History of Hacking 4: Real-World Phone Phreaking Stories

As a copestone of his talk, John Draper tells a few stories from his phone phreaking past to show the power you could have playing around with phone numbers.

800 numbers Okay, what I’d like to do now is tell a few stories about some of the stuff that we did, because I kind of wanted to save the best for last. One of the things that I really wanted to point out is that there was no 800 directory, a directory of 800 numbers. So, in order for you to find 800 number, the only way you can do that is to watch the ads on TV, newspapers, or whatever.

And so, what you’ll need to do is basically figure out how you can find 800 numbers. There were a lot of independent companies that were giving away 800 directories.

Well, I said to myself: “I bet Washington, D.C. must have some really interesting 800 numbers.” So I decided to scan every possible 800 number in Washington, D.C. It turns out that Washington, D.C. 800 prefix is 800-424; that translates into 202 area code. And so, all I did was I would just dial 800-424-0000 thru 9999.

I would skip every 10 numbers because of the recording that says: “We’re sorry, your call cannot be completed as dial. This is a recording 2022.” That means the entire bank of 10 numbers is not valid. So, therefore, why should I go through every 10 of those numbers? So I skipped by tens: 0010, 0020, 0030, 0040, and then until I find a working number. If I got a recording that says: “We’re sorry, the number you dialed is not a working number,” then that must mean the entire bank of 10 numbers is a valid bank of numbers to use, so then we’d skip by 1’s.

And so, I found out that 800-424-933-7 went into a very interesting individual. The person who I called at that number was extremely rude to me. Why would anybody who would want you to call them and pay for your call not want to talk to you?

So, therefore that number had to be something special. I wrote this down in my little special book and later on, a week or so later, I went back to that number and I said: “Yeah, I should figure out where that number comes from.”

So I called the number again and this time I said: “Hi, this is White Plains for a trunk testing, AT&T long lines division. Who have we reached?” And the person says: “You’ve reached the White House, sir; this is the CIA crisis hotline you’ve called.” I responded: “Oh, sir, we’ll get it fixed right away for you; we’re having some translation difficulties. Thank you very much,” and I hung up. Okay, I wrote down: “White House CIA crisis hotline number.”

Now, a lot of telephone phreaks get together at parties and stuff like that. They like to trade information. One particular phone phreak had this really amazing conference number and I just had to have it. So he says: “What have you got to give away?” I say: “Well, I can give you the CIA crisis hotline to the White House,” and he said: “You have what?” I said: “Yeah, I’ve got the CIA crisis hotline number to the White House, you want it?” He says “Yeah!”

Okay, after I found out the crisis hotline number, the next thing I had to do is I had to find out where’s the 202 area code it came in. It turns out that 202-456-9337 happened to be a regular 10-digit number. So, back in the day they had ‘auto verify’, which meant that if I could get directly into the 202 trunk line, if dialed KP 052-252-9337*, I get ‘click’, ‘plop’ and then I get the scrambled noise.

I flash it with 2600 and it goes ‘beep’ – and it just clears away and I can hear the conversation on that number now. So I’m sitting there listening to the conversation on that number, and then I hear the conversation that says: “Olympus, please,” and then the guy says: “One moment, sir,” and I swear, the guy that came on the line was President Nixon. I wrote down: “Olympus, President Nixon.” Then I gave that to him as well.

Okay, so what happened was my friend Adam grabbed the phone from me and then he says: “I know what I’m going to do.” He called the number up, but I said: “You really don’t want to call that number directly; you really want to call that number in stack of a few trunks.”

So, what we did was we stacked a few trunks so that it would be harder for them to trace us back, because we knew that this could really result in somebody getting into trouble. So, Adam says: “Olympus, please” – “One moment, sir”, and Olympus came on the line and says: “Olympus.” He says: “Sir, we have a national crisis on our hands here in Los Angeles. Sir, we’re out of toilet paper,” and we hung up.

The idea of that was the fact you could do that kind of thing back then. I believe it was 1974-1975, this was just during the time that Nixon was having all this Watergate stuff going on. And I think he got kicked out of office soon afterwards. But that at least was what we did.

A couple of other pranks that we did had to do with dialing old funky step-by-step exchange, these are the old switches. Well, Santa Barbara was operated and controlled not by Pacific Telephone Company which is in California. It was operated by General Telephone Company which is a totally different private telephone company. And they’re also using 2600 signaling and trunking for the lines.

So, if you were to call into Santa Barbara – I had to dial into Santa Barbara with 2 phone lines exactly at the same time – and if you picked it just right, maybe 1 in about 50 tries, you get this high-pitched scratch, and all of a sudden just silence, and then you get ‘burp’, ring comes in: “Hello, is Maple there?” – “You got the wrong number, lady,” and then we hung up.

Oh, this is interesting; we’re intercepting calls going into Santa Barbara. So we started saying: “Oh, why don’t we do this?” We said: “We know what we can do.” The next call that came in was: “Sir, this is The National Guard, Santa Barbara had a nuclear accident. We are not accepting calls into Santa Barbara at the time. Please call back later.”

After a while, more and more calls started coming in, people started realizing and words got spread around, and then the press started calling and it started just getting pandemonium, because we were on the primary selector group for all trunk lines going into Santa Barbara.

We did this with two phone lines by just simply causing what is called a ‘glare condition’. A ‘glare condition’ is where you’ve got 2 trunks looking at each other, and they’re glaring. This guy is waiting for this guy to do something, this guy is waiting for this guy to do something, so they’re sitting there staring at each other, figuring out what they’re going to do.

But as a result of that process, calls coming in would show up as on-hook, which meant that the numbers were not engaged. But all those calls that were coming into that primary selector group wouldn’t jump over to the next line, it wouldn’t work that way. It just jammed up the lines and then the calls just started piling in. And so, when we told them about the nuclear bomb hoax, it wound up in the LA Times.

And there were also some cases when I was with Steve Wozniak. Steve Wozniak got these little radio transmitters for 160 MHz. And if you go up to a drive-thru like McDonald’s, you drive into McDonald’s, you see this clown Ronald McDonald who says something in his little speaker: “May I take your order please?”

And that was over 150-160 MHz frequency. So, Steve was sitting in his car, way in the back there, watching these people drive in, and he’d say: “May I have your order please?”, and then they’ll take the order and they’ll come back, and he’d say: “Lady, you’re too fat, I’m ordering a veggie burger for you instead”.

Anyway, that’s it for my presentation. Thank you!

Read previous: History of Hacking 3: The Dawn of Computer Hacking

Like This Article? Let Others Know!
Related Articles:

Leave a comment:

Your email address will not be published. Required fields are marked *

Comment via Facebook: