[00:03.800 --> 00:08.590]  Okay, welcome to the Phreaking 110 panel.
[00:09.520 --> 00:16.030]  I'm I-baLL, and I'll just start with some announcements, because that fills up time pretty fast.
[00:16.550 --> 00:23.780]  The stage paintings are available for sale, and if you want to buy them, leave contact info at the information desk.
[00:27.650 --> 00:30.240]  So, I'm glad that everybody came here.
[00:33.930 --> 00:39.560]  How many people here are familiar with the very, very, very basics of phone phreaking?
[00:41.440 --> 00:43.160]  Old-school phreaking here, so...
[00:43.160 --> 00:47.600]  Yeah, so I don't have to cover a lot of the stuff like blue-boxing and red-boxing.
[00:47.600 --> 00:48.300]  Okay.
[00:49.860 --> 00:55.740]  So, in the beginning there were phones, and then there were humans, and they all had fun with each other.
[00:56.180 --> 01:01.780]  And this gave birth to phone phreaking, a weird sexual practice.
[01:04.780 --> 01:32.600]  As you probably know, phone phreaking in the public's eye died out with a switch over to an advanced signaling and the SS7 network when it took over, and that prevented you from using tones to, you know, rapture your own calls across the world and jump from country to country.
[01:34.460 --> 01:39.790]  However, there's a lot more interesting stuff that's left over, and some new stuff.
[01:40.780 --> 01:48.680]  Right off the bat, I'll just get into VoIP and how some people think it's not phone phreaking.
[01:50.490 --> 01:57.160]  I'll get... basically, in the old days, the only way you could spoof caller ID...
[01:57.160 --> 01:57.960]  Actually, you know what?
[01:58.160 --> 02:00.260]  I'll start off with caller ID.
[02:01.020 --> 02:06.350]  Basically, people call... faking your caller ID, they call it caller ID spoofing.
[02:06.350 --> 02:12.990]  But you're not spoofing the caller ID, you're spoofing something called the CPN, calling party number.
[02:13.520 --> 02:34.650]  And why that's different from the caller ID is because when you place a phone call to somebody, and you use star 67, and your phone number is, I don't know, 212-555-5555, if you do star 67, your phone number still gets passed on to the terminating switch,
[02:34.710 --> 02:36.580]  to the person who you're calling.
[02:36.940 --> 02:40.610]  Their phone switch still gets your... the number.
[02:41.620 --> 02:43.710]  And that number is called the CPN.
[02:45.410 --> 02:49.840]  After the CPN, there's, I think, a two-bit flag.
[02:51.360 --> 02:53.740]  One for, uh, show caller ID.
[02:54.020 --> 02:56.840]  Another flag for, uh, don't show caller ID.
[02:57.180 --> 02:59.500]  Another, uh, as in caller ID restricted.
[02:59.900 --> 03:03.260]  A third flag for, um, unknown caller ID.
[03:03.440 --> 03:07.260]  And I believe a fourth flag for no caller ID whatsoever.
[03:08.000 --> 03:19.480]  Which is why on your cell phones, a lot of times, you might notice it says, uh, unknown, blocked, unavailable, and other messages, like, uh, and stuff.
[03:19.940 --> 03:37.000]  Now, caller ID is what happens when the terminating phone switch, uh, yeah, terminating phone switch, in other words, the phone switch of the person who you're calling, uh, sees the CPN, which is your phone number, uh, and sees the flags right after that.
[03:37.240 --> 03:44.440]  And, uh, if it sees, oh, you know, show the caller ID, uh, show the phone number, then that's called caller ID.
[03:44.680 --> 03:52.480]  Caller ID is, is what gets passed between, uh, the person who you're calling, their terminating switch, and their caller ID box.
[03:52.760 --> 03:53.640]  That's caller ID.
[03:54.340 --> 03:56.900]  But from, between switches, that's CPN.
[03:57.240 --> 04:05.100]  But it's still a reason that, uh, caller ID can be blocked from, because, uh, the customer never gets the number if it's blocked.
[04:05.340 --> 04:08.420]  But the switch always gets the number, unless it's not there.
[04:08.580 --> 04:08.940]  Question?
[04:08.940 --> 04:10.400]  There's a little point that relates to that.
[04:10.740 --> 04:14.200]  Some, I've seen situations where you call with blocked.
[04:20.560 --> 04:20.710]  Okay.
[04:21.210 --> 04:22.140]  It's actually there.
[04:22.420 --> 04:28.410]  Yeah, uh, Yeah, so you point to that that some, uh, phone switches ignore the, uh, caller ID flags.
[04:28.520 --> 04:28.970]  Private ones.
[04:29.080 --> 04:30.460]  Uh, yeah, the private ones.
[04:30.700 --> 04:32.080]  Uh, a great example was Omnipoint.
[04:32.670 --> 04:32.970]  Yes.
[04:33.110 --> 04:37.170]  Back in, uh, the 90s, whatever, late 90s.
[04:37.470 --> 04:42.410]  Uh, if you blocked your caller ID and called the phone, uh, the phone would not get the caller ID.
[04:42.640 --> 04:52.880]  But if you got to the voicemail, their voicemail system, uh, ignored the privacy flags and just said, like, oh, yeah, this person's calling you from this number.
[04:53.260 --> 04:56.000]  Even though, the number, they blocked the number in.
[04:56.210 --> 04:59.320]  What places was common to happen when somebody's calling cards?
[04:59.590 --> 05:02.140]  A lot of times you're doing it to a small switch and they were dating that.
[05:02.610 --> 05:04.200]  Oh, yeah, yeah, no, no.
[05:04.640 --> 05:06.210]  It's, it's basically, uh, depends on switch configurations.
[05:06.210 --> 05:07.110]  Exactly.
[05:07.270 --> 05:13.640]  And there's, uh, and that brings me into, uh, uh, CLIR and CLIRO.
[05:14.020 --> 05:19.260]  Uh, the phone companies are, like, have a fetish for, uh, for acronyms.
[05:19.530 --> 05:22.200]  And there's, like, a three billion acronyms for the same thing.
[05:22.200 --> 05:23.790]  And it causes mass confusion.
[05:24.900 --> 05:31.260]  Uh, another name for, uh, a name for caller ID, um, blocking is called CLIR.
[05:31.260 --> 05:35.100]  Color, uh, calling line identification restriction.
[05:36.100 --> 05:42.160]  And, uh, and, uh, the, uh, what, uh, there's a service called CLIRO.
[05:42.640 --> 05:50.160]  I don't know if that's pronounced CLIRO, but it's spelled C-L-I-R-O, which is calling line identification restriction override.
[05:50.420 --> 06:06.020]  Which is basically, it's the, uh, it's a subscriber feature where you can basically tell the phone switch that, hey, you know what, ignore all the, uh, privacy bits after the, uh, calling party numbers, CPN, and send me the caller ID even if it's supposed to be blocked.
[06:06.840 --> 06:08.380]  So, um, um...
[06:08.380 --> 06:10.320]  Use the phone with the 911 thing to have...
[06:10.320 --> 06:11.290]  Yeah, exactly.
[06:11.440 --> 06:16.520]  911 has it set up for that because, uh, I don't know this for a hundred percent.
[06:16.540 --> 06:25.780]  I'm actually speculating, uh, on this, but I believe that 911 services use, uh, CPN instead of, uh, instead of, uh, a...
[06:25.780 --> 06:27.700]  Well, actually, let me get into A&I then.
[06:27.840 --> 06:30.770]  Well, you know, A&I, but A&I is primarily...
[06:31.500 --> 06:44.480]  Yeah, A&I, uh, is, uh, automatic number identification, also, but in the SS7 specifications, it's known as B-T-N, building telephone number, uh, or sometimes it's seen as C-N, charge number.
[06:44.940 --> 06:53.660]  And, uh, that, uh, what that is, is the number to which, uh, the billing number of the person calling.
[06:53.660 --> 06:57.420]  So, in other words, um, we're at, uh, Hotel Pennsylvania.
[06:57.850 --> 07:02.840]  There's a billion phones here, but probably only about 20, 30 outgoing phone lines.
[07:03.220 --> 07:08.580]  And so, um, what happens is, uh, and these phone lines...
[07:08.580 --> 07:09.880]  Well, no, not 20, 30, you know what I'm saying.
[07:10.170 --> 07:13.650]  Well, basically, there's outgoing phone lines, but each, uh...
[07:14.280 --> 07:16.720]  Actually, I don't know if you could reach individual rooms through extensions.
[07:17.060 --> 07:17.500]  Whatever.
[07:17.840 --> 07:20.170]  You have, uh, let's say a college, that's a better example.
[07:20.170 --> 07:21.100]  You have a college.
[07:21.280 --> 07:24.670]  It has about 4,000 phone numbers going into it.
[07:24.900 --> 07:32.040]  Uh, however, those phone numbers, uh, all are coming in on a PRI line.
[07:32.220 --> 07:35.170]  Does everybody here know what a PRI line is?
[07:35.350 --> 07:35.980]  C-1?
[07:36.290 --> 07:36.560]  Okay, good.
[07:36.880 --> 07:40.840]  So, basically, um, uh, so not...
[07:40.840 --> 07:48.840]  Uh, so the billing number that's going out and calls me an ad from that PRI line, from that C-1 line, uh, would be the same number.
[07:48.980 --> 07:50.290]  Because it's the same customer.
[07:50.610 --> 07:55.080]  However, the individual extensions are going out in the CPN field.
[07:55.230 --> 07:56.880]  It's, uh, calling party number field.
[07:57.340 --> 08:07.880]  So, uh, if I'm in a college and I'm calling from the, uh, admissions department to somebody outside, it's gonna send, uh, the billing telephone number.
[08:07.880 --> 08:13.520]  The, uh, it's gonna send it out as the, uh, billing number of the college.
[08:14.120 --> 08:20.660]  And the C-1, which, uh, charge, calling party number, is sent out as your extension.
[08:20.960 --> 08:23.290]  Which is basically, uh, the admissions office.
[08:23.820 --> 08:31.660]  So, 9-1-1, I believe, uses C-1 instead of A-N-I, or charge number, for the sole reason.
[08:32.220 --> 08:38.360]  That if you're on the college campus and you have an emergency, they don't want the, the billing telephone number.
[08:38.620 --> 08:43.650]  They don't care what the billing telephone number is because it could be, uh, campus could be a mile long.
[08:44.540 --> 08:47.100]  And it could be some, like, one building.
[08:47.420 --> 08:52.060]  The, the address they might have for it might be a building that's not where the emergency is happening.
[08:52.060 --> 09:00.740]  However, a logic would have it that the calling party number, uh, would be the number of the place where the emergency is happening.
[09:01.420 --> 09:12.700]  Because, on all those 4,000 phone numbers, uh, the billing, that are, the calls that are going out from all the 4,000 telephones they have, the billing telephone number is, is gonna be the same.
[09:13.200 --> 09:14.920]  Well, most likely it will be the same.
[09:15.120 --> 09:19.580]  But, uh, each individual phone will have its own, uh, C-P-N going out.
[09:20.200 --> 09:23.080]  It's a bit simplified, but usually that's probably the case.
[09:23.380 --> 09:34.900]  And that's why 9-1-1 uses, in my belief, uh, C-P-N because, uh, to use A-N-I would be, uh, would not help figure out who's calling.
[09:35.500 --> 09:50.760]  And that's why 9-1-1 are people, uh, C-L-I-R-O, calling line identification restriction override service, it's usually provided to emergency services because they're the ones who are actually needed to, uh, know who the hell is calling.
[09:51.760 --> 09:56.520]  Um, now on to, uh, caller ID spoofing.
[09:56.920 --> 10:03.680]  So before, um, people could always spoof caller ID if, uh, they had a P-R-I line or if they had direct switch access.
[10:04.100 --> 10:07.780]  Because then they could just modify the C-P-N, the outgoing C-P-N.
[10:08.340 --> 10:10.920]  Nowadays, we've got, uh, VoIP.
[10:11.140 --> 10:15.160]  And with VoIP it's so much easier because, uh, was there, sorry, do you want to ask a question?
[10:15.720 --> 10:16.980]  Or is there just stretching?
[10:17.600 --> 10:17.780]  Okay.
[10:19.640 --> 10:25.740]  So basically, um, now with, uh, VoIP, there's certain, uh, VoIP providers outgoing.
[10:26.180 --> 10:32.700]  Usually they're the, um, wholesale providers who allow the customer to set their own C-P-N.
[10:33.170 --> 10:38.540]  Sometimes, uh, they send a specific call, uh, ANI along with it.
[10:38.880 --> 10:40.880]  Other times, there's no ANI.
[10:41.000 --> 10:42.140]  That's an ANI fail.
[10:42.360 --> 10:43.240]  That's being passed.
[10:43.960 --> 10:53.900]  Um, so what people do is, uh, you just, uh, uh, you just, uh, use asterisk, use, uh, the, I think, IAX, uh, connection protocol.
[10:54.220 --> 10:57.000]  And then you just throw in the C-P-N.
[10:57.240 --> 10:58.520]  And that's what gets passed.
[10:58.840 --> 11:00.660]  So that's one way of spoofing caller ID.
[11:00.660 --> 11:04.860]  Which, a lot of people here are probably already familiar with that because it's been around for a while.
[11:05.860 --> 11:11.600]  The, um, the, uh, the other, there are other ways of spoofing caller ID.
[11:12.060 --> 11:20.200]  Which is basically, uh, you call up, uh, your AN, your ANI fail to an operator.
[11:20.820 --> 11:26.280]  What's ANI failing to an operator is basically, you plug up your local phone, your landline.
[11:26.860 --> 11:31.100]  Actually, with my C-Mobile account, I can actually reach your local operator by just pushing zero as well.
[11:31.860 --> 11:38.620]  And so, uh, you, uh, you dial zero and tell the operator that you're having problems selling a number.
[11:38.900 --> 11:44.080]  Uh, if it's a, you might want to call an 800 number for, like, a calling card system or whatever.
[11:45.800 --> 11:50.620]  Uh, so, call zero, you say, hello operator, I'm having problems selling a phone number.
[11:50.860 --> 11:54.080]  They'll ask you for the phone number, and you're like, 800, whatever.
[11:55.020 --> 11:58.060]  And they'll say, sorry sir, we don't allow you to dial 800 numbers.
[11:58.200 --> 12:00.280]  And then you cry, and it's a horrible mess.
[12:00.280 --> 12:03.340]  Um, and the, so what you say is, I'm special.
[12:03.860 --> 12:09.500]  Which implies that you're blind, or deaf, or have no arms, no legs, you're dead, I don't know.
[12:10.040 --> 12:13.540]  Uh, it happened to me once, no.
[12:14.040 --> 12:19.720]  Uh, the other way of saying is, um, I have operator privileges, which means the exact same thing.
[12:20.580 --> 12:25.160]  Uh, so you just say, hey, uh, operator, I have operator privileges, and would like a number dialed.
[12:25.380 --> 12:29.180]  Then they'll say what number, then you give them the 800 number, and they'll dial it for you.
[12:29.180 --> 12:41.360]  Now, the operator, again, a bit of speculation on my part, because I don't know things for sure, but, um, I believe they're usually located, uh, or a tandem switches.
[12:42.000 --> 12:49.060]  Uh, so, when they dial out, they're not calling from an end office, they're calling from, uh, a tandem office.
[12:49.300 --> 12:54.520]  So there's no ANI going out, because there's no, they're not calling out from an end point.
[12:54.520 --> 13:07.380]  A tandem office is, is, point A calls point B, and, uh, if the call needs to be, uh, to be rewrited to another switch, the in-between switch is called a tandem office.
[13:07.580 --> 13:18.380]  And there could be more than one, like, a call can go through about, I don't know, an infinite amount of, uh, tandem switches, because, uh, tandem stacking was supposedly popular in the old days.
[13:18.900 --> 13:22.360]  Which, basically, you just ran your calls to various tandem offices.
[13:22.740 --> 13:29.900]  So since the operator's placing a call from a tandem office, there's no ANI going out, because there's nothing to really bill it to.
[13:30.700 --> 13:43.780]  Uh, the, uh, companies that handle the call afterwards bill to the company number that's passed, and the, uh, the SS7 IAM field, uh, message, which is the initial address message.
[13:44.460 --> 13:51.660]  So what happens is basically, uh, when, uh, um, let's see, blah, blah, blah, blah.
[13:55.080 --> 14:03.320]  So when the, uh, operator calls out, there's no ANI, so you have no, uh, ANI being passed to whoever call you're calling.
