Тгах изобрел мультичастотный кодовый фрикинг. Посылая специальные тоны – сгенерированные компьютерной программой – по телефонной линии, он мог контролировать некоторые функции телефонного коммутатора. Многие хакеры научились совершать бесплатные телефонные звонки, за которые платил кто-то другой, или мошенничая с телефонными картами, но Тгах обнаружил, что можно звонить бесплатно, и платить за это не придется вообще никому. Это были не только бесплатные, но и «бесследные» звонки: их нельзя было проследить.

Тгах написал о своем открытии 48-страничный труд и назвал его Australian Phreakers Manual Volumes.[p145] Но, постепенно добавляя к учебнику все новые материалы, он стал волноваться по поводу того, что может произойти, если он выпустит его в андеграунд, поэтому он решил показать его только двум другим хакерам из International Subversive.

Он опубликовал The Advanced Phreaker’s Manual,[p146] второе издание своего труда, в The International Subversive, подпольном журнале, который издавал Mendax.

Ok in this file you will learn the in’s and out’s of MFC signalling He all know about CCITT 5. But what is MFC? Hell first of all it stands tor Multi-Frequency Code and is the Backward tones you hear when you play your Forward CCITT 5 tones. MFC tones when you know how to use then with CCITT 5 tones will let you do anything a Fault Operator and Call Operator can do. They are however very difficult to understand. They aren’t simple ST-NUMBBR-KP type routing. So you will have to do some heavy programming to cope with the different signalling groups. So lets get started.

Index

Chapter 1. Frequency Table

Chapter 2. CCITT 5 Routing Table

Chapter 3. MFC Signalling Table

Chapter 4. Signalling Groups

Chapter 5. Horking it Together

Chapter 6. Other types of Signalling

Chapter 7. Hang Up Time

%%%%%%%%%%%%

Chapter 1. Frequency Table

Tone Table

I Forward I Backward I KEY I CCITT #5 IMPC I KEY – I-1-1-1-1-

1 I 1380 I 1500 I 1140 I 1020 I 1

2 I 1380 I 1620 I 1140 I 900 1 2

– I in routing programs i use the following I defined keys.

3 I 1500 I 1620 I 1020 I 900! 3 I Key ICCITTIMFC I See Chapter 6.

4 I 1380 I 1740 I 1140 [780 1 4 I-!-1-1 For other

Signalling

5 I 1500 I 1740 I 1020 I 780 1 5 I A I 11 [11 I Frequencies.

6 I 1620 I 1740 I 9001 7801 6 I В I 12 I 12 I

7 I 1380 I 1860 I 1140 I 6601 7 [С I KP I 13 I

8 I 1500 I 1860 I 1020 I 6601 8 I D I KP2 I 14 I

9 I 1620 I 1860 I 900 col1¦0t 9 I E I ST I 15 I

0 11740 1 1860 I 7801 6601 0 I-1-1-1

11 I 1380 I 1980 I 1140 I 5401 11 I This is for ease of programiting only. It is

12 I 1500 I 1980 I 1020 I 540 1 12 I best to have a single key switch to change KP I 1620 I 1980 I 900 col1¦0 1 13 I between Forward and

Backward frequencies.

KP2 I 1740 I 1980 I 7801 5401 14 1 So note. ST I 1860 I 1980 I 660 col1¦1 1 15 1 SF = Switch Forward –1-1-1-[-1-1 SB = Switch Backward

NUMBER=Telephone number CCITT 5 Half Tones An example would translate from

– I–I-I–I-I–I SF-E-1-123456-*

1380 1150011620117401 I860 I 19801 to

– 1-1-1-1-1-1 Switch Forward tones

1140110201 9001 7801 660! 540 I ST-(1)-NUMBER-KP

MFC Half Tones

These half tones do strange things in the middle of routing. Like alarms going off and numbers Re-routed STD. Note that single frequencies will be bracketed. [] as below.

For example.

ST-(1)-0011-(CO – (AC)-NUMBER-KP-(OPD)-[1850]

The above is the formula for TASI line breaking.

CC=Country Code

AC=Area Code

OPD=Other Party Disconnects

[1850] The frequency in hz to get into a TASI control line.

