pack. All that need be done to use them is connect
it to two wires and run a current through them. Military squibs are difficult
to get, but they are a little bit better, since they explode when a current
is run through them, whereas rocketry igniters only burst into flame. Most
squibs will NOT detonate KClO3/petroleum jelly or RDX. This requires a
blasting cap type detonation in most cases. There are, however, military
explosive squibs which will do the job. Igniters can be used to set off
black powder, mercury fulminate, or guncotton, which in turn, can set of
a high order explosive. ---
HOW TO MAKE AN
ELECTRIC FUZE--- By Capt. Hack & GW
Take a flashlight bulb and place it
glass tip down on a file. Grind it down on the file until there is a hole
in the end. Solder one wire to the case of the bulb and another to the
center conductor at the end. Fill the bulb with black powder or powdered
match head. One or two flashlight batteries will heat the filament in the
bulb causing the powder to ignite. ---ANOTHER ELECTRIC FUZE--- Take a medium
grade of steel wool and pull a strand out of it. Attach it to the ends
of two pieces of copper wire by wrapping it around a few turns and then
pinch on a small piece of solder to bind the strand to the wire. You want
about « inch of steel strand between the wires. Number 18 or 20 is
a good size wire to use. Cut a « by 1 inch piece of cardboard of
the type used in match covers. Place a small pile of powdered match head
in the center and press it flat. Place the wires so the steel strand is
on top of and in contact with the powder. Sprinkle on more powder to cover
the strand. The strand should be surrounded with powder and not touching
anything else except the wires at its ends. Place a piece of blackmatch
in contact with the powder. Now put a piece of masking tape on top of the
lot, and fold it under on the two ends. Press it down so it sticks all
around the powder. The wires are sticking out on one side and the blackmatch
on the other. A single flashlight battery will set this off. ---ELECTRO-MECHANICAL
IGNITION--- Electro-mechanical ignition systems are systems that use some
type of mechanical switch to set off an explosive charge electrically.
This type of switch is typically used in booby traps or other devices in
which the person who places the bomb does not wish to be anywhere near
the device when it explodes. Several types of electro-mechanical detonators
will be discussed ---Mercury Switches--- Mercury switches are a switch
that uses the fact that mercury metal conducts electricity, as do all metals,
but mercury metal is a liquid at room temperatures. A typical mercury switch
is a sealed glass tube with two electrodes and a bead of mercury metal.
It is sealed because of mercury's nasty habit of giving off brain-damaging
vapors. The diagram below may help to explain a mercury switch. ______________
A / \ B _____wire +______/_________ \ \ ( Hg )| / \ _(_Hg___)|___/ | |
wire - | | | When the drop of mercury ("Hg" is mercury's atomic symbol)
touches both contacts, current flows through the switch. If this particular
switch was in its present position, A---B, current would be flowing, since
the mercury can touch both contacts in the horizontal position. If, however,
it was in the | position, the drop of mercury would only touch the + contact
on the A side. Current, then couldn't flow, since mercury does not reach
both contacts when the switch is in the vertical position. This type of
switch is ideal to place by a door. If it were placed in the path of a
swinging door in the vertical position, the motion of the door would knock
the switch down, if it was held to the ground by a piece if tape. This
would tilt the switch into the vertical position, causing the mercury to
touch both contacts, allowing current to flow through the mercury, and
to the igniter or squib in an explosive device. ---Tripwire Switches---
A tripwire is an element of the classic booby trap. By placing a nearly
invisible line of string or fishing line in the probable path of a victim,
and by putting some type of trap there also, nasty things can be caused
to occur. If this mode of thought is applied to explosives, how would one
use such a tripwire to detonate a bomb. The technique is simple. By wrapping
the tips of a standard clothespin with aluminum foil, and placing something
between them, and connecting wires to each aluminum foil contact, an electric
tripwire can be made, If a piece of wood attached to the tripwire was placed
between the contacts on the clothespin, the clothespin would serve as a
switch. When the tripwire was pulled, the clothespin would snap together,
allowing current to flow between the two pieces of aluminum foil, thereby
completing a circuit, which would have the igniter or squib in it. Current
would flow between the contacts to the igniter or squib, heat the igniter
or squib, causing it to explode. Make sure that the aluminum foil contacts
do not touch the spring, since the spring also conducts electricity. ---Radio
Control Detonators--- In the movies, every terrorist or criminal uses a
radio controlled detonator to set off explosives. With a good radio detonator,
one can be several miles away from the device, and still control exactly
when it explodes, in much the same way as an electrical switch. The problem
with radio detonators is that they are rather costly. However, there could
possibly be a reason that a terrorist would wish to spend the amounts of
money involved with a RC (radio control) system and use it as a detonator.
If such an individual wanted to devise an RC detonator, all he would need
to do is visit the local hobby store or toy store, and buy a radio controlled
toy. Taking it back to his/her abode, all that he/she would have to do
is detach the solenoid/motor that controls the motion of the front wheels
of a RC car, or detach the solenoid/motor of the elevators/rudder of a
RC plane, or the rudder of a RC boat, and re-connect the squib or rocket
engine igniter to the contacts for the solenoid/motor. The device should
be tested several times with squibs or igniters, and fully charged batteries
should be in both he controller and the receiver (the part that used to
move parts before the device became a detonator). ---DELAYS--- A delay
is a device which causes time to pass from when a device is set up to the
time that it explodes. A regular fuse is a delay, but it would cost quite
a bit to have a 24 hour delay with a fuse. This section deals with the
different types of delays that can be employed by a terrorist who wishes
to be sure that his bomb will go off, but wants to be out of the country
when it does. ---FUSE DELAYS--- It is extremely simple to delay explosive
devices that employ fuses for ignition. Perhaps the simplest way to do
so is with a cigarette. An average cigarette burns for between 8-11 minutes.
The higher the "tar" and nicotine rating, the slower the cigarette burns.
Low "tar" and nicotine cigarettes burn quicker than the higher "tar" and
nicotine cigarettes, but they are also less likely to go out if left unattended,
i.e. not smoked. Depending on the wind or draft in a given place, a high
"tar" cigarette is better for delaying the ignition of a fuse, but there
must be enough wind or draft to give the cigarette enough oxygen to burn.
People who use cigarettes for the purpose of delaying fuses will often
test the cigarettes that they plan to use in advance to make sure they
stay lit and to see how long it will burn. Once a cigarettes burn rate
is determined, it is a simple matter of carefully putting a hole all the
way through a cigarette with a toothpick at the point desired, and pushing
the fuse for a device in the hole formed. |=| |=| ---------- filter |=|
| | | | |o| ---------- hole for fuse cigarette ------------ | | | | | |
| | | | | | | | | | | | |_| ---------- light this end ---TIMER DELAYS---
Timer delays, or "time bombs" are usually employed by an individual who
wishes to threaten a place with a bomb and demand money to reveal its location
and means to disarm it. Such a device could be placed in any populated
place if it were concealed properly. There are several ways to build a
timer delay. By simply using a screw as one contact at the time that detonation
is desired, and using the hour hand of a clock as the other contact, a
simple timer can be made. The minute hand of a clock should be removed,
unless a delay of less than an hour is desired. The main disadvantage with
this type of timer is that it can only be set for a maximum time of 12
hours. If an electronic timer is used, such as that in an electronic clock,
then delays of up to 24 hours are possible. By removing the speaker from
an electronic clock, and attaching the wires of a squib or igniter to them,
a timer with a delay of up to 24 hours can be made. All that one has to
do is set the alarm time of the clock to the desired time, connect the
leads, and go away. This could also be done with an electronic watch, if
a larger battery were used, and the current to the speaker of the watch
was stepped up via a transformer. This would be good, since such a timer
could be extremely small. The timer in a VCR (Video Cassette Recorder)
would be ideal. VCR's can usually be set for times of up to a week. The
leads from the timer to the recording equipment would be the ones that
an igniter or squib would be connected to. Also, one can buy timers from
electronics stores that would be work well. Finally, one could employ a
digital watch, and use a relay, or electro-magnetic switch to fire the
igniter, and the current of the watch would not have to be stepped up.
---CHEMICAL DELAYS--- Chemical delays are uncommon, but they can be extremely
effective in some cases. These were often used in the bombs the Germans
dropped on England. The delay would ensure that a bomb would detonate hours
or even days after the initial bombing raid, thereby increasing the terrifying
effect on the British citizenry. If a glass container is filled with concentrated
sulfuric acid, and capped with several thicknesses of aluminum foil, or
a cap that it will eat through, then it can be used as a delay. Sulfuric
acid will react with aluminum foil to produce aluminum sulfate and hydrogen
gas, and so the container must be open to the air on one end so that the
pressure of the hydrogen gas that is forming does not break the container.
_ _ | | | | | | | | | | | | | |_____________| | | | | | | | sulfuric |
| | | | | | | acid | | | | | |---------- aluminum foil | |_____________|
| (several thicknesses) |_________________| The aluminum foil is placed
over the bottom of the container and secured there with tape. When the
acid eats through the aluminum foil, it can be used to ignite an explosive
device in several ways. Sulfuric acid is a good conductor of electricity.
If the acid that eats through the foil is collected in a glass container
placed underneath the foil, and two wires are placed in the glass container,
a current will be able to flow through the acid when both of the wires
are immersed in the acid. Sulfuric acid reacts very violently with potassium
chlorate. If the acid drips down into a container containing potassium
chlorate, the potassium chlorate will burst into flame. This flame can
be used to ignite a fuse, or the potassium chlorate can be the igniter
for a thermite bomb, if some potassium chlorate is mixed in a 50/50 ratio
with the thermite, and this mixture is used as an igniter for the rest
of the thermite. Sulfuric acid reacts with potassium permanganate in a
similar way.
206.Film Canisters
II by Bill
For a relatively low shrapnel explosion,
I suggest pouring it into an empty 35mm film canister. Poke a hole in the
plastic lid for a fuse. These goodies make an explosion audible a mile
away easily. Poke the hole before putting the flash powder into the canister.
Don't get any powder on the lip of the canister. Only use a very small
quantity and work your way up to the desired result. Do not pack the powder,
it works best loose. Do not grind or rub the mixture - it is friction sensitive.
Use a long fuse.
207.Book Bombs
by Exodus
Concealing a bomb can be extremely
difficult in a day and age where perpetrators of violence run wild. Bags
and briefcases are often searched by authorities whenever one enters a
place where an individual might intend to set off a bomb. One approach
to disguising a bomb is to build what is called a book bomb; an explosive
device that is entirely contained inside of a book. Usually, a relatively
large book is required, and the book must be of the hardback variety to
hide any protrusions of a bomb. Dictionaries, law books, large textbooks,
and other such books work well. When an individual makes a bookbomb, he/she
must choose a type of book that is appropriate for the place where the
book bomb will be placed. The actual construction of a book bomb can be
done by anyone who possesses an electric drill and a coping saw. First,
all of the pages of the book must be glued together. By pouring an entire
container of water-soluble glue into a large bucket, and filling the bucket
with boiling water, a glue-water solution can be made that will hold all
of the book's pages together tightly. After the glue-water solution has
cooled to a bearable temperature, and the solution has been stirred well,
the pages of the book must be immersed in the glue-water solution, and
each page must be thoroughly soaked. It is extremely important that the
covers of the book do not get stuck to the pages of the book while the
pages are drying. Suspending the book by both covers and clamping the pages
together in a vise works best. When the pages dry, after about three days
to a week, a hole must be drilled into the now rigid pages, and they should
drill out much like wood. Then, by inserting the coping saw blade through
the pages and sawing out a rectangle from the middle of the book, the individual
will be left with a shell of the book's pages. The pages, when drilled
out, should look like this: ________________________ | ____________________
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |
| | | | | | | | | | |__________________| | |______________________| (Book
covers omitted) This rectangle must be securely glued to the back cover
of the book. After building his/her bomb, which usually is of the timer
or radio controlled variety, the bomber places it inside the book. The
bomb itself, and whatever timer or detonator is used, should be packed
in foam to prevent it from rolling or shifting about. Finally, after the
timer is set, or the radio control has been turned on, the front cover
is glued closed, and the bomb is taken to its destination.
208.Phone Bombs
by Exodus
The phone bomb is an explosive device
that has been used in the past to kill or injure a specific individual.
The basic idea is simple: when the person answers the phone, the bomb explodes.
If a small but powerful high explosive device with a squib was placed in
the phone receiver, when the current flowed through the receiver, the squib
would explode, detonating the high explosive in the person's hand. Nasty.
All that has to be done is acquire a squib, and tape the receiver switch
down. Unscrew the mouthpiece cover, and remove the speaker, and connect
the squib's leads where it was. Place a high explosive putty, such as C-1
in the receiver, and screw the cover on, making sure that the squib is
surrounded by the C-1. Hang the phone up, and leave the tape in place.
When the individual to whom the phone belongs attempts to answer the phone,
he will notice the tape, and remove it. This will allow current to flow
through the squib. Note that the device will not explode by merely making
a phone call; the owner of the phone must lift up the receiver, and remove
the tape. It is highly probable that the phone will be by his/her ear when
the device explodes... IMPROVED PHONE BOMB The above seems overly complicated
to me... it would be better to rig the device as follows: FIRST UNPLUG
THE PHONE FROM THE WALL. Wire the detonator IN LINE with the wires going
to the earpiece, (may need to wire it with a relay so the detonator can
receive the full line power, not just the audio power to the earpiece)
Pack C4 into the phone body (NOT the handset) and plug it back in. When
they pick up the phone, power will flow through the circuit to the detonator....
________ /|------|\ ~ | | ~ @@@@@@@@ @@@@@@@@@@ @@@@@@@@@@
209.SPECIAL AMMUNITION
by Exodus
SPECIAL AMMUNITION FOR BLOWGUNS The
blowgun is an interesting weapon which has several advantages. A blowgun
can be extremely accurate, concealable, and deliver an explosive or poisoned
projectile. The manufacture of an explosive dart or projectile is not difficult.
To acquire a blowgun, please contact the editor at one of the addresses
given in the introduction. Perhaps the most simple design for such involves
the use of a pill capsule, such as the kind that are taken for headaches
or allergies. Empty gelatin pill capsules can be purchased from most health-food
stores. Next, the capsule would be filled with an impact-sensitive explosive,
such as mercury fulminate. An additional high explosive charge could be
placed behind the impact sensitive explosive, if one of the larger capsules
were used. Finally, the explosive capsule would be reglued back together,
and a tassel or cotton would be glued to the end containing the high explosive,
to insure that the impact-detonating explosive struck the target first.
Such a device would probably be about 3/4 of an inch long, not including
the tassel or cotton, and look something like this: ____________________
/mercury | \----------------------- (fulminate| R.D.X. )----------------------
} tassels \________|___________/----------------------- Care must be taken-
if a powerful dart went off in the blowgun, you could easily blow the back
of your head off. SPECIAL AMMUNITION FOR WRISTROCKETS AND SLINGSHOTS A
modern wristrocket is a formidable weapon. It can throw a shooter marble
about 500 ft. with reasonable accuracy. Inside of 200 ft., it could well
be lethal to a man or animal, if it struck in a vital area. Because of
the relatively large sized projectile that can be used in a wristrocket,
the wristrocket can be adapted to throw relatively powerful explosive projectiles.
A small segment of aluminum pipe could be made into an impact-detonating
device by filling it with an impact-sensitive explosive material. Also,
such a pipe could be filled with a low-order explosive, and fitted with
a fuse, which would be lit before the device was shot. One would have to
make sure that the fuse was of sufficient length to insure that the device
did not explode before it reached its intended target. Finally, .22 caliber
caps, such as the kind that are used in .22 caliber blank guns, make excellent
exploding ammunition for wristrockets, but they must be used at a relatively
close range, because of their light weight. SPECIAL AMMUNITION FOR FIREARMS
When special ammunition is used in combination with the power and rapidity
of modern firearms, it becomes very easy to take on a small army with a
single weapon. It is possible to buy explosive ammunition, but that can
be difficult to do. Such ammunition can also be manufactured in the home.
There is, however, a risk involved with modifying any ammunition. If the
ammunition is modified incorrectly, in such a way that it makes the bullet
even the slightest bit wider, an explosion in the barrel of the weapon
will occur. For this reason, NOBODY SHOULD EVER ATTEMPT TO MANUFACTURE
SUCH AMMUNITION. SPECIAL AMMUNITION FOR HANDGUNS If an individual wished
to produce explosive ammunition for his/her handgun, he/she could do it,
provided that the person had an impact-sensitive explosive and a few simple
tools. One would first purchase all lead bullets, and then make or acquire
an impact-detonating explosive. By drilling a hole in a lead bullet with
a drill, a space could be created for the placement of an explosive. After
filling the hole with an explosive, it would be sealed in the bullet with
a drop of hot wax from a candle. A diagram of a completed exploding bullet
is shown below. _o_ ------------ drop of wax /|*|\ | |*|-|----------- impact-sensitive
explosive | |_| | |_____| This hollow space design also works for putting
poison in bullets. In many spy thrillers, an assassin is depicted as manufacturing
"exploding bullets" by placing a drop of mercury in the nose of a bullet.
Through experimentation it has been found that this will not work. Mercury
reacts with lead to form a inert silvery compound. SPECIAL AMMUNITION FOR
SHOTGUNS Because of their large bore and high power, it is possible to
create some extremely powerful special ammunition for use in shotguns.
If a shotgun shell is opened at the top, and the shot removed, the shell
can be re-closed. Then, if one can find a very smooth, lightweight wooden
dowel that is close to the bore width of the shotgun, a person can make
several types of shotgun-launched weapons. Insert the dowel in the barrel
of the shotgun with the shell without the shot in the firing chamber. Mark
the dowel about six inches away from the end of the barrel, and remove
it from the barrel. Next, decide what type of explosive or incendiary device
is to be used. This device can be a chemical fire bottle, a pipe bomb,
or a thermite bomb. After the device is made, it must be securely attached
to the dowel. When this is done, place the dowel back in the shotgun. The
bomb or incendiary device should be on the end of the dowel. Make sure
that the device has a long enough fuse, light the fuse, and fire the shotgun.
If the projectile is not too heavy, ranges of up to 300 ft are possible.
A diagram of a shotgun projectile is shown below: ____ || | || | || | -----
bomb, securely taped to dowel || | ||__| || | || | ------- fuse || | ||
|| || || --------- dowel || || || || --------- insert this end into shotgun
|| || Special "grenade-launcher blanks" should be used - use of regular
blank ammunition may cause the device to land perilously close to the user.
SPECIAL AMMUNITION FOR COMPRESSED AIR/GAS WEAPONS This section deals with
the manufacture of special ammunition for compressed air or compressed
gas weapons, such as pump BB guns, COý BB guns, and .22 cal pellet
guns. These weapons, although usually thought of as kids toys, can be made
into rather dangerous weapons. SPECIAL AMMUNITION FOR BB GUNS A BB gun,
for this manuscript, will be considered any type of rifle or pistol that
uses compressed air or COý gas to fire a projectile with a caliber
of .177, either BB, or lead pellet. Such guns can have almost as high a
muzzle velocity as a bullet-firing rifle. Because of the speed at which
a .177 caliber projectile flies, an impact detonating projectile can easily
be made that has a caliber of .177. Most ammunition for guns of greater
than .22 caliber use primers to ignite the powder in the bullet. These
primers can be bought at gun stores, since many people like to reload their
own bullets. Such primers detonate when struck by the firing pin of a gun.
They will also detonate if they are thrown at a hard surface at a great
speed. Usually, they will also fit in the barrel of a .177 caliber gun.
If they are inserted flat end first, they will detonate when the gun is
fired at a hard surface. If such a primer is attached to a piece of thin
metal tubing, such as that used in an antenna, the tube can be filled with
an explosive, be sealed, and fired from a BB gun. A diagram of such a projectile
appears below: _____ primers _______ | | | | | | V V ______ ______ | ________________________
|------------------- | ****** explosive ******* |------------------- }
tassel or | ________________________ |------------------- cotton |_____
_____|------------------- ^ | | |_______ antenna tubing The front primer
is attached to the tubing with a drop of super glue. The tubing is then
filled with an explosive, and the rear primer is glued on. Finally, a tassel,
or a small piece of cotton is glued to the rear primer, to insure that
the projectile strikes on the front primer. The entire projectile should
be about 3/4 of an inch long. SPECIAL AMMUNITION FOR .22 CALIBER PELLET
GUNS A .22 caliber pellet gun usually is equivalent to a .22 cal rifle,
at close ranges. Because of this, relatively large explosive projectiles
can be adapted for use with .22 caliber air rifles. A design similar to
that used in the begining of this document is suitable, since some capsules
are about .22 caliber or smaller. Or, a design similar to that in this
document could be used, only one would have to purchase black powder percussion
caps, instead of ammunition primers, since there are percussion caps that
are about .22 caliber. A #11 cap is too small, but anything larger will
do nicely.
210.Rocketry by
Exodus
Rockets and cannon are generally thought
of as heavy artillery. Perpetrators of violence do not usually employ such
devices, because they are difficult or impossible to acquire. They are
not, however, impossible to make. Any individual who can make or buy black
powder or pyrodex can make such things. A terrorist with a cannon or large
rocket is, indeed, something to fear. ROCKETS Rockets were first developed
by the Chinese several hundred years before the myth of Christ began. They
were used for entertainment in the form of fireworks. They were not usually
used for military purposes because they were inaccurate, expensive, and
unpredictable. In modern times, however, rockets are used constantly by
the military, since they are cheap, reliable, and have no recoil. Perpetrators
of violence, fortunately, cannot obtain military rockets, but they can
make or buy rocket engines. Model rocketry is a popular hobby of the space
age, and to launch a rocket, an engine is required. Estes, a subsidiary
of Damon, is the leading manufacturer of model rockets and rocket engines.
Their most powerful engine, the "D" engine, can develop almost 12 lbs of
thrust; enough to send a relatively large explosive charge a significant
distance. Other companies, such as Centuri, produce even larger rocket
engines, which develop up to 30 lbs of thrust. These model rocket engines
are quite reliable, and are designed to be fired electrically. Most model
rocket engines have three basic sections. The diagram below will help explain
them. _________________________________________________________ |_________________________________________________________|
-- cardboard \ clay | - - - - - - - - - - | * * * | . . . .|c| casing \_______|
- - - - - - - - - | * * * | . . . |l| _______ - - - thrust - - - | smoke
| eject |a| / clay | - - - - - - - - - | * * * | . . . .|y| /________|_____________________|_______|________|_|_______
|_________________________________________________________| -- cardboard
casing The clay nozzle is where the igniter is inserted. When the area
labeled "thrust" is ignited, the "thrust" material, usually a large single
grain of a propellant such as black powder or pyrodex, burns, forcing large
volumes of hot, rapidly expanding gasses out the narrow nozzle, pushing
the rocket forward. After the material has been consumed, the smoke section
of the engine is ignited. It is usually a slow-burning material, similar
to black powder that has had various compounds added to it to produce visible
smoke, usually black, white, or yellow in color. This section exists so
that the rocket will be seen when it reaches its maximum altitude, or apogee.
When it is burned up, it ignites the ejection charge, labeled "eject".
The ejection charge is finely powdered black powder. It burns very rapidly,
exploding, in effect. The explosion of the ejection charge pushes out the
parachute of the model rocket. It could also be used to ignite the fuse
of a bomb... Rocket engines have their own peculiar labeling system. Typical
engine labels are: 1/4A-2T, 1/2A-3T, A8-3, B6-4, C6-7, and D12-5. The letter
is an indicator of the power of an engine. "B" engines are twice as powerful
as "A" engines, and "C" engines are twice as powerful as "B" engines, and
so on. The number following the letter is the approximate thrust of the
engine, in pounds. the final number and letter is the time delay, from
the time that the thrust period of engine burn ends until the ejection
charge fires; "3T" indicates a 3 second delay. NOTE: An extremely effective
rocket propellant can be made by mixing aluminum dust with ammonium perchlorate
and a very small amount of iron oxide. The mixture is bound together by
an epoxy. BASIC ROCKET BOMB A rocket bomb is simply what the name implies:
a bomb that is delivered to its target by means of a rocket. Most people
who would make such a device would use a model rocket engine to power the
device. By cutting fins from balsa wood and gluing them to a large rocket
engine, such as the Estes "C" engine, a basic rocket could be constructed.