[14:03.320 --> 14:04.760]  So you call an 800 number.
[14:05.060 --> 14:08.740]  So this 800 number, uh, let's say it's also a telephone company.
[14:08.960 --> 14:11.760]  And let's say it's 800-CALL-ATT.
[14:12.320 --> 14:22.280]  Now, 800-CALL-ATT will give you the billing rates by knowing, by looking at where you're calling from, and where you're calling to, and where you're calling to.
[14:22.720 --> 14:28.860]  And so what happens is basically you opt-avert by pushing zero, getting the operator to call the 800 number for you.
[14:29.280 --> 14:31.980]  And then, and you call 800-CALL-ATT.
[14:31.980 --> 14:36.560]  He called AT&T, sees you coming in from no number, basically.
[14:36.960 --> 14:39.800]  And they're like, sir, what number are you calling from?
[14:40.000 --> 14:43.780]  And you say, oh, yeah, I'm calling from, let's say you're in New York.
[14:43.840 --> 14:47.940]  You say the White House, whatever, 202, whatever the number is.
[14:48.140 --> 14:49.280]  I can't remember it anymore.
[14:50.000 --> 14:50.740]  I called it too much.
[14:53.500 --> 14:59.340]  So they put it into the system that you called from this number for billing purposes so they could give you your rate.
[14:59.720 --> 15:05.080]  However, it also changes the CPN to that number as well.
[15:07.120 --> 15:11.320]  So when they place a call for you, it now goes out with the number that you spooked.
[15:11.820 --> 15:14.960]  The downsides to that is, A, you've got to still pay.
[15:15.620 --> 15:19.140]  B, you can't freak people out with weird numbers.
[15:19.440 --> 15:28.220]  Like you can't get a call from 8008, like boobies written backwards and all the other crap.
[15:28.480 --> 15:33.940]  All the funny numbers that people do, like 411, 911, or like 0, whatever.
[15:34.940 --> 15:38.400]  So basically, that's the downside of this method.
[15:39.200 --> 15:44.560]  There were ways actually of committing toll fraud with this.
[15:44.920 --> 15:50.520]  Obviously, I'm ignoring the part about telling them that you're not calling from your own area, which is already toll fraud.
[15:50.660 --> 15:55.400]  But the other part of toll fraud is, what number are you calling from, sir?
[15:55.800 --> 15:56.440]  Blah, blah, blah, blah.
[15:56.720 --> 15:58.920]  And how would you like to pay for this call, sir?
[15:58.920 --> 16:00.520]  Oh, yeah, just spill it to this number.
[16:01.020 --> 16:04.440]  Like, that's a way, like, toll fraud to be committed.
[16:05.740 --> 16:09.520]  So obviously, if somebody's going to try this, don't commit toll fraud.
[16:10.440 --> 16:11.860]  And don't talk about it if you do.
[16:11.960 --> 16:17.040]  Yeah, don't talk about it at a public conference on a microphone in front of a bunch of people while you're being recorded.
[16:20.240 --> 16:22.540]  I never did this, though, so I'm safe.
[16:24.380 --> 16:32.460]  But yeah, with VoIP, with VoIP, you can, however, spoof all these speaking numbers.
[16:32.460 --> 16:37.100]  And you're not really committing toll fraud because there's no origin point anyway.
[16:37.500 --> 16:46.140]  Like, the billing rate is not done by where you're calling from, because you're calling from the Internet, which exists in, I think, Chicago.
[16:48.760 --> 16:49.700]  Nobody laughed at that.
[16:49.880 --> 16:50.040]  That's funny.
[16:52.980 --> 16:54.680]  So that's how you spoof caller ID.
[16:54.960 --> 16:59.360]  How you spoof ANI, which is different, and actually pretty close to what I just said.
[17:00.500 --> 17:05.160]  Because when you spoof CPN, the ANI has the capability of staying the same.
[17:06.060 --> 17:16.060]  Like, if you're in the PRI line and you spoof CPN, your billing telephone number will still remain the same number that you've been assigned to with the phone company.
[17:16.060 --> 17:30.340]  However, if you jump networks, like when we optiverted to an 800 number from, let's say, Verizon to, let's say, AT&T, now AT&T does not have your ANI.
[17:30.340 --> 17:36.320]  So the number she gave them is, I'm calling from this number, it gets put into the CPN field.
[17:36.560 --> 17:40.100]  The ANI field remains blank, usually.
[17:41.180 --> 17:51.230]  So when the terminating switch gets that initial address message, that's a 7 message, and sees, oh, look, it's this CPN, whatever.
[17:51.760 --> 17:54.120]  And look, there's no ANI listed whatsoever.
[17:54.800 --> 17:56.320]  Gee, what is it going to do?
[17:56.470 --> 17:59.190]  It's going to use the CPN as the ANI.
[17:59.530 --> 18:02.790]  Therefore, you spoofed ANI as well as CPN.
[18:02.790 --> 18:16.880]  In the old days, as far as an ANI spoofing, not quite an ANI spoofing, but as far as getting nothing, you're saying, it used to be, if you were in a crossbar switch, you were in common up until next year, that's over a year ago.
[18:16.880 --> 18:19.100]  You have to dial, let's say, .
[18:19.580 --> 18:24.010]  And as the call is going through, the certain point would close to a lash.
[18:24.250 --> 18:33.100]  This would very reliably, once you get your tracking right, drop you to a special operator, who will immediately stay here, special operator, but before you're calling from, please.
[18:33.400 --> 18:35.010]  Because it would pass the ANI...
[18:35.620 --> 18:36.380]  It would go about anything.
[18:36.560 --> 18:36.930]  If it would use
[18:49.000 --> 18:58.520]  data, if you have anything you want in that area, other than how to make up, they can kind of tell us if there's anything relatively local, we can give them ads.
[18:58.860 --> 19:00.120]  Sir, can you do the mic, please?
[19:01.080 --> 19:01.460]  Oh, sorry.
[19:01.920 --> 19:02.620]  Oh, I'll just...
[19:02.620 --> 19:02.660]  Oh, yeah.
[19:11.460 --> 19:15.060]  Actually, use this one, because you're going to get picked up on the video.
[19:16.300 --> 19:16.940]  Oh, what happened?
[19:17.780 --> 19:19.500]  Oh, okay, gotcha.
[19:20.040 --> 19:20.360]  All right.
[19:20.700 --> 19:24.800]  Basically, what I was discussing was, I'm an old school phreak, so I remember the old games.
[19:25.020 --> 19:26.040]  At least some of them, anyway.
[19:28.700 --> 19:35.620]  Now, basically, one of the things that was interesting was, if you were on a crossbar switch, and many people were for many years, you know.
[19:35.960 --> 19:36.360]  It's...
[19:36.360 --> 19:41.080]  My area that I'm still sort of in, probably one of the last ones went out over there.
[19:42.100 --> 19:42.500]  So...
[19:42.500 --> 19:44.480]  Some years ago, but it was one of the last ones to go out, I think.
[19:44.640 --> 19:44.780]  On dial?
[19:45.080 --> 19:45.760]  No, Brooklyn.
[19:45.980 --> 19:46.880]  All the way out at the end.
[19:47.100 --> 19:59.280]  No, but the point is, if you dialed, say, an operator, and you'd flash your hook switch at a certain point, as it was going through, it would momentarily disrupt the data flow.
[19:59.500 --> 20:01.840]  Because what was happening was, essentially...
[20:02.440 --> 20:03.220]  How did I put this?
[20:03.340 --> 20:05.000]  Well, basically, a relay would drop out.
[20:05.080 --> 20:06.540]  It would drop back in when you let go.
[20:06.760 --> 20:10.880]  But when it dropped out, that momentary period, the data was not being passed.
[20:11.240 --> 20:12.260]  So the operator...
[20:12.260 --> 20:15.880]  So it would abort in the middle, in the sense that you would not get the data.
[20:16.120 --> 20:19.920]  But then it would reroute to a special operator, because the data wasn't there.
[20:19.920 --> 20:24.860]  Now, at that point, she's looking at her display and getting either nothing or a set of full zeros.
[20:25.500 --> 20:27.240]  At that point, what you're going to get as a...
[20:27.700 --> 20:31.880]  Hang on, a special operator, what number you're calling from, please, or sir, or whatever.
