Phreaking is a slang term coined to describe the activity of a subculture of people who study, experiment with, or explore telecommunication systems, like equipment and systems connected to public telephone networks. Slang is the use of highly informal Words and expressions that are not considered standard in the speaker's Dialect or Language. For the term in biology see Subculture (biology. For the song by New Order see Sub-culture (song. The term "phreak" is a portmanteau of the words "phone" and "freak". Basic principle A traditional landline telephone system also known as "plain old telephone service" (POTS, commonly handles both signaling and audio information In contemporary usage the word freak is usually used to refer to a person with something unusual about their appearance or behaviour It may also refer to the use of various audio frequencies to manipulate a phone system. Frequency is a measure of the number of occurrences of a repeating event per unit Time. "Phreak", "phreaker", or "phone phreak" are names used for and by individuals who participate in phreaking. Additionally, it is often associated with computer hacking. In common usage hacker is generic term for a computer criminal often with a specific specialty in computer intrusion This is sometimes called the H/P culture (with H standing for Hacking and P standing for Phreaking).
Contents |
The precise origins of phone phreaking are unknown, although it is believed that phreak-like experimentation began with widespread deployment of automatically switched telephone networks. Modern day phreaking is more likely to be traced to the United States in the mid-to-late 1950s when AT&T began introducing fully automatic direct-dial long distance and certain forms of trunking carriers which used in-band signalling. The United States of America —commonly referred to as the Before proposing a merge request please see Talk and see if the merger you propose has recently been made and See also Signalling (telecommunications In Telecommunications, in-band signaling is the sending of Metadata and control information in At this time, phone system experimentation began, similar to the way modern-day hackers use the Internet. In common usage hacker is generic term for a computer criminal often with a specific specialty in computer intrusion The Internet is a global system of interconnected Computer networks
In approximately 1957, a blind seven-year old named Joe Engressia, who as an adult changed his name to "Joybubbles", skilled with perfect pitch, discovered that whistling the fourth E above middle C (a frequency of 2600 Hz) would stop a dialed phone recording. Joybubbles ( &ndash) born Josef Carl Engressia Jr in Richmond Virginia, USA, was an early phone phreak. Joybubbles ( &ndash) born Josef Carl Engressia Jr in Richmond Virginia, USA, was an early phone phreak. Absolute pitch (AP widely referred to as perfect pitch, is the ability of a person to identify or recreate a Musical Note without the benefit of a known This is a virtual piano with 88 keys tuned to A440, showing the frequencies in cycles per second ( Hz) of each note (ie note frequencies of each note found on a standard 2600 Hz is the Frequency in Hertz (cycles per second that AT&T formerly put as a steady signal on any Long-distance Telephone Engressia had stumbled on the tone that would cause a trunk to reset itself, though the eight-year-old didn't realise this at first. This is about the network-design strategies for riding in auto cargo space see Trunking (auto, and for the UK term for electrical wireways see Electrical conduit#Trunking The 2600 Hz frequency was an internal telephone company signal to take control of a trunk line, which opened up almost limitless possibilities for routing calls without charges. Unaware of what he had done, Engressia called the phone company and asked why the recordings had stopped. This was the beginning of his love of exploring the telephone system. [1]
Other early phreaks, such as "Bill from New York", began to develop a rudimentary understanding of how phone networks worked. "Bill" discovered that a recorder he owned could also play a tone at 2. The recorder is a woodwind Musical instrument of the family known as Fipple Flutes ' or internal duct flutes &mdash whistle-like 6 kHz with the same effect. John Draper discovered through his friendship with "Joybubbles" that the free whistles given out in Cap'n Crunch cereal boxes also produced a 2600 Hz tone when blown (providing his nickname, "Captain Crunch"). For the scientist see John William Draper John T Draper (born 1944 also known as Captain Crunch, Crunch or Crunchman Joybubbles ( &ndash) born Josef Carl Engressia Jr in Richmond Virginia, USA, was an early phone phreak. Cap'n Crunch is a sweetened corn and Oat Breakfast cereal manufactured by Quaker Oats Company and introduced in 1963 This allowed control of phone systems that worked on SF, or Single Frequency, controls. One could sound a long whistle to reset the line, followed by groups of whistles (a short tone for a "1", two for a "2", etc. ) to dial numbers. This process later led to MFing. An early Phreaking tool the blue box is an electronic device that simulates a Telephone operator 's dialing console
While SF worked on certain phone routes, the most common signalling on the then long distance network was MF, or Multi-Frequency Controls. The specific frequencies required were unknown until 1964, when Bell Systems published the information in the Bell System Technical Journal in an article describing the methods and frequencies used for inter-office signalling. The Bell System which was named for Alexander Graham Bell, the technologist popularly credited with the invention of the Telephone, was a Trademark and Bell Labs Technical Journal is the in-house journal for scientists of Bell Labs / Alcatel-Lucent. The journal was intended for the company's engineers; however, it found its way to various college campuses across the United States. With this one article, the Bell System accidentally gave away the 'keys to the kingdom', and the intricacies of the phone system were at the disposal of anyone with a cursory knowledge of electronics.
