The blue box previously owned by Steve Wozniak, on display at the Computer History Museum.

An early phreaking tool, the blue box is an electronic device that simulates a telephone operator's dialing console. It functions by replicating the tones used to switch long-distance calls and using them to route the user's own call, bypassing the normal switching mechanism. The most typical use of a blue box was to get free telephone calls. Blue boxes no longer work in most western nations, as the switching system is now digital and no longer uses in-band signaling. Instead, signaling occurs on an out-of-band channel which cannot be accessed from the line you are using (called Common Channel Interoffice Signaling (CCIS)). Cropped and colour corrected version of Image:Vcf7-bluebox-x534. ... Cropped and colour corrected version of Image:Vcf7-bluebox-x534. ... Steve Wozniak or Woz invented the Apple II, the computer that launched Apple. ... The Computer History Museum in Mountain View. ... Phreaking is a slang term coined to describe the activity of a subculture of people who study, experiment with, or exploit telephones, the telephone company, and systems connected to or composing the Public Switched Telephone Network (PSTN) for the purposes of hobby or utility. ... The field of electronics is the study and use of systems that operate by controlling the flow of electrons (or other charge carriers) in devices such as thermionic valves and semiconductors. ... A Verizon Central Office in Lakeland, Florida at night. ... It has been suggested that this article or section be merged with In-band signalling. ... In telecommunications, the term out-of-band signaling has the following meanings: 1. ... Common Channel Signaling (CCS) is the transmission of signaling information out of the information band. ...

The blue box got its name because the first device confiscated by Bell System security was in a blue plastic case.

See the reference to the blue box on the back cover of the spring 2006 issue of 2600 the hacker quarterly 2600

History

In 1955, the Bell System Technical Journal published an article entitled "In Band Signal Frequency Signalling", which described the process used for routing telephone calls over trunk lines with the then current signalling system, R1. The article described the basics of the inter-office trunking system and the signalling used. This, while handy, could not be used in and of itself, as the frequencies used for the Multi-Frequency, or "MF", tones were not published in this article. Bell System Technical Journal was the in-house journal of Bell Laboratories. ... In computer networking, trunking describes using multiple network cables or ports in parallel to increase the link speed beyond the limits of any one single cable or port. ...

In 1964, the other half of the equation was revealed by the Bell System Technical Journal: another article was published containing the frequencies used for the digits that were used for the actual routing codes. With these two bits of information, the phone system was at the disposal of anyone with a cursory knowledge of electronics. Sine waves of various frequencies; the lower waves have higher frequencies than those above. ...

However, contrary to numerous stories, before finding the articles in the Bell System Technical Journal it was discovered by many, some very unintentionally and to their annoyance, that some Bell System trunks could be reset by a 2600 Hz tone. Famous phone phreaks such as Joe Engressia (known as Joybubbles) and "Bill from New York" trained themselves to whistle 2600 Hz (which would reset trunks). They also learned how to route phone calls by causing trunks to flash in certain patterns. 2600 Hz is the frequency in hertz (cycles per second) that AT&T formerly put as a steady signal on any long-distance telephone line that was not currently in use. ... Phreaking is a slang term coined to describe the activity of a subculture of people who study, experiment with, or exploit telephones, the telephone company, and systems connected to or composing the Public Switched Telephone Network (PSTN) for the purposes of hobby or utility. ... Joybubbles (born May 25, 1949 as Joe Engressia in Richmond, Virginia, USA) was an early phone phreak. ...

With the ability to blue box, what was once individuals exploring the telephone network started to develop into a whole sub-culture. Famous phone phreaks such as John Draper (also known as Captain Crunch), Mark Bernay, Al Bernay, Joe Engressia, Evan Doorbell, Bill from New York, and Ben Decibel used blue boxes to explore the various 'hidden codes' that were not dialable from a regular phone line. John T. Draper (born 1944), also known as Captain Crunch, Crunch or Crunchman (after Capn Crunch, the mascot of a breakfast cereal), was a phone phreaker. ... Captain Crunch can refer to. ... Joybubbles (born May 25, 1949 as Joe Engressia in Richmond, Virginia, USA) was an early phone phreak. ... Evan Doorbell was the pseudonym used by a well-known but somewhat mysterious phone phreak of the 1970s. ...

Some of the more famous pranksters were Steve Wozniak and Steve Jobs, founders of Apple Computer. One of the more famous stories Wozniak tells is when he dialed over to the Vatican, and managed to wake up the Pope by impersonating Henry Kissinger, but instead of speaking with the Pope he spoke to the Pope's translator. Steve Wozniak or Woz invented the Apple II, the computer that launched Apple. ... Steven Paul Jobs (born February 24, 1955) is currently the CEO of Apple Computer and is a leading figure in both the computer and entertainment industries. ... Apple Computer, Inc. ... The current Pope is Benedict XVI (born Joseph Alois Ratzinger), who was elected at the age of 78 on 19 April 2005. ... Henry Alfred Kissinger (born Heinz Alfred Kissinger on May 27, 1923) is a German-born American diplomat, Nobel laureate and statesman. ...