[20:32.180 --> 20:36.000]  And at that point, you could give different data and play games for that.
[20:36.360 --> 20:38.360]  But at that point, there are things you could do with it.
[20:38.760 --> 20:41.400]  So that's sort of the old school issue with that one.
[20:41.680 --> 20:42.040]  Here you go.
[20:46.740 --> 20:48.580]  So do you have a crossbar switch at home?
[20:48.700 --> 20:49.320]  No, you can mess with it.
[20:49.460 --> 20:49.740]  No, I'm kidding.
[20:54.050 --> 21:04.190]  Actually, I think the reason why that works is the crossbar switch passes the ANI through MF signaling in the background.
[21:05.490 --> 21:11.010]  No, by signaling to a device, I don't remember the name of it, that sends it out over MF.
[21:11.170 --> 21:15.490]  So if you flash the line, it probably messes up that connection between the two devices.
[21:15.490 --> 21:17.030]  Well, that's probably where it stopped from.
[21:17.130 --> 21:19.290]  I would be probably corrected by the point where it was.
[21:19.450 --> 21:19.670]  Yeah.
[21:21.210 --> 21:21.850]  Um, so...
[21:23.610 --> 21:25.690]  Now, uh, the, um...
[21:25.690 --> 21:29.130]  Let's see, we covered the ANI, whatever, whatever, blah, blah, blah, blah, blah.
[21:29.890 --> 21:33.390]  So, uh, what else with the operators?
[21:34.010 --> 21:34.450]  Oh, yeah.
[21:34.530 --> 21:35.050]  Actually, screw that.
[21:35.150 --> 21:38.230]  Let's go into a new topic for now, until I remember what I was talking about before.
[21:38.230 --> 21:39.370]  No, I'm just kidding.
[21:39.790 --> 21:43.190]  Uh, basically, uh, ACD is automatic call distributors.
[21:43.810 --> 21:50.570]  And then if you go to, uh, 2600, I think it's spring of 92 or something issue.
[21:50.850 --> 22:01.090]  There's a thing about, um, calling, uh, an area code 555-1212, which is, you know, uh, the rough tree systems, the, uh, long number for it.
[22:01.090 --> 22:08.690]  And so, and as it's ringing, push down, I believe, the D tone on the silver box.
[22:08.930 --> 22:10.010]  Silver boxes...
[22:10.010 --> 22:11.710]  Everybody here know what a silver box is?
[22:12.770 --> 22:14.670]  Well, actually, I've seen a lot of people saying no.
[22:15.610 --> 22:17.790]  There's more colors than red and blue.
[22:20.110 --> 22:29.970]  So, basically, uh, a silver box is, if you ever look at a DTMF dial pad, um, diagram, it's a four by, it's a matrix of, uh, four by four.
[22:30.450 --> 22:39.290]  Which kind of, you make, so you start mentally thinking, like, one, two, three, blank, four, five, six, blank, seven, eight, nine, blank, star, zero, pound, blank.
[22:39.530 --> 22:41.030]  Like, what's with all the blanks?
[22:41.150 --> 22:42.110]  And I don't know myself.
[22:42.410 --> 22:51.510]  Um, so those blanks are the A, B, C, D, uh, numbers that are, uh, or used for the priority signaling in the old Autobahn system.
[22:52.170 --> 22:56.070]  Uh, the old military, uh, phone network that does not exist anymore.
[22:56.070 --> 23:00.990]  It's not released, been replaced by DSN Defense Switch Network, which there's two.
[23:01.270 --> 23:02.950]  It's DSN Red and DSN Black.
[23:03.370 --> 23:05.290]  One of them's classified, one of them's not.
[23:05.570 --> 23:07.430]  And they're all fun to play with.
[23:07.430 --> 23:10.070]  And they're the military, so don't play with it.
[23:11.650 --> 23:14.330]  But, but, like, know about it because it's fun to know about it.
[23:14.470 --> 23:21.050]  And because you can actually publicly call numbers in it without actually getting arrested because it's how you can reach people on a military base.
[23:21.770 --> 23:36.990]  Um, now, uh, so those, uh, uh, extra four keys, since they weren't just used for the Autobahn, since they were there basically for, from the beginning of DTMF, they, uh, they were used for other reasons.
[23:37.290 --> 23:51.010]  So this article pointed out that if you call a directory assistance number and, uh, and as it rang, you'd push, I believe, D, it would drop you to a special menu with, uh, various test numbers and whatever.
[23:51.490 --> 23:55.030]  However, the ACDs that I'm talking about are not the same thing.
[23:55.370 --> 24:01.150]  The ACDs, uh, there's a thing called the LERG, the Local Exchange Routing Guide.
[24:01.290 --> 24:04.590]  It's published by Telcordia, uh, and you can't buy it.
[24:05.010 --> 24:10.510]  I mean, like, big companies can buy it, but there's no way for an individual person to actually buy it.
[24:10.510 --> 24:14.230]  Like, I don't know why, I haven't, I haven't been able to find a website to buy it on.
[24:14.510 --> 24:17.990]  It probably has something to do with the fact that it costs, like, $30,000.
[24:18.450 --> 24:22.230]  Um, and so, I've tried buying it.
[24:22.390 --> 24:25.350]  I don't have $30,000, but I was trying to get a price code.
[24:25.650 --> 24:26.390]  They don't give it to you.
[24:26.570 --> 24:30.930]  They give you a sample LERG, which is basically, um, you can see how it's formatted.
[24:31.210 --> 24:37.430]  So if you're developing applications, you can easily figure out, like, hey, this field will have this, this field will have that.
[24:37.430 --> 24:39.650]  It's like a pull data, uh, off of it.
[24:39.770 --> 24:40.210]  It's a database.
[24:40.890 --> 24:42.510]  Um, and there's various files.
[24:42.970 --> 24:47.250]  Oh, and, uh, people forget, um, please turn off your cell phones, because, uh, I forgot to turn off mine.
[24:54.440 --> 24:57.860]  See, um, that's actually, it was a joke I just played on you guys.
[24:58.100 --> 24:58.940]  Uh, it didn't really ring.
[24:59.140 --> 25:02.100]  You all heard, uh, a lad busting in your ears for no reason whatsoever.
[25:02.820 --> 25:04.600]  Um, so basically, uh,
[25:07.800 --> 25:09.500]  the LERG has, uh, various files.
[25:09.680 --> 25:10.860]  I believe eight files.
[25:10.860 --> 25:14.520]  One of them's called LERG 06, I think, dash odd.
[25:14.720 --> 25:17.140]  And that's the oddball number.
[25:17.400 --> 25:25.380]  The LERG lists all the possible, all the exchanges currently existing in, um, in the phone, in the, in the NAPA system.
[25:25.520 --> 25:28.680]  North American numbering plan administration system.
[25:28.920 --> 25:33.240]  So, uh, that, I believe, includes Canada as well as North America.
[25:33.240 --> 25:35.760]  I'm just making fun of Canada right now.
[25:36.300 --> 25:39.020]  Uh, and, uh, basically it includes all the exchanges.
[25:39.540 --> 25:41.940]  Now, um, there's a bunch of weird exchanges.
[25:42.220 --> 25:47.060]  Because normally we need a number like 212, uh, 234, whatever.
[25:47.060 --> 25:52.060]  Like, why does the exchange, which is the number actually, the, the three numbers actually, the area code.
[25:52.260 --> 25:54.340]  Why does it never start with a 1 or 0?
[25:54.880 --> 25:58.800]  And we all know because with, uh, uh, with, uh, seven-digit dialing.
[25:58.940 --> 26:04.860]  If you dial 0, uh, you'll go to the operator and if you dial 1, it'll think you're dialing a long distance number.
[26:05.280 --> 26:15.500]  However, uh, the other reason for that is because, uh, various, um, networks, uh, what do you call it?
[26:15.500 --> 26:23.260]  So, uh, various, uh, networks use the, uh, 0 and, uh, use actual exchanges that start with 0 and the 1 for special routing purposes.
[26:23.500 --> 26:24.960]  And you can actually access that.
[26:25.100 --> 26:28.520]  And I'll mention that after the, um, um, N-words thing.
[26:28.720 --> 26:32.200]  I mean, the, um, the, uh, automatic call distributors.
[26:32.700 --> 26:37.600]  Now, uh, automatic call distributors, there are various exchanges that are listed in the LERG.