Then, by attaching a "crater maker", or COý cartridge bomb to the
rocket, a bomb would be added. To insure that the fuse of the "crater maker"
ignited, the clay over the ejection charge of the engine should be scraped
off with a plastic tool. The fuse of the bomb should be touching the ejection
charge, as shown below. ____________ rocket engine | _________ crater maker
| | | | V | _______________________________V_ |_______________________________|
______________________ \ | - - - - - -|***|::::| /# # # # # # # # # # #
\ \__| - - - - - -|***|::::| ___/ # # # # # # # # # # # \ __ - - - - -
-|***|::::|---fuse--- # # explosive # # ) / | - - - - - -|***|::::| ___
# # # # # # # # # # # / /___|____________|___|____|____ \_______________________/
|_______________________________| thrust> - - - - - - smoke> *** ejection
charge> :::: Duct tape is the best way to attach the crater maker to the
rocket engine. Note in the diagram the absence of the clay over the ejection
charge Many different types of explosive payloads can be attached to the
rocket, such as a high explosive, an incendiary device, or a chemical fire
bottle. Either four or three fins must be glued to the rocket engine to
insure that the rocket flies straight. The fins should look like the following
diagram: |\ | \ | \ | \ <--------- glue this to rocket engine | \ |
\ | \ | | | | | | leading edge | -------> | | | | | trailing edge | | <--------
| | | | | | | | \_____/ The leading edge and trailing edge should be sanded
with sandpaper so that they are rounded. This will help make the rocket
fly straight. A two inch long section of a plastic straw can be attached
to the rocket to launch it from. A clothes hanger can be cut and made into
a launch rod. The segment of a plastic straw should be glued to the rocket
engine adjacent to one of the fins of the rocket. A front view of a completed
rocket bomb is shown below. | fin | <------ fin | | | | | | | __|__
| V / \ V ---------------| |--------------- \_____/ |o <-----------
segment of plastic straw | | | <------ fin | | By cutting a coat hanger
at the indicated arrows, and bending it, a launch rod can be made. After
a fuse is inserted in the engine, the rocket is simply slid down the launch
rod, which is put through the segment of plastic straw. The rocket should
slide easily along a coathanger, such as the one illustrated on the following
page: ____ / \ | | cut here _____ | | | | | | / \ V / \ _________________/
\________________ / \ / \ /____________________________________________\
^ | | and here ______| Bend wire to this shape: _______ insert into straw
| | | V ____________________________________________ \ \ \ \ \ <---------
bend here to adjust flight angle | | | | | | <---------- put this end
in ground | LONG RANGE ROCKET BOMB Long range rockets can be made by using
multi-stage rockets. Model rocket engines with an "0" for a time delay
are designed for use in multi-stage rockets. An engine such as the D12-0
is an excellent example of such an engine. Immediately after the thrust
period is over, the ejection charge explodes. If another engine is placed
directly against the back of an "0" engine, the explosion of the ejection
charge will send hot gasses and burning particles into the nozzle of the
engine above it, and ignite the thrust section. This will push the used
"0" engine off of the rocket, causing an overall loss of weight. The main
advantage of a multi-stage rocket is that it loses weight as travels, and
it gains velocity. Multi-stage rockets must be designed somewhat differently
than a single stage rocket, since, in order for a rockets to fly straight,
their center of gravity must be ahead of their center of drag. This is
accomplished by adding weight to the front of the rocket, or by moving
the center of drag back by putting fins on the rocket that are well behind
the rocket. A diagram of a multi-stage rocket appears on the following
page: ___ / \ | | | C | | M | ------ CM: Crater Maker | | | | |___| | |
| | | | | C | ------ C6-5 rocket engine /| 6 |\ / | | | \ / | 5 | \ / |___|
\ ---- fin / /| |\ \ / / | | \ \ / / | | \ \ / / | C | \ \ | / | 6 | \
| | / | | | \ | | / | 0 | \ | |/ |___| \| | / \ | \______/ ^ \______/ -------
fin | | | | C6-0 rocket engine The fuse is put in the bottom engine. Two,
three, or even four stages can be added to a rocket bomb to give it a longer
range. It is important, however, that for each additional stage, the fin
area gets larger.
211.Basic Pipe
Cannon by Exodus
A simple cannon can be made from a
thick pipe by almost anyone. The only difficult part is finding a pipe
that is extremely smooth on its interior. This is absolutely necessary;
otherwise, the projectile may jam. Copper or aluminum piping is usually
smooth enough, but it must also be extremely thick to withstand the pressure
developed by the expanding hot gasses in a cannon. If one uses a projectile
such as a COý cartridge, since such a projectile can be made to
explode, a pipe that is about 1« - 2 feet long is ideal. Such a pipe
MUST have walls that are at least 1/3 to « an inch thick, and be
very smooth on the interior. If possible, screw an endplug into the pipe.
Otherwise, the pipe must be crimped and folded closed, without cracking
or tearing the pipe. A small hole is drilled in the back of the pipe near
the crimp or endplug. Then, all that need be done is fill the pipe with
about two teaspoons of grade blackpowder or pyrodex, insert a fuse, pack
it lightly by ramming a wad of tissue paper down the barrel, and drop in
a COý cartridge. Brace the cannon securely against a strong structure,
light the fuse, and run. If the person is lucky, he will not have overcharged
the cannon, and he will not be hit by pieces of exploding barrel. Such
a cannon would look like this: __________________ fuse hole | | V ________________________________________________________________
| |_____________________________________________________________| |endplug|powder|t.p.|
COý cartridge | ______|______|____|____________________________________________
|_|______________________________________________________________| An exploding
projectile can be made for this type of cannon with a COý cartridge.
It is relatively simple to do. Just make a crater maker, and construct
it such that the fuse projects about an inch from the end of the cartridge.
Then, wrap the fuse with duct tape, covering it entirely, except for a
small amount at the end. Put this in the pipe cannon without using a tissue
paper packing wad. When the cannon is fired, it will ignite the end of
the fuse, and shoot the COý cartridge. The explosive-filled cartridge
will explode in about three seconds, if all goes well. Such a projectile
would look like this: ___ ( ) |C | | M| | | | | \ / [] <--- taped fuse
[] [] ! <--- Bare fuse (add matcheads) ROCKET FIRING CANNON A rocket
firing cannon can be made exactly like a normal cannon; the only difference
is the ammunition. A rocket fired from a cannon will fly further than a
rocket alone, since the action of shooting it overcomes the initial inertia.
A rocket that is launched when it is moving will go further than one that
is launched when it is stationary. Such a rocket would resemble a normal
rocket bomb, except it would have no fins. It would look like the image
below. The fuse on such a device would, obviously, be short, but it would
not be ignited until the rocket's ejection charge exploded. Thus, the delay
before the ejection charge, in effect, becomes the delay before the bomb
explodes. Note that no fuse need be put in the rocket; the burning powder
in the cannon will ignite it, and simultaneously push the rocket out of
the cannon at a high velocity. ___ / \ | | | C | | M | | | | | |___| |
E | | N | | G | | I | | N | | E | |___| REINFORCED PIPE CANNON In high
school, a friend and I built cannons and launched COý cartridges,
etc, etc. However, the design of the cannon is what I want to add here.
It was made from plain steel water pipe, steel wire, and lead. Here is
a cross section: _______ | | | xxxxx_____________________________________________
2" ID pipe | |_________________________________________________ | | ....................
<- steel wire } | | _____ } 3/4" ID pipe this | | | xxx______________________________________}_________________
wire | | | |__________________________________________________________
holds | |....| | it up |>|....| | in the| | | |__________________________________________________________
cooker| | | xxx________________________________________________________
| | |____ } | | ..................... } <- cast lead | |_______________________________________________}_
| | _____________________________________________ | xxxxx |_____| We dug
into the side of a sand pile and built a chimney out of firebrick. Then
we stood the assembled pipe and wire on end in the chimney, sitting on
some bricks. We then had a blowtorch heating up the chimney, so that the
pipe was red hot. Then we poured molten lead into the space between the
pipes. If the caps aren't screwed on real tight, some of the lead will
leak out. If that happens, turn off the blowtorch and the pipe will cool
enough and the lead will stiffen and stop the leak. We used homemade and
commercial black powder, and slow smokeless shotgun powder in this thing.
After hundreds of shots we cut it up and there was no evidence of cracks
or swelling of the inner pipe.
212.Smoke Bombs
by Exodus
One type of pyrotechnic device that
might be employed by a terrorist in many way would be a smoke bomb. Such
a device could conceal the getaway route, or cause a diversion, or simply
provide cover. Such a device, were it to produce enough smoke that smelled
bad enough, could force the evacuation of a building, for example. Smoke
bombs are not difficult to make. Although the military smoke bombs employ
powdered white phosphorus or titanium compounds, such materials are usually
unavailable to even the most well-equipped terrorist. Instead, he/she would
have to make the smoke bomb for themselves. Most homemade smoke bombs usually
employ some type of base powder, such as black powder or pyrodex, to support
combustion. The base material will burn well, and provide heat to cause
the other materials in the device to burn, but not completely or cleanly.
Table sugar, mixed with sulfur and a base material, produces large amounts
of smoke. Sawdust, especially if it has a small amount of oil in it, and
a base powder works well also. Other excellent smoke ingredients are small
pieces of rubber, finely ground plastics, and many chemical mixtures. The
material in road flares can be mixed with sugar and sulfur and a base powder
produces much smoke. Most of the fuel-oxidizer mixtures, if the ratio is
not correct, produce much smoke when added to a base powder. The list of
possibilities goes on and on. The trick to a successful smoke bomb also
lies in the container used. A plastic cylinder works well, and contributes
to the smoke produced. The hole in the smoke bomb where the fuse enters
must be large enough to allow the material to burn without causing an explosion.
This is another plus for plastic containers, since they will melt and burn
when the smoke material ignites, producing an opening large enough to prevent
an explosion. ---SIMPLE SMOKE--- The following reaction should produce
a fair amount of smoke. Since this reaction is not all that dangerous you
can use larger amounts if necessary 6 pt. ZINC POWDER 1 pt. SULFUR POWDER
Insert a red hot wire into the pile, step back. ---COLORED FLAMES--- Colored
flames can often be used as a signaling device for terrorists. By putting
a ball of colored flame material in a rocket; the rocket, when the ejection
charge fires, will send out a burning colored ball. The materials that
produce the different colors of flames appear below. COLORMATERIALUSED
INRedStrontium SaltsRoad Flares [Strontium Nitrate]Red SparklersGreenBarium
SaltsGreen Sparklers [Barium Nitrate]YellowSodium SaltsGold Sparklers
[Sodium Nitrate]BluePowdered CopperBlue Sparklers Old PenniesWhitePowdered
Magnesium -or-Firestarters AluminumAluminum FoilPurplePotassium
PermanganatePurple Fountains Treating Sewage
213.Firecrackers
by Exodus
A simple firecracker can be made from
cardboard tubing and epoxy. The instructions are below: Cut a small piece
of cardboard tubing from the tube you are using. "Small" means anything
less than 4 times the diameter of the tube. Set the section of tubing down
on a piece of wax paper, and fill it with epoxy and the drying agent to
a height of 3/4 the diameter of the tubing. Allow the epoxy to dry to maximum
hardness, as specified on the package. When it is dry, put a small hole
in the middle of the tube, and insert a desired length of fuse. Fill the
tube with any type of flame-sensitive explosive. Flash powder, pyrodex,
black powder, potassium picrate, lead azide, nitrocellulose, or any of
the fast burning fuel-oxidizer mixtures will do nicely. Fill the tube almost
to the top. Pack the explosive tightly in the tube with a wad of tissue
paper and a pencil or other suitable ramrod. Be sure to leave enough space
for more epoxy. Fill the remainder of the tube with the epoxy and hardener,
and allow it to dry. For those who wish to make spectacular firecrackers,
always use flash powder, mixed with a small amount of other material for
colors. By crushing the material on a sparkler, and adding it to the flash
powder, the explosion will be the same color as the sparkler. By adding
small chunks of sparkler material, the device will throw out colored burning
sparks, of the same color as the sparkler. By adding powdered iron, orange
sparks will be produced. White sparks can be produced from magnesium shavings,
or from small, LIGHTLY crumpled balls of aluminum foil. Example: Suppose
I wish to make a firecracker that will explode with a red flash, and throw
out white sparks. First, I would take a road flare, and finely powder the
material inside it. Or, I could take a red sparkler, and finely powder
it. Then, I would mix a small amount of this material with the flash powder.