Blue boxes were not just the domain of "pranksters" and "explorers"; others (such as the Mafia) used blue boxes solely to make free phone calls for criminal purposes. The factual accuracy of this article is disputed. ...

Blue boxing hit the mainstream media when an article entitled Secrets of the Little Blue Box was published in the October 1971 issue of Esquire Magazine. Suddenly, everyone wanted to get into the phone phreaking culture spawned by the blue box, and it furthered the fame of Cap'n Crunch and others. Esquire is a magazine for men owned by the Hearst Corporation. ... Phreaking is a slang term for the action of making a telephone system do something that it normally should not allow—in the words of one former practitioner, making the phone company bend over and grab its ankles. Sometimes, phreaking will be considered illegal, like in the act of toll...

In November 1988, the CCITT (now known as ITU-T) published recommendation Q.140, which goes over Signaling System No. 5's international functions, once again giving away the 'secret' frequencies of the system. This caused a resurgence of blue boxing incidents with a new generation. ITU-T is the telecom standardization organization of the International Telecommunication Union (ITU). ... The ITU Telecommunication Standardization Sector (ITU-T) coordinates standards for telecommunications on behalf of the International Telecommunication Union (ITU) and is based in Geneva, Switzerland. ...

Operation

The operation of a blue box is simple: First, the user places a long distance telephone call, usually to an 800 number or some other non-supervising phone number. For the most part, anything going beyond 50 miles would go over a trunk type susceptible to this technique.

When the call starts to ring, the caller uses the blue box to send a 2600 Hz tone. The 2600 Hz is a supervisory signal, because it indicates the status of a trunk; on hook (tone) or off-hook (no tone). By playing this tone, you are convincing the far end of the connection that you've hung up and it should wait. When the tone stops, the trunk will go off-hook and on-hook (known as a supervision flash), making a "Ka-Cheep" noise, followed by silence. This is the far end of the connection signalling to the near end that it is now waiting for routing digits.

Once the far end sends the supervision flash, the user would use the blue box to dial a "Key Pulse" or "KP", the tone that starts a routing digit sequence, followed by either a telephone number or one of the numerous special codes that were used internally by the telephone company, then finished up with a "Start" or "ST" tone. At this point, the far end of the connection would route the call the way you told it, while the users end would think you were still ringing at the original number.

Frequencies and timings

Each MF tone consists of two frequencies, shown in the table on the left. Note that these are not the same as customer dialed Touch Tone, which is shown by the table on the right: Dual-tone multi-frequency (DTMF), also known as Touch Tone is used for telephone signaling over the line in the voice frequency band to the call switching center. ...

Normally, the tone durations are on for 60ms, with 60ms of silence between digits. The 'KP' and 'KP2' tones are sent for 100ms. KP2 (ST2 in the R1 standard) was used for dialing internal Bell System telephone numbers. However, actual frequency durations can vary depending on location, switch type, and machine status.

Special codes

Some of the special codes an MFer could get onto are in the chart below. "NPA" is a U.S. telephone company term for 'area code'. This article or section should be merged with Telephone numbering plan -- ran (talk) 21:23, Jan 30, 2005 (UTC) The area code is a part of a telephone number normally occurring at the beginning of the number, that usually indicates a geographical area. ...

• NPA+100 – Plant Test – Balance termination
• NPA+101 – Plant Test – Toll Testing Board
• NPA+102 – Plant Test – Milliwatt tone (1004 Hz)
• NPA+103 – Plant Test – Signaling test termination
• NPA+104 – Plant Test – 2-way transmission and noise test
• NPA+105 – Plant Test – Automatic Transmission Measuring System
• NPA+106 – Plant Test – CCSA loop transmission test
• NPA+107 – Plant Test – Par meter generator
• NPA+108 – Plant Test – CCSA loop echo support maintenance
• NPA+109 – Plant Test – Echo canceler test line
• NPA+121 – Inward Operator
• NPA+131 – Operator Directory assistance
• NPA+141 – Rate and Route Information
• 914+151 – Overseas incoming (White Plains, NY)
• 212+151 – Overseas incoming (New York, NY)
• NPA+161 – trouble reporting operator (defunct)
• NPA+181 – Coin Refund Operator
• 914+182 – International Sender (White Plains, NY)
• 212+183 – International Sender (New York, NY)
• 412+184 – International Sender (Pittsburgh, PA)
• 407+185 – International Sender (Orlando, FL)
• 510+186 – International Sender (Oakland, CA)
• 303+187 – International Sender (Denver, CO)
• 212+188 – International Sender (New York, NY)

Not all NPAs had all functions.

External links

• The SARTS technical journal
• Recordings of MFing in action
• Secrets of the Little Blue Box - article with photos
• The Esquire magazine article on John Draper
• All about the Blue Box and related devices
• Text files about blue boxing
• The definitive guide to Phreak boxes
• Fun with Dick and Jane by Lewis Gum and Edward Oxford - article that appeared in the 1978 Bell Telephone Magazine about telephone fraud and Phone Phreaks