[26:38.260 --> 26:41.300]  And the LERG, one of the fields in the LERG is switch type.
[26:41.800 --> 26:50.540]  And so switch type, you usually see 5ESS, uh, you know, DMS-100, uh, a guy with a bunch of cans and strings in his basement.
[26:51.240 --> 26:56.120]  And, uh, and so then you, uh, find one that's labeled automatic call distributor.
[26:56.120 --> 26:57.380]  And you're like, huh, that's weird.
[26:57.380 --> 26:58.900]  I thought they weren't used anymore.
[26:59.380 --> 27:02.300]  And you see now, and it's usually stuff like 212-555.
[27:03.080 --> 27:04.320]  And you're like, oh, that's kind of obvious.
[27:04.660 --> 27:05.640]  And that's what it is.
[27:06.060 --> 27:06.440]  No, I'm kidding.
[27:06.440 --> 27:08.260]  Uh, and there's more numbers.
[27:08.560 --> 27:10.380]  Uh, there's one in, uh, Colorado.
[27:10.380 --> 27:11.560]  I don't remember the exchange.
[27:11.600 --> 27:15.280]  If you find me after the talk, I can probably give you a list of them.
[27:15.880 --> 27:17.140]  Because I can easily pull them up.
[27:17.260 --> 27:18.020]  Because I'm psychic.
[27:18.560 --> 27:21.920]  Uh, but, uh, it's a normal exchange.
[27:22.200 --> 27:23.580]  It's not like a zero or one exchange.
[27:23.700 --> 27:24.480]  It's not a 555.
[27:24.600 --> 27:28.080]  It's just like the Colorado area code, which I can't remember.
[27:28.380 --> 27:29.140]  208 or something.
[27:30.200 --> 27:30.620]  303?
[27:30.800 --> 27:30.800]  303?
[27:31.220 --> 27:32.160]  Maybe, maybe.
[27:32.160 --> 27:38.300]  It's, and it's, what it does, it goes to a Quest, uh, Quest, uh, a medical distributor.
[27:38.620 --> 27:46.040]  And what that is, basically, Dell, the numbers in that exchange, like, whatever the NPA, whatever the exchange.
[27:46.480 --> 27:47.720]  Let's say 001.
[27:47.980 --> 27:50.560]  And you get their local operator.
[27:50.780 --> 27:53.620]  A local operator from some specific city in Colorado.
[27:54.860 --> 28:00.020]  Then, uh, you call the number, instead of 0001, you call 0002.
[28:00.340 --> 28:03.800]  And you don't get, uh, a local operator now in, uh, Colorado.
[28:04.160 --> 28:07.400]  Now you get a local operator for, uh, Utah.
[28:08.100 --> 28:10.800]  And the next number gives you a local operator for some other place.
[28:10.800 --> 28:14.680]  And these operators are all freaked out because they have no idea where you're coming in from.
[28:14.820 --> 28:17.740]  Because there's no, uh, fields being passed to them.
[28:17.860 --> 28:20.960]  Like, uh, they can't see your ANI.
[28:21.060 --> 28:22.020]  They can't see your CPN.
[28:22.720 --> 28:25.740]  Uh, you know, so they have no idea what's going on.
[28:25.980 --> 28:29.180]  You can joke around and say, hey, I'm a, I'm a technician.
[28:29.180 --> 28:30.400]  I'm just doing tests.
[28:30.560 --> 28:34.100]  Can you, uh, do something really stupid that you're not supposed to do?
[28:34.100 --> 28:35.540]  And they'll do it.
[28:35.860 --> 28:38.240]  But that's a bug in humanity.
[28:38.920 --> 28:47.860]  Uh, so, uh, so what happens is basically that, um, uh, these things are there.
[28:48.100 --> 28:49.020]  They exist.
[28:49.240 --> 28:50.280]  They're easy to reach.
[28:50.460 --> 28:52.260]  And they're illogical.
[28:52.260 --> 28:58.280]  Because if you think about it, there's not much of a reason that you need these things.
[28:59.140 --> 29:01.560]  Uh, there's one, Hawaii Telecom has one.
[29:01.560 --> 29:04.100]  And, uh, it always freaks people out.
[29:04.280 --> 29:09.080]  Because the first number you call, 0001, I think, is actually the 911 system.
[29:09.360 --> 29:12.420]  And when you hear 911 operator, like, oh, whoops, sorry.
[29:12.780 --> 29:15.520]  Look, because, like, you don't want to mess with 911.
[29:15.840 --> 29:18.560]  Because, uh, you know, it's emergency people.
[29:19.000 --> 29:23.520]  Uh, but, uh, like, so in other words, it makes no sense that those numbers exist.
[29:23.580 --> 29:30.920]  Because you can reach so many different internal, external, uh, numbers in a telephone company.
[29:30.920 --> 29:35.940]  And they pass no information to the operator.
[29:36.160 --> 29:38.800]  So they're all very confused and they hate their lives.
[29:39.360 --> 29:41.780]  Um, now, uh, now in words.
[29:42.020 --> 29:43.740]  So, and other interesting stuff.
[29:43.980 --> 29:48.260]  So, as I was saying before, no exchanges start with a zero or a one.
[29:48.720 --> 29:50.980]  Because the phone company hates those two numbers.
[29:51.160 --> 29:52.300]  Because they're not into binary.
[29:52.560 --> 29:54.020]  They're more like hexadecimal.
[29:54.020 --> 30:01.200]  Uh, but, uh, so the LERG lists, uh, forget the file name.
[30:02.240 --> 30:03.160]  Let me look it up.
[30:03.340 --> 30:05.000]  I'll go home and come back in a few seconds.
[30:05.520 --> 30:10.040]  Um, uh, it lists exchanges that start with a zero or a one.
[30:10.420 --> 30:11.440]  And the uses.
[30:12.140 --> 30:13.660]  And obviously I don't have a LERG.
[30:13.740 --> 30:17.720]  If you have a copy, please, um, uh, let me share it.
[30:17.980 --> 30:19.220]  Or let me have it.
[30:19.440 --> 30:20.540]  If you don't, no problem.
[30:20.540 --> 30:24.300]  Um, basically there's a file that has all the, uh, these exchanges.
[30:25.100 --> 30:30.560]  And these exchanges provide you access to various internal phone company stuff.
[30:31.180 --> 30:31.900]  And words operators.
[30:32.220 --> 30:33.400]  What are, and words operators.
[30:33.680 --> 30:34.880]  Most people probably here won't know.
[30:35.140 --> 30:36.140]  Most people not all.
[30:36.320 --> 30:37.500]  Because, um, I don't know.
[30:37.660 --> 30:40.120]  Like, I couldn't find any information about it when I was Googling for it.
[30:40.860 --> 30:44.380]  However, and words operators are, I work for Verizon.
[30:44.840 --> 30:49.440]  You work, I guess, we'll use AT&C again as a great example.
[30:49.440 --> 30:51.360]  Because it's three letters and easy to remember.
[30:52.100 --> 30:54.260]  Uh, so I'm a Verizon operator.
[30:54.520 --> 31:00.760]  And I'm calling, uh, a local area that used to be in, uh, SPC territory that's now owned by AT&T.
[31:01.140 --> 31:05.760]  And I'm worried about, uh, my relative because, uh, her phone's always busy.
[31:06.040 --> 31:09.600]  Like, and it's my grandma and, you know, maybe she fell or whatever.
[31:10.060 --> 31:11.680]  So, like, I'm worried.
[31:11.680 --> 31:18.400]  So, I want to find out if she actually is just, like, uh, a party liner or, you know, or if I, or if she's just actually injured or whatever.
[31:18.760 --> 31:20.160]  So, I called my local operator.
[31:20.380 --> 31:23.920]  I'm like, I'd like to do a busy line interrupt on this floor of the number or whatever.
[31:23.920 --> 31:27.740]  And, um, and, uh, so the operator's like, okay.
[31:28.200 --> 31:29.040]  But she's Verizon.
[31:29.240 --> 31:31.880]  She has no access to AT&T's, uh, system.
[31:32.460 --> 31:38.580]  So, she, she looks up in her, uh, little page of, like, she looks up the phone number I gave her.
[31:39.200 --> 31:45.280]  Finds, uh, the, uh, the, uh, the letter code for the exchange that serves that area.