Chapter 2. CCITT 5 Routing Table

NUMBER-KP

This is the simplest way to route a Phone Number. Also the only way alot of Australian Phreaker route. Depending on the

Signalling Trunk you may not be able to route a call over seas. Tor example STD

Signalling Trunk.

11-(Not used)

It’s use in CCITT 5 Routing is at present unknown. However some

Telecom Publications show it’s MFC counterpart used in routing to

Interception Centre and used by Incoming Operators.

12-(1)-ID

To

12-(9)-ID

These could be Non-Axe to Axe Exchange Switching signals. 12-(AC)– HUMBER

This routing is only allowed to Axe Exchanges from Son-Axe Exchanges.

This is very useful for Axe test numbers which are blocked from other Exchanges.

12-(KP)-1D

12-(KP2)-ID

12-(ST)-ID

These could be more Non-Axe to Axe Exchange Switching signals.

KP-(Not Used)

It’s use in CCITT 5 Routing is at present unknown.

KP2-(l)-3D’s

To

KP2-(9)-3D’s

The 3 digits maybe used as switches between Exchanges. For exaapla

Bwitch 456 Exchange to except ARE type routing or SXS type routing.

The signalling between Exchanges still being CCITT 5 and MFC but the internal switching is different.

KP2-(0)-NUMBER

It’s use in CCITT 5 Routing is at present unknown.

KP2-(11)-3D’s

KP2-(12)-3D’s

Maybe Exchange switches.

KP2-(12)-(0)-NUMBER

It’s use in CCITT 5 Routing is at present unknown.

KP2-(KP)-3D’s

KP2-(KP2)-3D'S

Maybe Exchange switches.

KP2-(ST)-(No CCITT 5 or MFC signals)

This maybe used as an echo suppressor.

ST-(1)-NUMBER

Another Routing method.

ST-(2)-4D’s

ST-(3)-4D’s

These maybe used to store or switch the lat 4 Digits on a given number. ST-(4)-ID

To

ST-(0)-ID ST-(11)-ID ST-(12)-ID ST-(KP)– ID ST– (KP2)– ID ST– (ST)-1D Maybe Exchange switches.

Chapter 3. MFC Signalling Table

HPC Signals have multiple function, so you’ll have to know what is sent and keep track of it to know what your signals are going do next. How all MFC Signalling start with the A Signals.

Now here is a run down.

A Signals

Al Next Digit.

A2 Restart.

A3 End Of Selection. Change to B.

A4 Terminating Exchange MFC. 5 Digit Length. Change to 2A.

A5 Terminating Exchange MFC. 6 Digit Length. Change to 2A.

A6 Terminating Exchange MFC. 7 Digit Length. Change to 2A.

A7 Terminating Exchange SxS. 5 Digit Length. Change to ЗА.

A8 Terminating Exchange SxS. 6 Digit Length, change to ЗА.

A9 Terminating Exchange SxS. 7 Digit Length. Change to ЗА.

АО Terminating Exchange SxS. Length Unknown. Change to ЗА.

2A Signal*

!!Al Next Digit.

;:A2 Restart.

::A3 End of Selection. Change to B.

::A4 Start Decadic. 1st Digit.

::A5 Start Decadic. 2nd Digit.

;!A6 Start Decadic. 3rd Digit.

:!A7 Waiting place. Next Digit. Change to ЗА.

::a8 Waiting Place. Restart. Change to ЗА.

.', A9 Waiting Place. same digit. change to ЗА.

:! A0 waiting place, previous Digit. Change to ЗА.

ЗА Signals

SAl Next Digit.

1A2 Restart.

iA3 End of Selection. Change to B.

(A4 Start Decadic. 1st Digit.

J.A5 Start Decadic. 2nd Digit.

'.A6 Start Decadic. 3rd Digit.

'>A7 Start Decadic. 4th Digit.

iA8 Start Decadic. 5th Digit.

'A9 Send A-party Category. Change to C.

iAO Send Previous Digit.

В Signals

Ml Idle Sub.

M2 Busy Sub.

M3 No Throwout.

M4 Congestion.

M5 Idle – Non Metering.

MO B-party Control. No time-out.

M7 B-party Control. Non chargeable.

MH Re-route to interception.