NOTE: FLASH POWDER MAY REACT WITH SOME MATERIALS THAT IT IS MIXED WITH,
AND EXPLODE SPONTANEOUSLY! I would mix it in a ratio of 9 parts flash powder
to 1 part of flare or sparkler material, and add about 15 small balls of
aluminum foil I would store the material in a plastic bag overnight outside
of the house, to make sure that the stuff doesn't react. Then, in the morning,
I would test a small amount of it, and if it was satisfactory, I would
put it in the firecracker. If this type of firecracker is mounted on a
rocket engine, professional to semi-professional displays can be produced.
---SKYROCKETS--- An impressive home made skyrocket can easily be made in
the home from model rocket engines. Estes engines are recommended. Buy
an Estes Model Rocket Engine of the desired size, remembering that the
power doubles with each letter. Either buy a section of body tube for model
rockets that exactly fits the engine, or make a tube from several thicknesses
of paper and glue. Scrape out the clay backing on the back of the engine,
so that the powder is exposed. Glue the tube to the engine, so that the
tube covers at least half the engine. Pour a small charge of flash powder
in the tube, about « an inch. By adding materials as detailed in
the section on firecrackers, various types of effects can be produced.
By putting Jumping Jacks or bottle rockets without the stick in the tube,
spectacular displays with moving fireballs or MRV's can be produced. Finally,
by mounting many home made firecrackers on the tube with the fuses in the
tube, multiple colored bursts can be made. ---ROMAN CANDLES--- Roman candles
are impressive to watch. They are relatively difficult to make, compared
to the other types of home-made fireworks, but they are well worth the
trouble. Buy a « inch thick model rocket body tube, and reinforce
it with several layers of paper and/or masking tape. This must be done
to prevent the tube from exploding. Cut the tube into about 10 inch lengths.
Put the tube on a sheet of wax paper, and seal one end with epoxy and the
drying agent. About « of an inch is sufficient. Put a hole in the
tube just above the bottom layer of epoxy, and insert a desired length
of water proof fuse. Make sure that the fuse fits tightly. Pour about 1
inch of pyrodex or gunpowder down the open end of the tube. Make a ball
by powdering about two 6 inch sparklers of the desired color. Mix this
powder with a small amount of flash powder and a small amount of pyrodex,
to have a final ratio (by volume) of 60% sparkler material / 20% flash
powder / 20% pyrodex. After mixing the powders well, add water, one drop
at a time, and mixing continuously, until a damp paste is formed. This
paste should be moldable by hand, and should retain its shape when left
alone. Make a ball out of the paste that just fits into the tube. Allow
the ball to dry. When it is dry, drop the ball down the tube. It should
slide down fairly easily. Put a small wad of tissue paper in the tube,
and pack it gently against the ball with a pencil. When ready to use, put
the candle in a hole in the ground, pointed in a safe direction, light
the fuse, and run. If the device works, a colored fireball should shoot
out of the tube to a height of about 30 feet. This height can be increased
by adding a slightly larger powder charge in step 4, or by using a slightly
longer tube. If the ball does not ignite, add slightly more pyrodex in
step 5. The balls made for roman candles also function very well in rockets,
producing an effect of falling colored fireballs.
214. Suppliers
II by Exodus
Most, if not all, of the information
in this publication can be obtained through a public or university library.
There are also many publications that are put out by people who want to
make money by telling other people how to make explosives at home. Adds
for such appear frequently in paramilitary magazines and newspapers. This
list is presented to show the large number of places that information and
materials can be purchased from. It also includes fireworks companies and
the like. COMPANY NAME AND ADDRESSWHAT COMPANY SELLSFULL AUTO CO. INC.EXPLOSIVE
RECIPESPO BOX 1881PAPER TUBINGMURFREESBORO, TN 37133 UNLIMITEDCHEMICALS
AND FUSEPO BOX 1378-SN HERMISTON, OR 97838 AMERICAN FIREWORKS
NEWSFIREWORKS NEWS MAGAZINE WITHSR BOX 30SOURCES AND TECHNIQUESDINGMAN'S
FERRY, PA 18328 BARNETT INTERNATIONAL INC.BOWS, CROSSBOWS, ARCHERY
MATERIALS,125 RUNNELS STREETAIR RIFLESPO BOX 226 PORT HURON, MI
48060 CROSSMAN AIR GUNSAIR GUNSPO BOX 22927 ROCHESTER, NY 14692
R. ALLENPROFESSIONAL FIREWORKS CONSTRUCTIONPO BOX 146BOOKS &
FORMULASWILLOW GROVE, PA 19090 MJ DISTRIBUTINGFIREWORKS FORMULASPO
BOX 10585 YAKIMA, WA 98909 EXECUTIVE PROTECTION PRODUCTS INCTEAR
GAS GRENADES,316 CALIFORNIA AVEPROTECTION DEVICESRENO, NV 89509 BADGER
FIREWORKS CO. INCCLASS "B" AND "C" FIREWORKS PO BOX 1451 JANESVILLE,
WI 53547 NEW ENGLAND FIREWORKS CO INCCLASS "C" FIREWORKS PO BOX
3504 STAMFORD, CT 06095 RAINBOW TRAILCLASS "C" FIREWORKS PO
BOX 581 EDGEMONT, PA 19028 STONINGTON FIREWORKS INCCLASS "C"
AND "B" FIREWORKS 4010 NEW WILSEY BAY U.25 ROAD RAPID RIVER, MI 49878
WINDY CITY FIREWORKS INCCLASS "C" AND "B" FIREWORKSPO BOX 11(GOOD
PRICES!)ROCHESTER, IN 46975 BOOKS THE ANARCHIST COOKBOOK(highly
circulated)THE IMPROVISED MUNITIONS MANUAL(formulas work, but put maker
at risk) MILITARY EXPLOSIVES Two manuals of interest: Duponts "Blaster's
Handbook", $20 manual mainly useful for rock and seismographic operations.
Atlas's "Powder Manual" or "Manual of Rock Blasting" (I forget the title,
it's in the office). This is a $60 book, well worth the cash, dealing with
the above two topics, plus demolitions, and non-quarry blasting.
215.Checklist
for Raids on Labs by Exodus
In the end, the serious terrorist would
probably realize that if he/she wishes to make a truly useful explosive,
he or she will have to steal the chemicals to make the explosive from a
lab. A list of such chemicals in order of priority would probably resemble
the following: LIQUIDS SOLIDS ____ Nitric Acid ____ Potassium Perchlorate
____ Sulfuric Acid ____ Potassium Chlorate ____ 95% Ethanol ____ Picric
Acid (usually a powder) ____ Toluene ____ Ammonium Nitrate ____ Perchloric
Acid ____ Powdered Magnesium ____ Hydrochloric Acid ____ Powdered Aluminum
____ Potassium Permanganate GASES ____ Sulfur (flowers of) ____ Hydrogen
____ Mercury ____ Oxygen ____ Potassium Nitrate ____ Chlorine ____ Potassium
Hydroxide ____ Carbon Dioxide ____ Phosphorus ____ Sodium Azide ____ Lead
Acetate ____ Barium Nitrate Print this sheet out and carry it with you!
Memorize it, anything. It is INVALUABLE. All of these chemicals should
be carried in your school lab. Happy hunting. :)
216.Misc Anarchy
by Exodus
Tennis ball cannons and other information
from the Usenet. The Usenet is a worldwide network of 15,000 machines and
over 500,000 people- And growing! At this time (twelve years ago) most
soft drink cans were rolled tin rather than the molded aluminum. We would
cut the tops and bottoms off of a bunch of them and tape them together
with duct tape, forming a tube of two feet or more. At the end we would
tape a can with the bottom intact, more holes punched (with a can opener)
around the top, and a small hole in the side at the base. We then fastened
this contraption to a tripod so we could aim it reliably. Any object that
came somewhat close to filling the tube was then placed therein. In the
shop, we used the clock as a target and an empty plastic solder spool as
ammunition, with tape over the ends of the center hole and sometimes filled
with washers for weight. When taken to parties or picnics, we would use
whatever was handy. Hot dog rolls or napkins filled with potato chips provided
spectacular entertainment. Once loaded, a small amount of lighter fluid
was poured into the hole in the side of the end can and allowed to vaporize
for a few moments. The "fire control technician" would announce "Fire in
the Hole" and ignite it. BOOM! Whoosh! The clock never worked after that!
Our version of the potato chip cannon, originally designed around the Pringles
potato chip can, was built similarly. Ours used coke cans, six with the
top and bottom removed, and the seventh had Bottle opener holes all around
one end, the top of this can was covered with a grid or piece of wire screening
to keep the tennis ball from falling all the way to the bottom. This was
spiral wrapped with at least two rolls of duct tape. A wooden shoulder
rest and forward hand grip was taped to the tube. For ignition we used
lantern batteries to a model-t coil, actuated by a push button on the hand
grip. A fresh wilson tennis ball was stuffed all the way back to the grid,
and a drop or two of lighter fluid was dropped in one of two holes in the
end. The ignition wire was poked through the other hole. We would then
lie in ambush, waiting for something to move. When fired with the proper
air/fuel mixture, a satisfying thoomp! At maximum range the ball would
travel about 100 yards with a 45ø launch angle. Closer up the ball
would leave a welt on an warring opponent. When launched at a moving car
the thud as it hit the door would generally rattle anyone inside. Luckily
we never completed the one that shot golf balls. More Fun Stuff for Terrorists
Carbide Bomb This is EXTREMELY DANGEROUS. Exercise extreme caution....
Obtain some calcium carbide. This is the stuff that is used in carbide
lamps and can be found at nearly any hardware store. Take a few pieces
of this stuff (it looks like gravel) and put it in a glass jar with some
water. Put a lid on tightly. The carbide will react with the water to produce
acetylene carbonate which is similar to the gas used in cutting torches.
Eventually the glass with explode from internal pressure. If you leave
a burning rag nearby, you will get a nice fireball! Auto Exhaust Flame
Thrower For this one, all you need is a car, a sparkplug, ignition wire
and a switch. Install the spark plug into the last four or five inches
of the tailpipe by drilling a hole that the plug can screw into easily.
Attach the wire (this is regular insulated wire) to one side of the switch
and to the spark plug. The other side of the switch is attached to the
positive terminal on the battery. With the car running, simply hit the
switch and watch the flames fly!!! Again be careful that no one is behind
you! I have seen some of these flames go 20 feet!! Balloons Balloons are
fun to play with in chem lab, fill them with the gas that you get out of
the taps on the lab desks, then tie up the balloon tight, and drop it out
the window to the burnouts below, you know, the ones that are always smoking,
they love to pop balloons with lit cigarette.... get the picture? Good.
217.Combo Locks
II by Exodus
First of all, let me tell you about
the set-up of a lock. When the lock is locked, there is a curved piece
of metal wedged inside the little notch on the horseshoe shaped bar (known
as the shackle) that is pushed in to the lock when you lock it. To free
this wedge, you usually have to turn the lock to the desired combination
and the pressure on the wedge is released therefore letting the lock open.
I will now tell you how to make a pick so you can open a lock without having
to waste all that time turning the combination (this also helps when you
don't know the combination to begin with). To bypass this hassle, simply
take a thinned hairpin (file it down) or a opened out piece of a collapsing
antenna (the inside diameter of the curved piece of metal should be the
same as the diameter of the shackle- if the metal is too thick, use fine
sandpaper to thin it down. Once you have your hair pin (make sure it's
metal), take the ridged side and break it off right before it starts to
make a U-turn onto the straight side. The curved part can now be used as
a handle. Now, using a file, file down the other end until it is fairly
thin. You should do this to many hairpins and file them so they are of
different thicknesses so you can jimmy various locks. Look at a lock to
see which side the lock opens from. If you can't tell, you will just have
to try both sides. When ya find out what side it opens from, take the lock
pick and stick the filed end into the inside of the horseshoe-shaped bar
on whichever side the lock opens from. Now, put pressure on the handle
of the lock pick (pushing down, into the crack) and pull the lock up and
down. The lock will then open because the pick separated the wedge and
the notch allowing it to open. Also, this technique works best on American
locks. I have never picked a Master lock before because of the shape a
pressure of the wedge but if anyone does it, let me know how long it took.
Also, the Master lock casing is very tight so ya can't get the shim in.
218.Misc Anarchy
II by Ragner Rocker
Many of you out there probably have
fantasies of revenge against teachers, principals and other people who
are just assholes. Depending on your level of hatred of this person I would
advise that you do some of these following experiments: Pouring dishsoap
into the gas tank of your enemy - many of you already know that gasoline
+ dishsoap (e.g. joy, palmolive, etc.) form a mixture called napalm. Now
napalm is a jelly-like substance used in bombs, flame-throwers, etc. Now
you can only guess what this mixture would do to someone's fuel line!!!!
Spreading dirty motor oil/castor oil on someone's exhaust pipe - when the
exhaust pipe heats up (and it will!!) the motor oil or castor oil on the
pipe will cause thick, disgusting smoke to ooze forth from the back of
that car. Who knows maybe he/she might be pulled over and given a ticket!!
Light Bulb Bomb Simple smoke/stink bomb - you can purchase sulfur at a
drugstore under the name flowers of sulfur. Now when sulfur burns it will
give off a very strong odor and plenty of smoke. Now all you need is a
fuse from a firecracker, a tin can, and the sulfur. Fill the can with sulfur
(pack very lightly), put aluminum foil over the top of the can, poke a
small hole into the foil, insert the wick, and light it and get out of
the room if you value your lungs. You can find many uses for this or at
least I hope so. FUN WITH ALARMS A fact I forgot to mention in my previous
alarm articles is that one can also use polyurethane foam in a can to silence
horns and bells. You can purchase this at any hardware store as insulation.
It is easy to handle and dries faster. Many people that travel carry a
pocket alarm with them. This alarm is a small device that is hung around
the door knob, and when someone touches the knob his body capacitance sets
off the alarm. These nasty nuisances can be found by walking down the halls
of a hotel and touching all the door knobs very quickly. if you happen
to chance upon one, attach a 3' length of wire or other metal object to
the knob. This will cause the sleeping business pig inside to think someone
is breaking in and call room service for help. All sorts of fun and games
will ensue. Some high-security installations use keypads just like touch-tone
pads (a registered trade mark of bell systems) to open locks or disarm
alarms. Most use three or four digits. To figure out the code, wipe the
key-pad free from all fingerprints by using a rag soaked in rubbing alcohol.
After the keypad has been used just apply finger print dust and all four
digits will be marked. now all you have to do is figure out the order.
If you want to have some fun with a keypad, try pressing the * and # at
the same time. Many units use this as a panic button. This will bring the
owner and the cops running and ever-one will have a good time. Never try
to remove these panels from the wall, as they have built-in tamper switches.
On the subject of holdups, most places (including supermarkets, liquor
stores, etc.) have what is known as a money clip. These little nasties
are placed at the bottom of a money drawer and when the last few bills
are with-drawn a switch closes and sets the alarm off. That's why when
you make your withdrawal it's best to help yourself so you can check for
these little nasties. If you find them, merely insert ones underneath the
pile of twenties, and then pull out the twenties, leaving the one-dollar
bill behind to prevent the circuit from closing. SOFT DRINK CAN BOMB AN
ARTICLE FROM THE BOOK: THE POOR MAN'S JAMES BOND BY KURT SAXON This is
an anti-personnel bomb meant for milling crowds. The bottom of a soft drink
can is half cut out and bent back. A giant firecracker or other explosive
is put in and surrounded with nuts and bolts or rocks. The fuse is then
armed with a chemical delay in a plastic drinking straw. After first making
sure there are no children nearby, the acid or glycerine is put into the
straw and the can is set down by a tree or wall where it will not be knocked
over. The delay should give you three to five minutes. It will then have
a shattering effect on passersby. It is hardly likely that anyone would
pick up and drink from someone else's soft drink can. but if such a crude
person should try to drink from your bomb he would break a nasty habit
fast! ! ! ! ! ! ! <-CHEMICAL INGITER ---- ---- ! !1! ! ! ===== ! !*
! ! "! ! ! ! ! ! ! ! !<- BIG FIRECRACKER ! ! !% ! ! ==== ! ! ! ! # !
! --- ! ! ! ! <- NUTS & BOLTS ! / ! ! ! --------- Pyro Book II by
Capt Hack and Grey Wolf TIME DELAYED CHEMICAL FUSE Put 1 teaspoon full
of potassium permanganate in a tin can. Add a few drops of glycerine. Wait
3-4 min. Get the hell out. The stuff will smoke, then burst into flames.
Potassium permanganate stains like iodine but worse [it's purple]. The
reaction will spatter a bit so it can be messy and it doesn't matter if
the amounts are uneven [i.e. 1 part to 3 parts] EXPLOSIVES AND INCENDIARIES
by THE RESEARCHER INTRODUCTION: The trouble with text books on chemistry
and explosives is the attitude with which they are written. They don't
say, "Now I know you would like to blow holy hell out of something just
for the fun of it so here is how to whip up something in your kitchen to
do it". They tell you how Dupont does it or how the ancient Chinese did
it but not how you can do it with the resources and materials available
to you. Even army manuals on field expedient explosives are almost useless
because they are just outlines written with the understanding that an instructor
is going to fill in the blanks. It is a fun game to search out the materials
that can be put together to make something go "boom". You can find what
you need in grocery stores, hardware stores, and farm supplies. An interesting
point to remember is that it is much easier to make a big e explosion than
a small one. It is very difficult for a home experimenter to make a firecracker,
but a bomb capable of blowing the walls out of a building is easy. HOW
TO MAKE ROCKET FUEL This is easy to make and fun to play with. Mix equal
parts by volume Potassium or Sodium Nitrate and granulated sugar. Pour
a big spoonful of this into a pile. Stick a piece of blackmatch fuse into
it; light; and step back. This is also a very hot incendiary. A little
imagination will suggest a lot of experiments for this. ANOTHER ROCKET
FUEL Mix equal parts by volume of zinc dust and sulfur. Watch out if you
experiment with this. It goes off in a sudden flash. It is not a powerful
explosive, but is violent stuff even when not confined because of its fast
burning rate. As I continue from this point some of the ingredients are
going to be harder to get without going through a chemical supply. I try
to avoid this. I happen to know that B. Prieser Scientific (local to my
area) has been instructed by the police to send them the names of anyone
buying chemicals in certain combinations. For example, if a person were
to buy Sulfuric acid, Nitric acid and Toluene (the makings for TNT) in
one order the police would be notified. I will do the best I can to tell
you how to make the things you need from commonly available materials,
but I don't want to leave out something really good because you might have
to scrounge for an ingredient. I am guessing you would prefer it that way.
HOW TO MAKE AN EXPLOSIVE FROM COMMON MATCHES Pinch the head near the bottom
with a pair of wire cutters to break it up; then use the edges of the cutters
to scrape off the loose material. It gets easy with practice. You can do
this while watching TV and collect enough for a bomb without dying of boredom.
Once you have a good batch of it, you can load it into a pipe instead of
black powder. Be careful not to get any in the threads, and wipe off any
that gets on the end of the pipe. Never try to use this stuff for rocket
fuel. A science teacher was killed that way. Just for fun while I'm on
the subject of matches, did you know that you can strike a safety match
on a window pane? Hold a paper match between your thumb and first finger.
With your second finger, press the head firmly against a large window.
Very quickly, rub the match down the pane about 2 feet while maintaining
the pressure. The friction will generate enough heat to light the match.
Another fun trick is the match rocket. Tightly wrap the top half of a paper
match with foil. Set it in the top of a pop bottle at a 45 ø angle.
Hold a lighted match under the head until it ignites. If you got it right,
the match will zip up and hit the ceiling. I just remembered the match
guns I used to make when I was a kid. These are made from a bicycle spoke.
At one end of the spoke is a piece that screws off. Take it off and screw
it on backwards. You now have a piece of stiff wire with a small hollow
tube on one end. Pack the material from a couple of wooden safety matches
into the tube. Force the stem of a match into the hole. It should fit very
tightly. Hold a lighted match under the tube until it gets hot enough to
ignite the powder. It goes off with a bang. HOW TO MAKE CONCENTRATED SULFURIC
ACID FROM BATTERY ACID Go to an auto supply store and ask for "a small
battery acid". This should only cost a few dollars. What you will get is
about a gallon of dilute sulfuric acid. Put a pint of this into a heat
resistant glass container. The glass pitchers used for making coffee are
perfect. Do not use a metal container. Use an extension cord to set up
a hotplate out doors. Boil the acid until white fumes appear. As soon as
you see the white fumes, turn off the hot plate and let the acid cool.
Pour the now concentrated acid into a glass container. The container must
have a glass stopper or plastic cap -- no metal. It must be air tight.
Otherwise, the acid will quickly absorb moisture from the air and become
diluted. Want to know how to make a time bomb that doesn't tick and has
no wires or batteries? Hold on to your acid and follow me into the next
installment. HOW TO MAKE A CHEMICAL TIME DELAY FUSE: To get an understanding
of how this is going to work, mix up equal parts by volume Potassium chlorate
and granulated sugar. Pour a spoonful of the mixture in a small pile and
make a depression in the top with the end of a spoon. Using a medicine
dropper, place one drop of concentrated sulfuric acid in the depression
and step back. It will snap and crackle a few times and then burst into
vigorous flames. To make the fuse, cut about 2 inches off a plastic drinking
straw. Tamp a small piece of cotton in one end. On top of this put about
an inch of the clorate/sugar mixture. Now lightly tamp in about a quarter
inch of either glass wool or asbestos fibers. Secure this with the open
end up and drop in 3 or 4 drops of sulfuric acid. After a few minutes the
acid will soak through the fibers and ignite the mixture. The time delay
can be controlled by the amount of fiber used and by varying how tightly
it is packed. Don't use cotton for this. The acid will react with cotton
and become weakened in the process. By punching a hole in the side of the
straw, a piece of blackmatch or other fuse can be inserted and used to
set off the device of your choice. Potassium chlorate was very popular
with the radical underground. It can be used to make a wide variety of
explosives and incendiaries, some of them extremely dangerous to handle.
The radicals lost several people that way. But, don't worry. I am not going
to try to protect you from yourself. I have decided to tell all. I will
have more to say about Potassium chlorate, but for now, let's look at a
couple of interesting electric fuses. PEROXYACETONE PEROXYACETONE IS EXTREMELY
FLAMMABLE AND HAS BEEN REPORTED TO BE SHOCK SENSITIVE MATERIALS: 4 mL Acetone
4 mL 30% Hydrogen Peroxide 4 drops Conc. Hydrochloric Acid 150 mm Test
Tube Add 4 mL acetone and 4 mL hydrogen peroxide to the test tube. Then
add 4 drops concentrated hydrochloric acid. In 10-20 minutes a white solid
should begin to appear. If no change is observed, warm the test tube in
a water bath at 40øC. Allow the reaction to continue for two hours.
Swirl the slurry and filter it. Leave out on filter paper to dry for at
least two hours. To ignite, light a candle tied to a meter stick and light
it (while staying at least a meter away). I would like to give credit to
a book by shakashari entitled "Chemical demonstrations" for a few of the
precise amounts of chemicals in some experiments. THE CHEMIST'S CORNER
#2: HOUSEHOLD CHEMICALS, BY ZAPHOD BEEBLEBROX/MPG This article deals with
instructions on how to do some interesting experiments with common household
chemicals. Some may or may not work depending on the concentration of certain
chemicals in different areas and brands. I would suggest that the person
doing these experiments have some knowledge of chemistry, especially for
the more dangerous experiments. I am not responsible for any injury or
damage caused by people using this information. It is provided for use
by people knowledgeable in chemistry who are interested in such experiments
and can safely handle such experiments. I. A LIST OF HOUSEHOLD CHEMICALS
AND THEIR COMPOSITION VINEGAR: 3-5% ACETIC ACID BAKING SODA: SODIUM BICARBONATE
DRAIN CLEANERS: SODIUM HYDROXIDE SANI-FLUSH: 75% SODIUM BISULFATE AMMONIA
WATER: AMMONIUM HYDROXIDE CITRUS FRUIT: CITRIC ACID TABLE SALT: SODIUM
CHLORIDE SUGAR: SUCROSE MILK OF MAGNESIA: MAGNESIUM HYDROXIDE TINCTURE
OF IODINE: 4% IODINE RUBBING ALCOHOL: 70% OR 99% (DEPENDS ON BRAND) ISOPROPYL
ALCOHOL (DO NOT DRINK!) GENERATING CHLORINE GAS This is slightly more dangerous
than the other two experiments, so you should know what you're doing before
you try this... Ever wonder why ammonia bottles always say 'do not mix
with chlorine bleach', and visa-versa? That's because if you mix ammonia
water with Ajax or something like it, it will give off chlorine gas. To
capture it, get a large bottle and put Ajax in the bottom. Then pour some
ammonia down into the bottle. Since the chlorine is heavier than air, it
will stay down in there unless you use large amounts of either Ajax or
ammonia (don't!). CHLORINE + TURPENTINE Take a small cloth or rag and soak
it in turpentine. Quickly drop it into the bottle of chlorine. It should
give off a lot of black smoke and probably start burning... GENERATING
HYDROGEN GAS To generate hydrogen, all you need is an acid and a metal
that will react with that acid. Try vinegar (acetic acid) with zinc, aluminum,
magnesium, etc. You can collect hydrogen in something if you note that
it is lighter than air.... light a small amount and it burns with a small
*pop*. Another way of creating hydrogen is by the electrolysis of water.