[31:45.580 --> 31:46.820]  It's, it's the zero or one.
[31:47.060 --> 31:48.220]  It's a tandem code.
[31:48.380 --> 31:50.200]  It's a code for a tandem search in that area.
[31:51.000 --> 31:52.240]  So, she finds it.
[31:52.360 --> 31:54.580]  So, let's say it's, oh, God, I don't know any Florida numbers.
[31:55.080 --> 31:56.680]  So, I'll make up an area code.
[31:56.880 --> 31:57.320]  Oh, no, no, no.
[31:57.360 --> 31:59.340]  I know one because, uh, uh, sure, sure.
[31:59.340 --> 32:04.060]  Three, two, one, uh, uh, two, three, four, whatever.
[32:04.360 --> 32:11.860]  So, she looks up and she's like, oh, yeah, the three, two, one, two, three, four is served by the tandem, uh, zero, zero, one.
[32:12.320 --> 32:21.060]  So, so, so she calls three, two, one, zero, zero, one, and then the operator's service code, which can last anywhere from, I think, two to, uh, ten digits.
[32:21.060 --> 32:28.720]  And the operator service code tells the tandem to which operator service to connect the call to.
[32:29.640 --> 32:32.480]  In this case, the operator is looking for an inwards operator.
[32:33.080 --> 32:40.300]  An inwards operator is an operator who helps out other operators from outside the company.
[32:40.860 --> 32:44.480]  So this AT&C inwards op picks up and says AT&C inwards, how may I help you?
[32:45.060 --> 32:49.940]  And a Verizon operator is like, hello, this is whatever, Becky from Verizon.
[32:49.940 --> 32:55.100]  I have a customer on the line who likes to do a busy line verification on this phone number.
[32:55.380 --> 32:55.820]  Blah, blah, blah, blah.
[32:57.120 --> 33:00.200]  So the AT&T ops is like, yeah, yeah, whatever, okay, cool.
[33:00.420 --> 33:01.320]  I'll do it right now.
[33:02.540 --> 33:06.660]  And then you ram as a party liner and then you kill yourself and you're like, no.
[33:07.140 --> 33:15.320]  Anyway, but yeah, like, and that's a Verizon ops can do a busy line verification on AT&T's network through inwards.
[33:15.500 --> 33:18.580]  Because inwards is an operator for operators.
[33:18.580 --> 33:22.280]  That's the definition you find in Google, but nobody explains the other part.
[33:22.680 --> 33:24.300]  So you're like, what?
[33:25.680 --> 33:28.520]  And so you can reach that through these ACDs.
[33:28.640 --> 33:35.140]  And there's, I believe, 10 numbers, 20 numbers, I found, that are actual ACDs.
[33:35.220 --> 33:38.420]  That are not like 2 and 2, 5, 5, 5 numbers, but actual exchanges.
[33:38.420 --> 33:43.120]  And, oh, no, I'm sorry, that's not ACDs.
[33:43.240 --> 33:43.440]  Wow.
[33:43.660 --> 33:44.020]  Brain fart.
[33:45.400 --> 33:52.160]  These inwards ops, I'm not, these exchanges that serve with a 0 or 1 are published in the LERG.
[33:52.480 --> 33:53.520]  You can reach them.
[33:53.840 --> 33:59.440]  I can't tell you the specifics, because I'm not the guy who found out about this, so I'm not going to tell you the very specifics.
[33:59.440 --> 34:03.100]  Basically, you have to figure out how to write your call.
[34:03.540 --> 34:10.260]  And you can write your call through operators by saying, hey, you know, hello operator, I'd like to have a number dialed.
[34:10.440 --> 34:17.040]  And you can actually convince them to dial a number that's not allowed, like 212, let's say 001, whatever.
[34:18.280 --> 34:19.500]  You can convince them.
[34:19.620 --> 34:20.180]  It works.
[34:20.420 --> 34:26.640]  If you're scanning for these special exchanges, for operator service codes, you're not going to find them.
[34:29.860 --> 34:34.400]  I think the exchange in that situation is called the tandem access code or something.
[34:34.800 --> 34:35.140]  It's not...
[34:35.880 --> 34:39.400]  Anybody know what I mean by exchange and NPA here?
[34:39.820 --> 34:41.120]  Or are you all blank?
[34:41.680 --> 34:43.160]  I am seeing blank faces.
[34:43.500 --> 34:43.620]  Okay.
[34:44.040 --> 34:44.840]  You got a phone number.
[34:44.840 --> 34:47.420]  Again, 212-555-1212.
[34:47.680 --> 34:50.440]  So, 212, that's the area code.
[34:50.860 --> 34:54.000]  However, obviously, telephone companies love acronyms.
[34:54.180 --> 34:55.680]  So, for them, it's the NPA.
[34:56.140 --> 34:57.980]  Numbering plan account or something.
[34:58.300 --> 34:58.740]  What's the...
[34:58.740 --> 34:59.140]  Numbering plan area.
[34:59.380 --> 35:01.020]  Oh, numbering plan area, thanks.
[35:01.680 --> 35:03.840]  The next three digits is the exchange.
[35:04.220 --> 35:04.840]  It tells...
[35:06.120 --> 35:07.840]  A telephone switch can have...
[35:08.620 --> 35:13.320]  The exchange basically tells the routing people, routing...
[35:13.320 --> 35:17.360]  The switch that handles you to what switch you're going to.
[35:18.880 --> 35:22.860]  A telephone switch can have multiple...
[35:22.860 --> 35:25.460]  One telephone switch can be serving multiple exchanges.
[35:25.860 --> 35:30.960]  However, one exchange cannot be in multiple switches.
[35:30.960 --> 35:36.600]  So, 212, 234 can be on two separate switches.
[35:36.940 --> 35:42.020]  However, one switch can hold 212, 234, 235, 236, whatever.
[35:42.820 --> 35:47.800]  There's services online where you can look up what switch services your extension.
[35:47.800 --> 35:49.860]  In New York, it's easy.
[35:50.760 --> 35:54.380]  Because most switches that are Verizon owned, let's say...
[35:54.380 --> 35:55.680]  What's a good one?
[35:57.340 --> 36:00.900]  718-996-9901.
[36:01.040 --> 36:07.140]  Dialing 9901 as the suffix will give you the switch information.
[36:08.280 --> 36:14.660]  In this case, so you got the 718, that's the NPA, the area code.
[36:15.940 --> 36:18.660]  996, that's the exchange, which is basically the switch.
[36:20.040 --> 36:21.840]  But those three numbers are called the exchange.
[36:22.020 --> 36:23.460]  That's all you need to know right now.
[36:23.880 --> 36:25.600]  And the last numbers are called the suffix.
[36:26.960 --> 36:30.800]  And so, you'll hear a voice recording going, you know, you've reached the whatever, whatever, whatever.
[36:32.080 --> 36:34.680]  DS0 or DMS or ESS.
[36:35.840 --> 36:40.360]  DS0 being if there's more than one switch in the central office, it tells you which one.
[36:40.360 --> 36:46.280]  And that'll identify which exchanges are being served by the switch in the Verizon area in New York.
[36:47.500 --> 36:48.220]  That's that.
[36:49.740 --> 36:50.240]  So...
[36:50.240 --> 36:51.340]  Which time does that?
[36:51.520 --> 36:52.000]  What can I go into?
[36:52.220 --> 36:52.420]  Perfect.
[36:53.080 --> 36:53.180]  Okay.
[36:54.020 --> 36:54.520]  So...
[36:54.520 --> 36:55.840]  I need water.
[37:01.210 --> 37:01.710]  Notes.
[37:04.010 --> 37:05.950]  Oh, wow, I didn't cover that as well.
[37:05.950 --> 37:08.010]  So, yeah, basically...
[37:10.050 --> 37:12.130]  Exchange, whatever, whatever, NWRDS.
[37:12.970 --> 37:14.370]  Yeah, so NWRDS, oh yeah.
[37:14.710 --> 37:17.230]  So, you can use an operator to call NWRDS.
[37:17.510 --> 37:20.490]  I call NWRDS, but there's more services than just NWRDS.
[37:20.970 --> 37:23.010]  And there's other ways to write calls.
[37:24.270 --> 37:26.150]  Let's say you call 800-CALL-ATT.
[37:27.130 --> 37:29.830]  That means you can now dial out from AT&T's network.