The second generation of phreaks arose at this time, including the New Yorkers "Evan Doorbell", "Ben Decibel" and Neil R. New York ( is a state in the Mid-Atlantic and Northeastern regions of the United States and is the nation's third most populous Bell and Californians Mark Bernay, Chris Bernay, and "Alan from Canada". California ( is a US state on the West Coast of the United States, along the Pacific Ocean. Each conducted their own independent exploration and experimentation of the telephone network, initially on an individual basis, and later within groups as they discovered each other in their travels. "Evan Doorbell", "Ben" and "Neil" formed a group of phreaks known as Group Bell. Mark Bernay initiated a similar group named the Mark Bernay Society. Both Mark and Evan received fame amongst today's phone phreakers for Internet publication of their collection of telephone exploration recordings. These recordings, conducted in the 60s, 70s, and early 80s are available at Mark's website Phone Trips. [2]
In October 1971, phreaking was introduced to the masses when Esquire Magazine published a story called "Secrets of the Little Blue Box" [3] by Ron Rosenbaum. Esquire is a Men's magazine by the Hearst Corporation with a strong literary tradition This article featured Joybubbles and John Draper prominently, synonymising their names with phreaking. Joybubbles ( &ndash) born Josef Carl Engressia Jr in Richmond Virginia, USA, was an early phone phreak. For the scientist see John William Draper John T Draper (born 1944 also known as Captain Crunch, Crunch or Crunchman The article also attracted the interest of other soon-to-be phreaks, such as Steve Wozniak and Steve Jobs who went on to found Apple Computer [4]. Steven Paul Jobs (born February 24 1955 is the Co-founder, Chairman, and CEO of Apple Inc and former CEO of Pixar Animation Apple Inc, ( formerly Apple Computer Inc, is an American Multinational corporation with a focus on designing and manufacturing Consumer electronics
1971 also saw the beginnings of YIPL (Youth International Party Line), a publication started by Abbie Hoffman and Al Bell to provide information to Yippies on how to "beat the man," mostly involving telephones. In 1973, Al Bell would move YIPL over and start TAP (Technology Assistance Program). TAP would develop into a major source for subversive technical information among phreaks and hackers all over the world. TAP ran from 1973 to 1984, with Al Bell handing over the magazine to "Tom Edison" in the late 70's. TAP ended publication in 1990 due mostly to a break-in and arson at Tom Edison's residence in 1983 [5]. Cheshire Catalyst then took over running the magazine for its final (1984) year.
A controversially suppressed article "How to Build a 'Phone Phreaks' box" in Ramparts Magazine, (June, 1972) touched off a firestorm of interest in phreaking. Ramparts was an American political and literary magazine published from 1962 through 1975 This article published simple schematic plans of a "black box" used to receive free long distance phone calls, and included a very short parts list that could be used to construct one. Bell sued Ramparts which forced the magazine to pull all copies from shelves, but not before numerous copies were sold and many regular subscribers received them.
In the 1980s, the revolution of the personal computer and the popularity of computer bulletin board systems (accessed via modem) created an influx of tech-savvy users. A personal computer ( PC) is any Computer whose original sales price size and capabilities make it useful for individuals and which is intended to be operated A Bulletin Board System, or BBS, is a Computer system running software that allows users to connect and login to Modem (from mo dulator- dem odulator is a device that modulates an analog carrier signal to encode Digital information These BBSes became popular for computer hackers and others interested in the technology, and served as a medium for previously scattered independent phone phreaks to share their discoveries and experiments. A Bulletin Board System, or BBS, is a Computer system running software that allows users to connect and login to This not only led to unprecedented collaboration between phone phreaks, but also spread the notion of phreaking to others who took it upon themselves to study, experiment with, or exploit the telephone system. This was also at a time when the telephone company was a popular subject of discussion in the US, as the monopoly AT&T was forced into divestiture. In Economics, a monopoly (from Greek monos, alone or single + polein, to sell exists when a specific individual or enterprise has sufficient Before proposing a merge request please see Talk and see if the merger you propose has recently been made and During this time, phreaking lost its label for being the exploration of the telephone network, and began to focus more on toll fraud. Computer hackers began to use phreaking methods to find the telephone numbers for modems belonging to businesses, which they could later exploit. Groups then formed around the BBS hacker/phreaking (H/P) community such as the famous Masters of Deception (Phiber Optik) and Legion of Doom (Erik Bloodaxe) groups. Masters of Deception ( MOD) were a New York -based hacker group Mark Abene (born 1972 better known by his Pseudonym Phiber Optik, is a computer security hacker from New The Legion of Doom ( LOD) was an extremely influential hacker group that was active from the 1980s to the late 1990s and early 2000 Chris Goggans, who used the name Erik Bloodaxe in honor of the Viking king of a similar name, is a founding member of the Legion of Doom group and In 1985 an underground e-zine called Phrack (a combination of the words Phreak and Hack) began circulation among BBSes, and focused on hacking, phreaking, and other related technological subjects. Phrack is an Underground ezine written by and for hackers first published November 17, 1985.
In the early 1990s H/P groups like Masters of Deception and Legion of Doom were shut down by the US Secret Service's Operation Sundevil. Operation Sundevil was a 1990 nation-wide United States Secret Service crackdown on "illegal computer hacking activities" Phreaking as a subculture saw a brief dispersion in fear of criminal prosecution in the 1990s, before the popularity of the internet initiated a reemergence of phreaking as a subculture in the US and spread phreaking to international levels. The Internet is a global system of interconnected Computer networks
Into the turn of the 21st century, phreaks began to focus on the exploration and playing with the network, and the concept of toll fraud became widely frowned on among serious phreakers, primarily under the influence of the website Phone Trips, put up by second generation phreaks Mark Bernay and Evan Doorbell.
In the original analog networks, short-distance telephone calls were completed by sending relatively high-power electrical signals through the wires to the end office, which then switched the call. 2600 Hz is the Frequency in Hertz (cycles per second that AT&T formerly put as a steady signal on any Long-distance Telephone A Class 5 switch in United States telephony jargon refers to a Telephone switch or exchange located at the local telephone company's central office directly This technique could not be used for long-distance connections, because the signals would be filtered out due to capacitance in the wires. Capacitance is a measure of the amount of Electric charge stored (or separated for a given Electric potential. Long-distance switching remained a manual operation years after short-distance calls were automated, requiring operators at either end of the line to set up the connections.
Bell automated this process by sending "in-band" signals. Since the one thing the long-distance trunks were definitely able to do was send voice-frequency signals, the Bell system used a selection of tones sent over the trunks to control the system. When calling long-distance, the local end-office switch would first route the call to a special switch (this is why it is necessary to dial "1" in North America for long-distance calls) which would then convert further dialing into tones and send them over an appropriately selected trunk line (selected with the area code). A similar machine at the far end of the trunk would decode the tones back into electrical signals, and the call would complete as normal.
In addition to dialing instructions, the system also included a number of other tones that represented various commands or status. 2600 Hz, the key to early phreaking, was the frequency of the tone sent by the long-distance switch indicating that the user has gone on-hook (hung up the phone). Frequency is a measure of the number of occurrences of a repeating event per unit Time. In Telephony, the term on-hook has the following meanings The condition that exists when a Telephone or other user instrument is not This normally resulted in the remote switch also going on-hook, freeing the trunk for other uses. In order to make free lines easy to find, the 2600 Hz tone was continually played into free trunks. Engressia's whistling had triggered the remote switch to go on-hook, but critically, the local switch knew he was still off-hook because that was signaled electrically. The system was now in an inconsistent state, leaving him connected to an operational long-distance trunk line. With further experimentation, the phreaks learned the rest of the signals needed to dial on the remote switch.
Normally long-distance calls are billed locally. Since the "trick" required a long distance call to be placed in order to connect to the remote switch, it would be billed like normal. However there are a class of calls that have either no billing, like calls to directory service, or reverse the billing, like WATS lines (1-800 numbers). In US Telecommunications a Wide Area Telephone Service (WATS is a Toll service offering for customer dial-type telecommunications between a given customer station By dialing one of these numbers the user was connected to a remote switch as normal, but no billing record was made locally. A number of people in the 1960s discovered a loophole that resulted from this combination of features that allowed free long distance calls to be made. First you would dial a toll-free number in the area code you wanted to connect to, then play the 2600 Hz tone into the line to return the remote switch to on-hook, and then use a blue box to dial the number you wanted to connect to. An early Phreaking tool the blue box is an electronic device that simulates a Telephone operator 's dialing console The local Bell office would have no record of the call.