This involve separating water (H2O) into hydrogen and oxygen by an electric
current. To do this, you need a 6-12 volt battery (or a DC transformer),
two test tubes, a large bowl, two carbon electrodes (take them out of an
unworking 6-12 volt battery), and table salt. Dissolve the salt in a large
bowl full of water. Submerge the two test tubes in the water and put the
electrodes inside them, with the mouth of the tube aiming down. Connect
the battery to some wire going down to the electrodes. This will work for
a while, but chlorine will be generated along with the oxygen which will
corrode your copper wires leading to the carbon electrodes... (the table
salt is broken up into chlorine and sodium ions, the chlorine comes off
as a gas with oxygen while sodium reacts with the water to form sodium
hydroxide....). therefore, if you can get your hands on some sulfuric acid,
use it instead. it will not affect the reaction other than making the water
conduct electricity. WARNING: DO NOT use a transformer that outputs AC
current! Not only is AC inherently more dangerous than DC, it also produces
both Hydrogen and Oxygen at each electrode. HYDROGEN + CHLORINE Take the
test tube of hydrogen and cover the mouth with your thumb. Keep it inverted,
and bring it near the bottle of chlorine (not one that has reacted with
turpentine). Say "good-bye test tube", and drop it into the bottle. The
hydrogen and chlorine should react and possibly explode (depending on purity
and amount of each gas). An interesting thing about this is they will not
react if it is dark and no heat or other energy is around. When a light
is turned on, enough energy is present to cause them to react... PREPARATION
OF OXYGEN Get some hydrogen peroxide (from a drug store) and manganese
dioxide (from a battery- it's a black powder). Mix the two in a bottle,
and they give off oxygen. If the bottle is stoppered, pressure will build
up and shoot it off. Try lighting a wood splint and sticking it (when only
glowing) into the bottle. The oxygen will make it burst into flame. The
oxygen will allow things to burn better... IODINE Tincture of iodine contains
mainly alcohol and a little iodine. To separate them, put the tincture
of iodine in a metal lid to a bottle and heat it over a candle. Have a
stand holding another metal lid directly over the tincture (about 4-6 inches
above it) with ice on top of it. The alcohol should evaporate, and the
iodine should sublime, but should reform iodine crystals on the cold metal
lid directly above. If this works (I haven't tried), you can use the iodine
along with household ammonia to form nitrogen triiodide. I have found that
Pool Chlorine tablets with strong household ammonia react to produce LOTS
of chlorine gas and heat... also mixing the tablets with rubbing alcohol
produces heat, a different (and highly flammable) gas, and possibly some
sort of acid (it eats away at just about anything it touches) TRIPWIRES
by The Mortician Well first of all I recommend that you read the file on
my board about landmines... If you can't then here is the concept. You
can use an m-80,h-100, blockbuster or any other type of explosive that
will light with a fuse. Now the way this works is if you have a 9 volt
battery, get either a solar igniter (preferably) or some steel wool you
can create a remote ignition system. What you do it set up a schematic
like this. ------------------>+ battery steel || ->- battery wool || /
:==:--- <--fuse \ || / ---- spst switch--\ So when the switch is on
the currnet will flow through the steel wool or igniter and heat up causing
the fuse to light. Note: For use with steel wool try it first and get a
really thin piece of wire and pump the current through it to make sure
it will heat up to light the explosive. Now the thing to do is plant your
explosive wherever you want it to be, bury it and cover the wires. Now
take a fishing line (about 20 lb. test) and tie one end to a secure object.
Have your switch secured to something and make a loop on the other end
on the line. Put the loop around the switch such that when pulled it will
pull the switch and set off the explosive. To ignite the explosive... The
thing to do is to experiment with this and find your best method... Let
me know on any good kills, or new techniques... On my board... (201)376-4462
BOOBY TRAP TRIP WIRES BY Vlad Tepes (of Chicago C64 fame) Here is a method
for constructing boobytraps which I personally invented, and which I have
found to work better than any other type of release booby trap. There are
many possible variations on this design, but the basic premise remains
the same. What you'll need: 3-4 nails each 2 inches long and soft enough
to bend easily (galvanized iron works well) 6 feet of wire or fishing line
5-15 feet of strong string or rope 1 really sick mind. Hammer two of the
nails into the trunk of a tree (about one inch apart) so they form a horizontal
line. They should be angled slightly upward, about 30ø. Bend each
nail Downward about one inch out from the trunk. Take your nefarious device
(say a small rock suspended in a tree) and rig a rope or string so the
line comes DOWN towards the two nails. Tie a loop in the string so the
loop *just* reaches between the two nails, and pass a third nail between
the two nails with the loop around this nail b detonate at 7600-7800
m/sec.. These two explosives are very powerful and should be sensitive
to a #6 blasting cap or equivalent. These explosives are dangerous and
should not be made unless the manufacturer has had experience with this
type compound. The foolish and ignorant may as well forget these explosives
as they won't live to get to use them. Don't get me wrong, these explosives
have been manufactured for years with an amazing record of safety. Millions
of tons of nitroglycerine have been made and used to manufacture dynamite
and explosives of this nature with very few mishaps. Nitroglycerin and
nitroglycol will kill and their main victims are the stupid and foolhardy.
Before manufacturing these explosives take a drop of nitroglycerin and
soak into a small piece of filter paper and place it on an anvil. Hit this
drop with a hammer and don't put any more on the anvil. See what I mean!
This explosive compound is not to be taken lightly. If there are any doubts
DON'T. Improvised Explosives Plastique Explosive from Aspirin This explosive
is a phenol derivative. It is HIGHLY toxic and explosive compounds made
from picric acid are poisonous if inhaled, ingested, or handled and absorbed
through the skin. The toxicity of this explosive restricts its use due
to the fact that over exposure in most cases causes liver and kidney failure
and sometimes death if immediate treatment is not obtained. This explosive
is a cousin to TNT but is more powerful than it's cousin. It is the first
explosive used militarily and was adopted in 1888 as an artillery shell
filler. Originally this explosive was derived from coal tar but thanks
to modern chemistry you can make this explosive easily in approximately
three hours from acetylsalicylic acid (aspirin purified). This procedure
involves dissolving the acetylsalicylic acid in warm sulfuric acid and
adding sodium or potassium nitrate which nitrates the purified aspirin
and the whole mixture drowned in water and filtered to obtain the final
product. This explosive is called trinitrophenol. Care should be taken
to ensure that this explosive is stored in glass containers. Picric acid
will form dangerous salts when allowed to contact all metals except tin
and aluminum. These salts are primary explosive and are super sensitive.
They also will cause the detonation of the picric acid. To make picric
acid obtain some aspirin. The cheaper brands work best but buffered brands
should be avoided. Powder these tablets to a fine consistency. To extract
the acetylsalicylic acid from this powder place this powder in methyl alcohol
and stir vigorously. Not all of the powder will dissolve. Filter this powder
out of the alcohol. Again wash this powder that was filtered out of the
alcohol with more alcohol but with a lesser amount than the first extraction.
Again filter the remaining powder out of the alcohol. Combine the now clear
alcohol and allow it to evaporate in a pyrex dish. When the alcohol has
evaporated there will be a surprising amount of crystals in the bottom
of the pyrex dish. Take forty grams of these purified acetylsalicylic acid
crystals and dissolve them in 150 mL of sulfuric acid (98%, specify gravity
1.8) and heat to dissolve all the crystals. This heating can be done in
a common electric frying pan with the thermostat set on 150øF and
filled with a good cooking oil. When all the crystals have dissolved in
the sulfuric acid take the beaker, that you've done all this dissolving
in (600 mL), out of the oil bath. This next step will need to be done with
a very good ventilation system (it is a good idea to do any chemistry work
such as the whole procedure and any procedure on this disk with good ventilation
or outside). Slowly start adding 58 g of sodium nitrate or 77 g of potassium
nitrate to the acid mixture in the beaker very slowly in small portions
with vigorous stirring. A red gas (nitrogen trioxide) will be formed and
this should be avoided. The mixture is likely to foam up and the addition
should be stopped until the foaming goes down to prevent the overflow of
the acid mixture in the beaker. When the sodium or potassium nitrate has
been added the mixture is allowed to cool somewhat (30-40øC). The
solution should then be dumped slowly into twice it's volume of crushed
ice and water. The brilliant yellow crystals will form in the water. These
should be filtered out and placed in 200 mL of boiling distilled water.
This water is allowed to cool and then the crystals are then filtered out
of the water. These crystals are a very, very pure trinitrophenol. These
crystals are then placed in a pyrex dish and places in an oil bath and
heated to 80øC and held there for 2 hours. This temperature is best
maintained and checked with a thermometer. The crystals are then powdered
in small quantities to a face powder consistency. These powdered crystals
are then mixed with 10% by weight wax and 5% vaseline which are heated
to melting temperature and poured into the crystals. The mixing is best
done by kneading together with gloved hands. This explosive should have
a useful plasticity range of 0-40øC. The detonation velocity should
be around 7000 m/sec.. It is toxic to handle but simply made from common
ingredients and is suitable for most demolition work requiring a moderately
high detonation velocity. It is very suitable for shaped charges and some
steel cutting charges. It is not as good an explosive as C-4 or other RDX
based explosives but it is much easier to make. Again this explosive is
very toxic and should be treated with great care. AVOID HANDLING BARE-HANDED,
BREATHING DUST AND FUMES, AVOID ANY CHANCE OF INGESTION. AFTER UTENSILS
ARE USED FOR THE MANUFACTURE OF THIS EXPLOSIVE RETIRE THEM FROM THE KITCHEN
AS THE CHANCE OF POISONING IS NOT WORTH THE RISK. THIS EXPLOSIVE, IF MANUFACTURED
AS ABOVE, SHOULD BE SAFE IN STORAGE BUT WITH ANY HOMEMADE EXPLOSIVE STORAGE
OS NOT RECOMMENDED AND EXPLOSIVES SHOULD BE MADE UP AS NEEDED. Improvised
Explosives Plastique Explosive from Bleach This explosive is a potassium
chlorate explosive. This explosive and explosives of similar composition
were used in World War II as the main explosive filler in grenades, land
mines, and mortar used by French, German, and other forces involved in
that conflict. These explosives are relatively safe to manufacture. One
should strive to make sure these explosives are free of sulfur, sulfides,
and picric acid. The presence of these compounds result in mixtures that
are or can become highly sensitive and possibly decompose explosively while
in storage. The manufacture of this explosive from bleach is given as just
an expedient method. This method of manufacturing potassium chlorate is
not economical due to the amount of energy used to boil the solution and
cause the 'dissociation' reaction to take place. This procedure does work
and yields a relatively pure and a sulfur/sulfide free product. These explosives
are very cap sensitive and require only a #3 cap for instigating detonation.
To manufacture potassium chlorate from bleach (5¬% sodium hypochlorite
solution) obtain a heat source (hot plate etc.) a battery hydrometer, a
large pyrex or enameled steel container (to weigh chemicals), and some
potassium chloride (sold as salt substitute). Take one gallon of bleach,
place it in the container and begin heating it. While this solution heats,
weigh out 63 g potassium chloride and add this to the bleach being heated.