[37:29.990 --> 37:35.190]  And it's up to AT&T themselves to block you from dialing out the special codes.
[37:35.190 --> 37:49.310]  And I think the name for the blocking, so you can't call zero and one exchanges within a cell phone network, is called D-digit blocking.
[37:49.630 --> 37:54.850]  Because an area code is three digits, and then the fourth digit would be the zero or one.
[37:55.470 --> 37:57.810]  So, it would be the first digit of the exchange.
[37:58.110 --> 38:01.250]  So, it blocks that from being a zero or a one.
[38:01.250 --> 38:11.450]  And that's why when you call, when you have seven-digit dialing, and you call zero or one, zero will give you to an operator, or one will give you to a...
[38:13.470 --> 38:15.650]  makes the switch know that you're making a long-distance call.
[38:15.870 --> 38:22.430]  Because if it didn't, it'd be routed to all these weird internal telephone company numbers, and everything will burn down, and we will all die.
[38:24.030 --> 38:24.610]  Okay.
[38:25.010 --> 38:29.990]  Now, let me get into something else that's interesting, hopefully, to you.
[38:30.550 --> 38:31.130]  Telephones.
[38:32.710 --> 38:33.990]  Okay, that was a big pause.
[38:35.390 --> 38:36.490]  Payphones, specifically.
[38:36.990 --> 38:38.930]  Specifically, Verizon's payphones.
[38:39.190 --> 38:41.830]  And I love the word specifically, because I'm about to say specifically next.
[38:42.250 --> 38:44.330]  Specifically, the Verizon hybrid payphones.
[38:45.930 --> 38:48.070]  Most people here, hopefully, know what COCOTs are.
[38:48.530 --> 38:48.630]  Yes?
[38:48.810 --> 38:49.010]  Who knows?
[38:49.130 --> 38:49.690]  Raise your hands.
[38:49.910 --> 38:50.850]  Have some exercise.
[38:51.490 --> 38:52.970]  Mmm, half the crowd.
[38:54.110 --> 38:57.670]  Basically, COCOTs are customer-owned, coin-operated telephones.
[38:57.950 --> 39:05.910]  In other words, you go to a deli, you walk inside, there's a payphone there, and you realize that, hey, that's not a normal telephone company payphone.
[39:07.250 --> 39:10.070]  That's a payphone that's probably owned by the deli.
[39:10.350 --> 39:17.270]  The lines provided by the deli probably, then that means it's a COCOT, because it's owned by the customer, not by the telephone company.
[39:17.990 --> 39:21.530]  Telephone company payphones are called BOCOTs.
[39:22.130 --> 39:25.870]  Bell-owned, coin-operated telephones.
[39:26.470 --> 39:28.770]  So-called, because they're owned by the telephone company.
[39:28.770 --> 39:31.390]  That's the bell reference and whatever.
[39:31.530 --> 39:33.350]  And the coin operated, that's the bowl cut part.
[39:34.310 --> 39:47.610]  Now, the bowl cuts, the way they're designed is since they're on a customer's line, the customer can have the phone company provision the line to have as a payphone.
[39:48.170 --> 39:58.010]  So, basically, you can use DC switching, which is, you know, electrical switching, to figure out if coins have been put in.
[39:58.010 --> 40:02.730]  However, most bowl cuts are in the normal phone line.
[40:03.510 --> 40:08.130]  Everything is controlled by the actual payphone itself.
[40:08.510 --> 40:14.790]  In other words, if you ignore the payphone and clip onto the line, you're in the normal phone line and you can do whatever you want.
[40:16.510 --> 40:22.670]  Now, bowl cuts, before, were just normal phones, basically.
[40:22.890 --> 40:24.470]  I mean, not normal phones, because they took coins.
[40:24.470 --> 40:28.870]  But, if you clipped onto the line itself, you could not die loud.
[40:29.430 --> 40:33.470]  Like, they would use various signaling, advanced signaling, red boxing, basically.
[40:33.890 --> 40:43.970]  DC signaling, which is war games, you know, stick a paper clip into a phone, and nukes get launched?
[40:44.390 --> 40:44.470]  No.
[40:45.290 --> 40:52.190]  So, basically, that's DC signaling, and the act system by AT&T for long distance.
[40:52.390 --> 40:53.510]  That's how it was in the older days.
[40:54.030 --> 40:55.870]  So, what did AT&T do in the year 2000?
[40:56.070 --> 41:00.730]  They stopped at, so you couldn't use, you know, red boxing to call long distance.
[41:02.450 --> 41:08.350]  But, Verizon, which wasn't Verizon at the time, it was NYNEX, was planning, actually, for this.
[41:08.570 --> 41:11.370]  And, in 96, you could find a memo, I think?
[41:11.430 --> 41:11.870]  Not a memo.
[41:12.030 --> 41:16.370]  It's a press release from NYNEX, about Alcatel.
[41:16.870 --> 41:18.630]  Alcatel used to make payphones back then.
[41:18.830 --> 41:20.490]  Now, they're, I believe, Qualtech?
[41:20.810 --> 41:21.210]  Qualcomm?
[41:21.850 --> 41:22.250]  Qualtech?
[41:22.650 --> 41:23.330]  It's just with a Q.
[41:23.510 --> 41:24.210]  That's all we need to know.
[41:25.270 --> 41:29.930]  And so, basically, they started making payphones with firmware in it.
[41:30.510 --> 41:41.970]  At Beyond HOPE, in 97, like, there were rumors going around about how Sony saw a payphone technician plug what looked like a laptop directly into the phone.
[41:42.250 --> 41:44.290]  And, like, nobody knew what the hell that was about.
[41:44.290 --> 41:53.510]  But, now we know that's the Alcatel people replacing normal bulkheads, which were just dumb payphones, with payphones with firmware capabilities.
[41:53.510 --> 42:08.450]  What would be, in other words, your local COCOT, your local customer-owned telephone, the one that everything is done within the payphone itself, and nothing is done in the line, that's the Verizon payphones you see outside in this area, for example.
[42:08.810 --> 42:10.130]  They actually have firmware.
[42:10.530 --> 42:15.870]  However, things are still done with the line.
[42:15.870 --> 42:24.970]  And so, the firmware remained quiet for about four years, until AT&T stopped using Axe.
[42:24.970 --> 42:26.590]  Does everyone here know what Axe is?
[42:27.450 --> 42:31.190]  If no, just go back and watch Phreaking 101 from The Lasso.
[42:33.350 --> 42:52.210]  Basically, it used tones to signal, if you put cash into a payphone, payphone would play tones down the line, and the switch would know that, hey, this guy put in cash, or if it was long distance, the long distance cell phone company would be like, oh yeah,
[42:52.270 --> 42:53.630]  there's money in the payphone.
[42:54.610 --> 43:00.150]  So, and you can obviously play the tones, and make phone calls, and that's red boxing.
[43:00.690 --> 43:04.690]  Now, so, 2018-C gets rid of Axe.
[43:04.710 --> 43:09.090]  Now, you can't make long distance cell phone calls with payphones, Verizon payphones.
[43:10.070 --> 43:12.090]  So, how does Verizon get around this?
[43:12.710 --> 43:13.790]  They put in the firmware.
[43:15.310 --> 43:19.210]  They change the way that payphones handle calls.
[43:19.510 --> 43:23.810]  So, now, if you pick up a payphone, a Verizon payphone, you hear dial tone.
[43:24.370 --> 43:25.790]  That's not a real dial tone.
[43:26.010 --> 43:27.130]  That's a fake dial tone.
[43:27.730 --> 43:28.770]  How do I know this?
[43:28.950 --> 43:29.630]  I'm psychic.
[43:30.550 --> 43:33.310]  You click onto the line, and you start dialing a number.
[43:34.210 --> 43:37.570]  And you listen on the payphone, and you listen on your butt set.
[43:37.790 --> 43:39.450]  And you're not hearing the same thing.
[43:39.650 --> 43:43.650]  On the telephone, you hear beep, beep, beep, beep, beep.
[43:43.910 --> 43:44.670]  You know, as you're dialing.
[43:44.870 --> 43:46.990]  I can't do TTM of my voice, I'm sorry.
[43:47.830 --> 43:50.830]  On the butt set, you hear ring.
[43:52.610 --> 43:55.250]  And you're like, how does that happen?