As knowledge of phreaking spread, a minor culture emerged from the increasing number of phone phreaks. Sympathetic (or easily social-engineered) telephone company employees began to provide the various routing codes to use international satellites and trunk lines. Social engineering is the art of manipulating people into performing actions or divulging confidential information At the time it was felt that there was nothing Bell could do to stop this. Their entire network was based on this system, so changing the system in order to stop the phreakers would require a massive infrastructure upgrade.
In fact, Bell responded fairly quickly, but in a more targeted fashion. Looking on local records for inordinately long calls to directory service or other hints that phreakers were using a particular switch, filters could then be installed to block efforts at that end office. Many phreakers were forced to use pay telephones as the telephone company technicians regularly tracked long-distance toll free calls in an elaborate cat-and-mouse game. AT&T instead turned to the law for help, and a number of phreaks were caught by "The Man". This page is about the phrase for other uses of the phrase see The Man (disambiguation.
Eventually, the phone companies in North America did, in fact, replace all their hardware. They didn't do it to stop the phreaks, but simply as a matter of course while moving to fully digital switching systems. Unlike the crossbar, where the switching signals and voice were carried on the same lines, the new systems used separate lines for signalling that the phreaks couldn't get to. This system is known as Common Channel Interoffice Signaling. See also Signaling (telecommunications In telephony Common Channel Signaling (CCS or in the US Common Channel Interoffice Signaling (CCIS is the transmission Classic phreaking with the 2600 Hz tone continued to work in more remote locations into the 1980s, but was of little use in North America by the 1990s.
The 1984 AT&T breakup gave rise to many small companies intent upon competing in the long distance market. These included the then-fledgling Sprint and MCI, both of whom had only recently entered the marketplace. Sprint Nextel Corporation ( is a Telecommunications company based in Overland Park, Kansas. MCI Inc is an American Telecommunications company that is headquartered in Ashburn Virginia. At the time, there was no way to switch a phone line to have calls automatically carried by non-AT&T companies. Customers of these small long distance operations would be required to dial a local access number, enter their calling card number, and finally enter the area code and phone number they wish to call. Because of the relatively lengthy process for customers to complete a call, the companies kept the calling card numbers short – usually 6 or 7 digits. This opened up a huge vulnerability to phone phreaks with a computer.
6-digit calling card numbers only offer 1 million combinations. 7-digit numbers offer just 10 million. If a company had 10,000 customers, a person attempting to "guess" a card number would have a good chance of doing so correctly once every 100 tries for a 6-digit card and once every 1000 tries for a 7-digit card. While this is almost easy enough for people to do manually, computers made the task far easier. "Code hack" programs were developed for computers with modems. The modems would dial the long distance access number, enter a random calling card number (of the proper number of digits), and attempt to complete a call to a computer bulletin board system (BBS). If the computer connected successfully to the BBS, it proved that it had found a working card number, and it saved that number to disk. If it did not connect to the BBS in a specified amount of time (usually 30 or 60 seconds), it would hang up and try a different code. Utilizing this methodology, code hacking programs would turn up hundreds (or in some case thousands) of working calling card numbers per day. These would subsequently be shared amongst fellow phreakers.
Worse yet, there was no way for these small phone companies to identify the culprits of these brute-force hacks. They had no access to local phone company records of calls into their access numbers, and even if they had access, obtaining such records would be prohibitively expensive and time-consuming. While there was some advancement in tracking down these code hackers in the early 1990s, the problem did not completely disappear until most long distance companies were able to offer standard 1+ dialing without the use of an access number.
Another method of obtaining free phone calls involved the use of so-called "diverters". Call forwarding was not an available feature for many business phone lines in the 1980s and early 1990s, so they were forced to buy equipment that could do the job manually between two phone lines. When the business would close, they would program the call diverting equipment to answer all calls, pick up another phone line, call their answering service, and bridge the two lines together. This gave the appearance to the caller that they were directly forwarded to the company's answering service. Unfortunately, the switching equipment would typically reset the line after the call had hung up and timed out back to dial tone, so the caller could simply wait after the answering service had disconnected, and would eventually get a usable dial tone from the second line. Phreakers recognized the opportunity this provided, and they would spend hours manually dialing businesses after hours, attempting to identify faulty diverters. Once a phreaker had access to one of these lines, he could use it for one of many purposes. In addition to completing phone calls anywhere in the world at the business' expense, they could also dial 1-900 phone sex/entertainment numbers, as well as use the phone line to harass their enemies without fear of being traced. Victimized small businesses were usually required to foot the bill for the long distance calls, as it was their own private equipment (not phone company security flaws) that allowed such fraud to occur. By 1993, call forwarding was offered to nearly every business line subscriber, making these diverters obsolete. As a result, hackers stopped searching for the few remaining ones, and this method of phreaking died.