Bring this solution to a boil and boiled until when checked by a hydrometer
the reading is 1.3 (if a battery hydrometer is used it should read full
charge). When the reading is 1.3 take the solution and let it cool in the
refrigerator until it's between room temperature and 0øC. Filter
out the crystals that have formed and save them. Boil the solution again
until it reads 1.3 on the hydrometer and again cool the solution. Filter
out the crystals that have formed and save them. Boil this solution again
and cool as before. Filter and save the crystals. Take these crystals that
have been saved and mix them with distilled water in the following proportions:
56g per 100 mL distilled water. Heat this solution until it boils and allow
it to cool. Filter the solution and save the crystals that form upon cooling.
The process if purification is called fractional crystallization. These
crystals should be relatively pure potassium chlorate. Powder these to
the consistency of face powder (400 mesh) and heat gently to drive off
all moisture. Melt five parts vaseline and five parts wax. Dissolve this
in white gasoline (camp stove gasoline) and pour this liquid on 90 parts
potassium chlorate (the crystals from the above operation) in a plastic
bowl. Knead this liquid into the potassium chlorate until immediately mixed.
Allow all the gasoline to evaporate. Place this explosive in a cool, dry
place. Avoid friction, sulfur, sulfide, and phosphorous compounds. This
explosive is best molded to the desired shape and density (1.3g/cc) and
dipped in wax to water proof. These block type charges guarantee the highest
detonation velocity. This explosive is really not suited to use in shaped
charge applications due to its relatively low detonation velocity. It is
comparable to 40% ammonia dynamite and can be considered the same for the
sake of charge computation. If the potassium chlorate is bought and not
made it is put into the manufacture process in the powdering stages preceding
the addition of the wax/vaseline mixture. This explosive is bristant and
powerful. The addition of 2-3% aluminum powder increases its blast effect.
Detonation velocity is 3300 m/sec. Plastique Explosives From Swimming Pool
Chlorinating Compound This explosive is a chlorate explosive from bleach.
This method of production of potassium or sodium chlorate is easier and
yields a more pure product than does the plastique explosive from bleach
process. In this reaction the HTH (calcium hypochlorite CaC10) is mixed
with water and heated with either sodium chloride (table salt, rock salt)
or potassium chloride (salt substitute). The latter of these salts is the
salt of choice due to the easy crystallization of the potassium chlorate.
This mixture will need to be boiled to ensure complete reaction of the
ingredients. Obtain some HTH swimming pool chlorination compound or equivalent
(usually 65% calcium hypochlorite). As with the bleach process mentioned
earlier the reaction described below is also a dissociation reaction. In
a large pyrex glass or enameled steel container place 1200g HTH and 220g
potassium chloride or 159g sodium chloride. Add enough boiling water to
dissolve the powder and boil this solution. A chalky substance (calcium
chloride) will be formed. When the formation of this chalky substance is
no longer formed the solution is filtered while boiling hot. If potassium
chloride was used potassium chlorate will be formed. This potassium chlorate
will drop out or crystallize as the clear liquid left after filtering cools.
These crystals are filtered out when the solution reaches room temperature.
If the sodium chloride salt was used this clear filtrate (clear liquid
after filtration) will need to have all water evaporated. This will leave
crystals which should be saved. These crystals should be heated in a slightly
warm oven in a pyrex dish to drive off all traces of water (40-75øC).
These crystals are ground to a very fine powder (400 mesh). If the sodium
chloride salt is used in the initial step the crystallization is much more
time consuming. The potassium chloride is the salt to use as the resulting
product will crystallize out of the solution as it cools. The powdered
and completely dry chlorate crystals are kneaded together with vaseline
in a plastic bowl. ALL CHLORATE BASED EXPLOSIVES ARE SENSITIVE TO FRICTION
AND SHOCK AND THESE SHOULD BE AVOIDED. If sodium chloride is used in this
explosive it will have a tendency to cake and has a slightly lower detonation
velocity. This explosive is composed of the following: Potassium/Sodium
Chlorate 90% Vaseline 10% Simply pour the powder into a plastic baggy and
knead in the vaseline carefully. This explosive (especially if the Sodium
Chlorate variation is used) should not be exposed to water or moisture.
The detonation velocity can be raised to a slight extent by the addition
of 2-3% aluminum substituted for 2-3% of the vaseline. This addition of
this aluminum will give the explosive a bright flash if set off at night
which will ruin night vision for a short while. The detonation velocity
of this explosive is approximately 3200 m/sec for the potassium salt and
2900 m/sec for the sodium salt based explosive. It was claimed above that
this explosive degrades over time. I would assume that this occurs due
to the small amount of water present in the vaseline, and that a different
type of fuel would be better than the vaseline. ASSORTED NASTIES: Sweet-Oil
In this one you open there hood and pour some honey in their oil spout.
If you have time you might remover the oil plug first and drain some of
the oil out. I have tried this one but wasn't around to see the effects
but I am sure that I did some damage. Slow Air OK, sneak up the victims
car and poke a small hole somewhere in 2 of his/her tires. They only have
1 spare. Now if the hole is small but there then there tire will go flat
some where on the road. You could slice the tire so this is blows out on
the road with a razor blade. Cut a long and fairly deep (don't cut a hole
all the way through) and peel a little bit of the rubber back and cut that
off. Now very soon there tires will go flat or a possible blow out at a
high speed if your lucky. Vanishing Paint Spread a little gas or paint
thinner on the victims car and this will make his paint run and fade. Vodka
will eat the paint off and so will a little 190. Eggs work great on paint
if they sit there long enough. Loose Wheel Loosen the lugs on you victims
tires so that they will soon fall off. This can really fuck some one up
if they are cruising when the tire falls off. Dual Neutral This name sucks
but pull the 10 bolt or what ever they have there off. (On the real wheels,
in the middle of the axle) Now throw some screws, blots, nuts and assorted
things in there and replace the cover. At this point you could chip some
of the teeth off the gears. Un-Midaser Crawl under there car with a ratchet
and loosen all the nuts on their exhaust so that it hangs low and will
fall off soon. This method also works on transmissions but is a little
harder to get all bolts off, but the harder you work the more you fuck
them over. LAUGHING GAS Learn how to make laughing gas from ammonium nitrate.
Laughing gas was one of the earliest anesthetics. After a little while
of inhaling the gas the patient became so happy [ain't life great?] he
couldn't keep from laughing. Finally he would drift off to a pleasant sleep.
Some do-it-yourselfers have died while taking laughing gas. This is because
they has generated it through plastic bags while their heads were inside.
They were simply suffocating but were too bombed out to realize it. The
trick is to have a plastic clothes bag in which you generate a lot of the
gas. Then you stop generating the gas and hold a small opening of the bag
under your nose, getting plenty of oxygen in the meantime. Then, Whee!
To make it you start with ammonium nitrate bought from a chemical supply
house or which you have purified with 100% rubbing or wood alcohol. First,
dissolve a quantity of ammonium nitrate in some water. Then you evaporate
the water over the stove, while stirring, until you have a heavy brine.
When nearly all the moisture is out it should solidify instantly when a
drop is put on an ice cold metal plate. When ready, dump it all out on
a very cold surface. After a while, break it up and store it in a bottle.
A spoonful is put into a flask with a one-hole stopper, with a tube leading
into a big plastic bag. The flask is heated with an alcohol lamp. When
the temperature in the flask reaches 480 F the gas will generate. If white
fumes appear the heat should be lowered as the stuff explodes at 600 F.
When the bag is filled, stop the action and get ready to turn on. CAUTION:
NýO supplants oxygen in your blood, but you don't realize it. It's
easy to die from NýO because you're suffocating and your breathing
reflex doesn't know it. Do not put your head in a plastic bag. You will
cheerfully choke to death. PIPE OR "ZIP" GUNS Commonly known as "zip" guns,
guns made from pipe have been used for years by juvenile punks. Today's
Militants make them just for the hell of it or to shoot once in an assassination
or riot and throw away if there is any danger of apprehension. They can
be used many times but with some, a length of dowel is needed to force
out the spent shell. There are many variations but the illustration shows
the basic design. First, a wooden stock is made and a groove is cut for
the barrel to rest in. The barrel is then taped securely to the stock with
a good, strong tape. The trigger is made from galvanized tin. A slot is
punched in the trigger flap to hold a roofing nail, which is wired or soldered
onto the flap. The trigger is bent and nailed to the stock on both sides.
The pipe is a short length of one-quarter inch steel gas or water pipe
with a bore that fits in a cartridge, yet keeps the cartridge rim from
passing through the pipe. The cartridge is put in the pipe and the cap,
with a hole bored through it, is screwed on. Then the trigger is slowly
released to let the nail pass through the hole and rest on the primer.
To fire, the trigger is pulled back with the left hand and held back with
the thumb of the right hand. The gun is then aimed and the thumb releases
the trigger and the thing actually fires. Pipes of different lengths and
diameters are found in any hardware store. All caliber bullets, from the
.22 to the .45 are used in such guns. Some zip guns are made from two or
three pipes nested within each other. For instance, a .22 shell will fit
snugly into a length of a car's copper gas line. Unfortunately, the copper
is too weak to withstand the pressure of the firing. So the length of gas
line is spread with glue and pushed into a wider length of pipe. This is
spread with glue and pushed into a length of steel pipe with threads and
a cap. Using this method, you can accommodate any cartridge, even a rifle
shell. The first size of pipe for a rifle shell accommodates the bullet.
The second accommodates its wider powder chamber. A 12-gauge shotgun can
be made from a 3/4 inch steel pipe. If you want to comply with the gun
laws, the barrel should be at least eighteen inches long. Its firing mechanism
is the same as that for the pistol. It naturally has a longer stock and
its handle is lengthened into a rifle butt. Also, a small nail is driven
half way into each side of the stock about four inches in the front of
the trigger. The rubber band is put over one nail and brought around the
trigger and snagged over the other nail. In case you actually make a zip
gun, you should test it before firing it by hand. This is done by first
tying the gun to a tree or post, pointed to where it will do no damage.
Then a string is tied to the trigger and you go off several yards. The
string is then pulled back and let go. If the barrel does not blow up,
the gun is (probably) safe to fire by hand. Repeat firings may weaken the
barrel, so NO zip gun can be considered "safe" to use. Astrolite and Sodium
Chlorate Explosives By: Future Spy & The Fighting Falcon Note: Information
on the Astrolite Explosives were taken from the book 'Two Component High
Explosive Mixtures' By Desert Pub'l Some of the chemicals used are somewhat
toxic, but who gives a fuck! Go ahead! I won't even bother mentioning 'This
information is for enlightening purposes only'! I would love it if everyone
made a gallon of astrolite and blew their fucking school to kingdom scum!
Astrolite The astrolite family of liquid explosives were products of rocket
propellant research in the '60's. Astrolite A-1-5 is supposed to be the
world's most powerful non-nuclear explosive -at about 1.8 to 2 times more
powerful than TNT. Being more powerful it is also safer to handle than
TNT (not that it isn't safe in the first place) and Nitroglycerin. Astrolite
G "Astrolite G is a clear liquid explosive especially designed to produce
very high detonation velocity, 8,600MPS (meters/sec.), compared with 7,700MPS
for nitroglycerin and 6,900MPS for TNT...In addition, a very unusual characteristic
is that it the liquid explosive has the ability to be absorbed easily into
the ground while remaining detonatable...In field tests, Astrolite G has
remained detonatable for 4 days in the ground, even when the soil was soaked
due to rainy weather" know what that means?....Astrolite Dynamite! To make
(mix in fairly large container & outside) Two parts by weight of ammonium
nitrate mixed with one part by weight 'anhydrous' hydrazine, produces Astrolite
G...Simple enough eh? I'm sure that the 2:1 ratio is not perfect, and that
if you screw around with it long enough, that you'll find a better formula.