[43:55.510 --> 43:59.350]  Because the payphone, the Verizon payphone, is giving you a fake dial tone.
[43:59.570 --> 44:01.670]  And why is it giving you a fake dial tone?
[44:01.890 --> 44:03.210]  To find out what you're dialing.
[44:03.210 --> 44:05.690]  So we can figure out if it's a local call.
[44:06.430 --> 44:09.410]  If it's a local call that's within the switch.
[44:09.830 --> 44:12.390]  If it's a local call that's outside of the switch.
[44:13.250 --> 44:19.910]  Or if it's a call that's outside of the LATA, local access toll area.
[44:21.430 --> 44:23.850]  Which basically means a lot of distance phone call.
[44:24.930 --> 44:31.070]  And it listens to that to know how to control the signaling that you put cash in.
[44:31.290 --> 44:35.390]  If you're calling within the switch, you have a direct connection to the telephone switch.
[44:35.590 --> 44:39.370]  Using the cable, I mean the phone line.
[44:39.910 --> 44:41.930]  So it does tip ring signaling.
[44:42.230 --> 44:45.310]  Which you can look up by yourself because I'm out of water.
[44:45.930 --> 44:48.470]  To signal that you put cash in.
[44:48.670 --> 44:52.930]  Push cash in, it grounds I think the tip for two seconds in the ring.
[44:53.330 --> 44:56.350]  And the switch goes like, oh, this guy put cash in.
[44:56.750 --> 45:02.550]  That's why if you call 411 in New York City, they'll say, did you put cash in sir?
[45:02.590 --> 45:03.370]  And you're like, yeah I did.
[45:03.550 --> 45:04.850]  And they're like, no you didn't.
[45:06.410 --> 45:08.990]  Because they can actually see you putting the coins in.
[45:09.150 --> 45:11.950]  Because they have a display that tells you how much cash you put in.
[45:12.590 --> 45:16.970]  And if the phone line is not rounded properly, their display will fluctuate.
[45:17.090 --> 45:19.210]  And be like, oh I see you put in 10 cents.
[45:19.350 --> 45:20.690]  I mean 40, I mean 3.
[45:20.690 --> 45:23.410]  And they'll freak out.
[45:23.690 --> 45:25.110]  And they'll put a call for you anyway.
[45:25.830 --> 45:26.870]  Because they're nice people.
[45:28.310 --> 45:31.170]  Now, so basically whatever, whatever, whatever, whatever, whatever.
[45:31.330 --> 45:31.510]  Oh yeah.
[45:31.990 --> 45:33.130]  So now outside of the switch.
[45:33.730 --> 45:36.630]  Since you're placing a phone call outside of the switch.
[45:37.830 --> 45:41.030]  It's not going to use your switch place to call.
[45:41.370 --> 45:43.350]  I mean it will, but it will go to a tandem switch.
[45:44.070 --> 45:46.370]  So for telephones, I'm going for that.
[45:47.650 --> 45:49.890]  And it's still going to be in the Verizon area.
[45:50.130 --> 45:51.090]  So what does it do?
[45:51.570 --> 45:52.630]  It uses act.
[45:52.630 --> 45:55.650]  So if you actually hook up a buttset to the line.
[45:55.890 --> 45:58.130]  And you put in cash to the pay phone.
[45:58.510 --> 46:02.210]  And you call an area that's not served by your switch.
[46:02.350 --> 46:04.690]  The switch that serves the pay phone.
[46:04.970 --> 46:09.390]  But in an area, let's say, you're in East Manhattan.
[46:09.390 --> 46:10.350]  You call West Manhattan.
[46:11.270 --> 46:14.130]  You'll hear the phone, pay phone, red box.
[46:14.450 --> 46:16.790]  You'll actually hear it go beep, beep, beep, beep.
[46:16.790 --> 46:17.250]  Beep, beep, beep, beep.
[46:17.470 --> 46:18.270]  You're like, ha ha.
[46:18.470 --> 46:19.410]  I thought it was illegal.
[46:21.170 --> 46:23.070]  Actually, I'm giving it a bit too much credit.
[46:23.310 --> 46:25.510]  The phone does that no matter what call you do.
[46:25.950 --> 46:31.690]  Like if you put coins in as you are, even if you're making a local call, it will always red box down the line.
[46:31.910 --> 46:32.530]  No matter what.
[46:33.010 --> 46:38.110]  Now if you make a long distance phone call on the other hand, that's different.
[46:40.050 --> 46:47.470]  In New York it works because the firmware does something weird.
[46:47.750 --> 46:49.410]  I'm not too familiar with that part yet.
[46:49.650 --> 46:50.930]  That hasn't been figured out yet.
[46:51.150 --> 47:02.510]  However, if you go to New Jersey, for example, and you make a long distance phone call with a Verizon pay phone, you'll get a reorder because there's no long distance service on those pay phones and they won't give you your money back.
[47:02.990 --> 47:04.490]  And that's how they make their money.
[47:05.150 --> 47:07.930]  Now, the firmware, there's other cool stuff.
[47:08.990 --> 47:10.650]  Like you've got to fake dial tone.
[47:10.790 --> 47:11.850]  That means it's a prompt.
[47:12.010 --> 47:12.730]  It's not a dial tone.
[47:12.810 --> 47:13.330]  It's a prompt.
[47:13.750 --> 47:18.110]  So how we found this all out is we started seeing the Verizon pay phones.
[47:18.290 --> 47:28.770]  They suddenly got the Phone 1 logo on the handset because Phone 1 was the VoIP company that was paid to handle long distance phone calls for Verizon.
[47:31.150 --> 47:37.830]  And there's a little sign, well, 2, 1, and you're like, why is this woman so slow?
[47:38.210 --> 47:43.550]  Because that's Gemini 2, the slower, older version of Gemini.
[47:46.390 --> 47:50.410]  And this caused a lot of confusion before because we couldn't figure out why the woman's voice was slow.
[47:50.410 --> 47:53.410]  There's two versions of Gemini currently out there.
[47:53.850 --> 47:57.250]  Gemini is the system that was developed by Elkotel back in 96.
[47:57.650 --> 48:05.090]  So the 96 Beyond HOPE rumor came out last year when we realized, holy crap, this is all related together.
[48:06.170 --> 48:12.350]  And the Gemini Calling Center is a calling center for Gemini support for the Verizon pay phone technicians.
[48:12.350 --> 48:14.690]  And that's what a pound coin is.
[48:15.230 --> 48:20.030]  And now there's another number called pound fill.
[48:20.390 --> 48:22.650]  And that's their test number.
[48:23.050 --> 48:26.250]  There's also other test numbers like pound, I don't know, test.
[48:26.830 --> 48:27.950]  It's a coin test.
[48:28.090 --> 48:28.950]  It does not work properly.
[48:29.230 --> 48:32.790]  If Verizon hears this, please fix that because it took my 40 cents.
[48:33.610 --> 48:35.510]  It asks you to put in 40 cents.
[48:35.890 --> 48:37.070]  Why 40 cents?
[48:37.870 --> 48:41.530]  Nickel, dime, and a quarter equals 40 cents.
[48:41.530 --> 48:43.070]  Oh wow, I can do math.
[48:43.810 --> 48:47.790]  So basically, that's that, that's that, and that's that.
[48:47.970 --> 48:48.810]  So that's Gemini.
[48:49.390 --> 48:54.390]  So now their test number is pound fill.
[48:56.190 --> 48:58.510]  And pound fill is an Easter egg in it.
[48:58.670 --> 49:00.630]  Which is like...
[49:00.630 --> 49:03.990]  Like we see, we say telephone companies, we say government.
[49:04.550 --> 49:08.170]  But like, they're just abstract concepts because people work in it.
[49:08.170 --> 49:14.690]  And people are assholes and also great, great beings because they, you know, people are people.
[49:15.570 --> 49:16.690]  So, pound fill.
[50:04.410 --> 50:05.130]  I'm rich.
[50:13.830 --> 50:14.770]  What does it skip?
[50:19.900 --> 50:20.920]  What else does it skip?
[50:21.480 --> 50:23.780]  Press 9 for bring back test.
[50:23.980 --> 50:25.060]  So what happens if I push 5?
[50:28.460 --> 50:29.560]  Ah, that sucks.
[50:29.860 --> 50:30.340]  What about 8?
[50:30.440 --> 50:31.060]  Press 1.