By the late 1990s, the fraudulent aspect of phreaking all but vanished. Most cellular phones offered unlimited domestic long distance calling for the price of standard airtime (often totally unlimited on weekends), and flat-rate long-distance plans appeared offering unlimited home phone long distance for as little as $25 per month. International calling could be made very cheaply, as well. Between the much higher risk of being caught (due to advances in technology) and the much lower gain of making free phone calls, toll fraud started to become a concept associated very little with phreaking.
Prior to the BBS era of the 1980s, phone phreaking was more of a solitary venture, as it was difficult for phreaks to connect with one another. In addition to communicating over BBSs, phone phreaks discovered voice mail boxes and party lines as ways to network and keep in touch over the telephone. Voicemail (or voice mail voice-mail vmail or VMS, sometimes called messagebank) is a centralized system of managing Telephone messages for a large group In 20th century Telephone systems a party line (also multiparty line or Shared Service Line) is an arrangement in which two or more customers are It was rare for a phone phreak to legally purchase access to voice mail. Instead, they usually would appropriate unused boxes that were part of business or cellular phone systems. Once a vulnerable mailbox system was discovered, word would spread around the phreak community, and scores of them would take residence on the system. They would use the system as a "home base" for communication with one another, until the rightful owners would discover the intrusion and wipe them off. A dead drop or dead letter box, is a location used to secretly pass items between two people without requiring them Voice mailboxes also provided a safe phone number for phreaks to give out to one another, as home phone numbers would allow the phreak's identity (and home address) to be discovered. This was especially important, given that phone phreaks were breaking the law.
Phreakers also used "bridges" to communicate live with one another. The term "bridge" originally referred to a group of telephone company test lines that were bridged together, giving the effect of a party-line. Eventually all party-lines, whether bridges or not, came to be known as bridges if primarily populated by hackers and/or phreakers.
The popularity of the Internet in the mid-1990s, along with the better awareness of voice mail by business and cell phone owners, made the practice of stealing voice mailboxes less popular. To this day, bridges are still very popular with phreakers, yet with the advent of VoIP, the use of telephone company owned bridges has decreased slightly in favor of phreaker-owned conferences.
The end of MF phreaking in the lower 48 United States occurred on June 15, 2006, when the last exchange in the continental United States to use a "phreakable" MF-signalled trunk replaced the aging (yet still well kept) N2 carrier with a T1 carrier. Events 763 BC - Assyrians record a Solar eclipse that will be used to fix the Chronology of Mesopotamian history Year 2006 ( MMVI) was a Common year starting on Sunday of the Gregorian calendar. The United States of America —commonly referred to as the In Telecommunications T-carrier, sometimes abbreviated as T-CXR, is the generic designator for any of several digitally multiplexed telecommunications This exchange, located in Wawina Township, Minnesota, was run by the Northern Telephone Company of Minnesota. Many phone phreaks from across North America and the world made calls into what was the last group of MF-able inward trunks in the continental United States. A message board was set up for Paul Revere on +1 (218) 488-1307, for phone phreaks across the world to "say their goodbyes" to MF signalling and the N2 in Wawina.
During the days prior to the cut over, many famous phone phreaks such as Mark Bernay, Joybubbles, Bob Bernay, and Captain Crunch could be heard leaving their comments on the message board. Joybubbles ( &ndash) born Josef Carl Engressia Jr in Richmond Virginia, USA, was an early phone phreak. For the scientist see John William Draper John T Draper (born 1944 also known as Captain Crunch, Crunch or Crunchman The official date for the cutover from N2 to T-carrier was Wednesday, June 14. In Telecommunications T-carrier, sometimes abbreviated as T-CXR, is the generic designator for any of several digitally multiplexed telecommunications Events 1276 - While taking exile in Fuzhou in southern China, away from the advancing Mongol invaders, the remnants of the As early as June 7, there was a noticeable static on what had previously been clear lines. Events 1099 - The First Crusade: The Siege of Jerusalem begins By Monday, June 12, many numbers were unreachable, and the static had peaked. Events 1381 - Peasants' Revolt: in England, rebels arrive at Blackheath. The recording on +1 (218) 488-1307 was generally inaccessible, and MFing through the switch was becoming increasingly difficult due to the increased static. On June 15th, around 1:40am, Eastern Daylight Time, any new incoming calls were unreachable.