Also, dunno why the book says 'anhydrous' hydrazine, hydrazine is already
anhydrous... Hydrazine is the chemical you'll probably have the hardest
time getting hold of. Uses for Hydrazine are: Rocket fuel, agricultural
chemicals (maleic hydra-zide), drugs (antibacterial and antihypertension),
polymerization catalyst, plating metals on glass and plastics, solder fluxes,
photographic developers, diving equipment. Hydrazine is also the chemical
you should be careful with. Astrolite A/A-1-5 Mix 20% (weight) aluminum
powder to the ammonium nitrate, and then mix with hydrazine. The aluminum
powder should be 100 mesh or finer. Astrolite A has a detonation velocity
of 7,800MPS. Misc Info You should be careful not to get any of the astrolite
on you, if it happens though, you should flush the area with water. Astrolite
A&G both should be able to be detonated by a #8 blasting cap. Sodium
Chlorate Formulas Sodium Chlorate is similar to potassium chlorate, and
in most cases can be a substitute. Sodium chlorate is also more soluble
in water. You can find sodium chlorate at Channel or any hardware/home
improvement store. It is used in blowtorches and you can get about 3 lbs
for about $6.00. Sodium Chlorate Gunpowder 65% Sodium Chlorate 22% Charcoal
13% Sulfur Sprinkles of Graphite on top Rocket Fuel 6 parts Sodium Chlorate
5 parts Rubber Cement Mix *THOROUGHLY* Rocket Fuel II (Better Performance)
50% Sodium Chlorate 35% Rubber Cement ('One-Coat' brand) 10% Epoxy Resin
Hardener 5% Sulfur You may want to add more sodium chlorate depending on
the purity you are using. Incendiary Mixture 55% Aluminum Powder (Atomized)
45% Sodium Chlorate 5% Sulfur Impact Mixture 50% Red Phosphorus 50% Sodium
Chlorate Unlike potassium chlorate, sodium chlorate won't explode spontaneously
when mixed with phosphorus. It has to be hit to be detonated. Filler explosive
85% Sodium Chlorate 10% Vaseline 5% Aluminum Powder Nitromethane formulas
I thought that I might add this in since it's similar to Astrolite. Nitromethane
(CH3NOý) Specific Gravity: 1.139 Flash Point: 95øF Auto-Ignite:
785øF Derivation: Reaction of methane or propane with nitric acid
under pressure. Uses: Rocket fuel; solvent for cellulosic compounds, polymers,
waxes, fats, etc. To be detonated with a #8 cap, add: 95% nitromethane
+ 5% ethylenediamine 94% nitromethane + 6% aniline Power output: 22-24%
more powerful than TNT. Detonation velocity of 6,200MPS. Nitromethane 'solid'
explosives 2 parts nitromethane 5 parts ammonium nitrate (solid powder)
Soak for 3-5 min. When done, store in an air-tight container. This is supposed
to be 30% more powerful than dynamite containing 60% nitro-glycerin, and
has 30% more brilliance. MERCURY BATTERY BOMB! by Phucked Agent! Materials:
1 Mercury Battery (1« or 1.4 V Hearing Aid) 1 working lamp with on/off
switch It is VERY SIMPLE!!! Hurray! Kids under 18 shouldn't consider trying
this one or else they would have mercuric acid on their faces! Turn the
lamp switch on to see if lite-bulb lights up. If work, leave the switch
on and unplug the cord Unscrew the bulb (Don't touch the hot-spot!) Place
1 Mercury Battery in the socket and make sure that it is touching the Hot-spot
contact. Move any object or furniture - Why? There may be sparks given
off! Now your favorite part, stand back and plug in cord in the socket.
And you will have fun!! Like Real Party!!!
219.Thermite IV
by Kilroy
DISCLAIMER : The making and possession
of the following devices and mixtures is probably illegal in most communities.
The incendiaries are capable of burning in excess of 5400øF and
are next to impossible to extinguish. If you make them you accept all responsibility
for their possession and use. You also accept all responsibility for your
own stupidity and carelessness. This information is intended solely to
educate. All Formulas are by Weight Thermites are a group of pyrotechnics
mixtures in which a reactive metal reduces oxygen from a metallic oxide.
This produces a lot of heat, slag and pure metal. The most common thermite
is ferroaluminum thermite, made from aluminum (reactive metal) and iron
oxide (metal oxide). When it burns it produces aluminum oxide (slag) and
pure iron. Thermite is usually used to cut or weld metal. As an experiment,
a 3 lb. brick of thermite was placed on an aluminum engine block. After
the thermite was done burning, only a small portion of block was melted.
However, the block was very warped out of shape plus there were cracks
all through the block. Ferro-thermite produces about 930 calories per gram
The usual proportions of ferro-thermite are 25% aluminum and 75% iron oxide
The iron oxide usually used is not rust (Fe2O3) but iron scale (Fe3O4).
Rust will work but you may want to adjust the mixture to about 77% rust.
The aluminum is usually coarse powder to help slow down the burning rate.
The chemicals are mixed together thoroughly and compressed into a suitable
container. A first fire mix is poured on top and ignited. NOTE: Thermites
are generally very safe to mix and store. They are not shock or friction
sensitive and ignite at about 2000øF. A first fire mix is a mixture
that ignites easier than thermite and burns hot enough to light the thermite
reliably. A very good one is : Potassium Nitrate 5 parts Fine ground Aluminum
3 parts Sulfur 2 parts Mix the above thoroughly and combine 2 parts of
it with 1 part of finely powdered ferro-thermite. The resulting mixture
can be light by safety fuse and burns intensely. One problem with thermites
is the difference in weight between the aluminum and the oxide. This causes
them to separate out rendering the thermite useless. One way to fix this
is to use a binder to hold the chemicals to each other. Sulfur is good
for this. Called Diasite, this formula uses sulfur to bind all the chemicals
together. It's drawback is the thermite must be heated to melt the sulfur.
Iron Oxide 70 % Aluminum 23 % Sulfur 7 % Mix the oxide and aluminum together
and put them in an oven at 325øF and let the mix heat for a while.
When the mixture is hot sprinkle the sulfur over it and mix well. Put this
back in the oven for a few minutes to melt all the sulfur. Pull it back
out and mix it again. While it is still hot, load into containers for use.
When it cools, drill out the diasite to hold about 10 - 15 grams of first
fire mix. When diasite burns it forms sulfide compounds that release hydrogen
sulfide when in contact with water. This rotten egg odor can hamper fire
fighting efforts. Thermite can be made not to separate by compressing it
under a couple of tons pressure. The resulting pellet is strong and burns
slower than thermite powder. CAST THERMITE: This formula can be cast into
molds or containers and hardens into a solid mass. It does not produce
as much iron as regular ferro-thermite, but it makes a slag which stays
liquid a lot longer. Make a mixtures as follows. Plaster of Paris 2 parts
Fine and Coarse Mixed Aluminum 2 parts Iron Oxide 3 parts Mix together
well and add enough water to wet down plaster. Pour it into a mold and
let it sit for « hour. Pour off any extra water that separates out
on top. Let this dry in the sun for at least a week. Or dry in the sun
for one day and put in a 250øF oven for a couple of hours. Drill
it out for a first fire mix when dry. THERMITE BOMB: Thermite can be made
to explode by taking the cast thermite formula and substituting fine powdered
aluminum for the coarse/fine mix. Take 15 grams of first fire mix and put
in the center of a piece of aluminum foil. Insert a waterproof fuse into
the mix and gather up the foil around the fuse. Waterproof the foil/fuse
with a thin coat of wax. Obtain a two-piece spherical mold with a diameter
of about 4-5 inches. Wax or oil the inside of the mold to help release
the thermite. Now, fill one half of the mold with the cast thermite. Put
the first fire/fuse package into the center of the filled mold. Fill the
other half of the mold with the thermite and assemble mold. The mold will
have to have a hole in it for the fuse to stick out. In about an hour,
carefully separate the mold. You should have a ball of thermite with the
first fire mix in the center of it, and the fuse sticking out of the ball.
Dry the ball in the sun for about a week. DO NOT DRY IT IN AN OVEN! The
fuse ignites the first fire mix which in turn ignites the thermite. Since
the thermite is ignited from the center out, the heat builds up in the
thermite and it burns faster than normal. The result is a small explosion.
The thermite ball burns in a split second and throws molten iron and slag
around. Use this carefully ! THERMITE WELL: To cut metal with thermite,
take a refractory crucible and drill a 1/4 in. hole in the bottom. Epoxy
a thin (20 gal) sheet of mild steel over the hole. Allow the epoxy to dry.
Fill the crucible with ferro-thermite and insert a first fire igniter in
the thermite. Fashion a standoff to the crucible. This should hold the
crucible about 1 « in. up. Place the well over your target and ignite
the first fire. The well works this way. The thermite burns, making slag
and iron. Since the iron is heavier it goes to the bottom of the well.
The molten iron burns through the metal sheet. This produces a small delay
which gives the iron and slag more time to separate fully. The molten iron
drips out through the hole in the bottom of the crucible. The standoff
allows the thermite to continue flowing out of the crucible. The force
of the dripping iron bores a hole in the target. A 2 lb thermite well can
penetrate up to 3/4 in. of steel. Experiment with different configurations
to get maximum penetration. For a crucible, try a flower pot coated with
a magnesium oxide layer. Sometimes the pot cracks however. Take the cast
thermite formula and add 50% ferro-thermite to it. This produces a fair
amount of iron plus a very liquid slag. THERMITE FUEL-AIR EXPLOSION: This
is a very dangerous device. Ask yourself if you really truly want to make
it before you do any work on it. It is next to impossible to give any dimensions
of containers or weights of charges because of the availability of parts
changes from one person to the next. However here is a general description
of this device affectionately known as a HELLHOUND. Make a thermite charge
in a 1/8 in. wall pipe. This charge must be electrically ignited. At the
opposite end of the pipe away from the ignitor side put a small explosive
charge of flash powder weighing about 1 oz Drill a small hole in a pipe
end cap and run the wires from the ignitor through the hole. Seal the wires
and hole up with fuel proof epoxy or cement. Try ferrule cement available
at sporting goods stores. Dope the threads of the end caps with a good
pipe dope and screw them onto the pipe. This gives you a thermite charge
in an iron pipe arranged so that when the thermite is electrically ignited,
it will burn from one end to the other finally setting of the flash powder
charge. Place this device in a larger pipe or very stout metal container
which is sealed at one end. Use a couple of metal "spiders" to keep the
device away from the walls or ends of the larger container. Run the wires
out through the wall of the container and seal the wires with the fuel
proof epoxy. Fill the container with a volatile liquid fuel. Acetone or
gasoline works great. Now seal up the container with an appropriate end
cap and it is done. The device works like this: Attach a timer-power supply
to the wires. When the thermite is ignited it superheats the liquid fuel.
Since the container is strong enough to hold the pressure the fuel does
not boil. When the thermite burns down to the explosive, it explodes rupturing
the container and releasing the superheated fuel. The fuel expands, cooling
off and making a fine mist and vapor that mixes with the surrounding air.
The hot thermite slag is also thrown into the air which ignites the fuel-air
mix. The result is obvious. Try about 1 « lbs of thermite to a gallon
of fuel. For the pressure vessel, try an old pressure cooker. Because the
fuel may dissolve the epoxy don't keep this device around for very long.
But ask yourself, do you really want to make this? EXOTIC THERMITES: Thermites
can also be made from teflon-magnesium or metal fluorides-magnesium or
aluminum. If there is an excess of fluoride compound in the mixture, fluorine
gas can be released. Fluorine is extremely corrosive and reactive. The
gas can cause organic material to burst into flames by mere contact. For
teflon-magnesium use 67% teflon and 33% magnesium. A strong first fire
igniter should be used to ignite this mixture. Both the teflon and the
magnesium should be in powdered form. Do not inhale any smoke from the
burning mixture. If you use metal-fluorides instead of teflon, use fluorides
of low energy metals. Lead fluoride is a good example. Try using 90% lead
fluoride and 10% aluminum. Warning: Fluoride compounds can be very poisonous.
They are approximately equal to cyanide compounds. Another exotic mix is
tricalcium orthophosphate and aluminum. When this burns, it forms calcium
phosphide which when contacts water releases hydrogen phosphide which can
ignite spontaneously in air. Tricalcium orthophosphate has the formula
Ca3(PO4)2 and is known as white-lockite. Use about 75% orthophosphate and
25% aluminum. This ratio may have to be altered for better burning as I
have not experimented with it much and don't know if more aluminum may
reduce the calcium better. It does work but it is a hard to ignite mixture.
A first fire mix containing a few percent of magnesium works well. Fighting
thermite fires: Two ways to fight thermite fires are either smothering
the thermite with sand. This doesn't put out the thermite but it does help
contain it and block some of the heat. The other way is to flood the thermite
with a great amount of water. This helps to break the thermite apart and
stop the reaction. If you use a small amount of water, an explosion may
result as the thermite may reduce the water and release hydrogen gas. Thermite
can start fires from the heat radiating from the reaction. Nearby flammable
substances can catch fire even though no sparks or flame touch them.