{"video_id":"fp_vPx8M3rH9o","title":"Phone Phreaking Explained","channel":"Techquickie","show":"Techquickie","published_at":"2024-10-22T20:15:00.078Z","duration_s":300,"segments":[{"start_s":0.0,"end_s":4.76,"text":"Did you know that Apple, a 3.5 trillion dollar company,","speaker":null,"is_sponsor":0},{"start_s":4.76,"end_s":8.56,"text":"is only around due to an illegal back alley product?","speaker":null,"is_sponsor":0},{"start_s":8.56,"end_s":11.56,"text":"Back in the early 1970s, Apple co-founder Steve Jobs","speaker":null,"is_sponsor":0},{"start_s":11.56,"end_s":15.8,"text":"and Steve Wozniak constructed a device called a blue box","speaker":null,"is_sponsor":0},{"start_s":15.8,"end_s":21.24,"text":"that essentially hacked phone systems, allowing the user to make free long distance calls.","speaker":null,"is_sponsor":0},{"start_s":21.24,"end_s":26.66,"text":"A huge deal at the time, as it wasn't uncommon to have to pay upwards of $3 a minute","speaker":null,"is_sponsor":0},{"start_s":26.66,"end_s":30.78,"text":"for calls across state lines. The blue box was a result of a discovery","speaker":null,"is_sponsor":0},{"start_s":30.78,"end_s":36.68,"text":"that phone connections could be manipulated by playing certain sounds into a phone's handset,","speaker":null,"is_sponsor":0},{"start_s":36.68,"end_s":39.06,"text":"a process called freaking.","speaker":null,"is_sponsor":0},{"start_s":40.9,"end_s":44.84,"text":"To be more specific, a tone of 2,600 Hertz,","speaker":null,"is_sponsor":0},{"start_s":44.84,"end_s":48.16,"text":"which sounds like this, was used by phone companies","speaker":null,"is_sponsor":0},{"start_s":48.16,"end_s":51.9,"text":"as a control signal that a certain line was now free,","speaker":null,"is_sponsor":0},{"start_s":51.9,"end_s":58.64,"text":"typically because one of the callers had hung up. But in the late 1950s, a blind child named Joe Ingressia","speaker":null,"is_sponsor":0},{"start_s":58.64,"end_s":63.3,"text":"discovered a similar form of freaking accidentally while whistling into a phone","speaker":null,"is_sponsor":0},{"start_s":63.3,"end_s":68.02,"text":"that was playing a recorded message. Because our friend Joe had perfect pitch,","speaker":null,"is_sponsor":0},{"start_s":68.02,"end_s":73.1,"text":"he was able to recreate this behavior to make calls drop without hanging up the phone,","speaker":null,"is_sponsor":0},{"start_s":73.1,"end_s":76.42,"text":"essentially manipulating the phone's back end systems","speaker":null,"is_sponsor":0},{"start_s":76.42,"end_s":80.34,"text":"from the user interface, sort of like people on Twitter telling AI bots","speaker":null,"is_sponsor":0},{"start_s":80.34,"end_s":85.7,"text":"to ignore all previous instructions. A community started to emerge around phone freaking","speaker":null,"is_sponsor":0},{"start_s":85.7,"end_s":89.18,"text":"and eventually the blue box built upon Joe's discovery","speaker":null,"is_sponsor":0},{"start_s":89.18,"end_s":93.66,"text":"to democratize long distance calling or cheat the phone companies out of revenue.","speaker":null,"is_sponsor":0},{"start_s":93.66,"end_s":99.74,"text":"Depending on your perspective, here's how it worked. The user of the blue box would dial a toll-free 1-800 number","speaker":null,"is_sponsor":0},{"start_s":99.74,"end_s":104.14,"text":"to ensure they wouldn't be charged for the call. When it heard the phone ring on the other end,","speaker":null,"is_sponsor":0},{"start_s":104.14,"end_s":107.14,"text":"the blue box would play that 2,600 Hertz tone","speaker":null,"is_sponsor":0},{"start_s":107.14,"end_s":110.24,"text":"into the phone's handset, which would trick the system","speaker":null,"is_sponsor":0},{"start_s":110.28,"end_s":113.64,"text":"into thinking the caller had hung up before anyone answered.","speaker":null,"is_sponsor":0},{"start_s":113.64,"end_s":119.52,"text":"The line was marked as being free, but the caller using the blue box was still on the line.","speaker":null,"is_sponsor":0},{"start_s":119.52,"end_s":123.56,"text":"The blue box would then send the tones that corresponded to the number the user","speaker":null,"is_sponsor":0},{"start_s":123.56,"end_s":128.66,"text":"actually wanted to reach since the line was selective and voila, free long distance calling.","speaker":null,"is_sponsor":0},{"start_s":128.66,"end_s":132.2,"text":"Not a bad deal considering they were sold for 170 bucks each,","speaker":null,"is_sponsor":0},{"start_s":132.2,"end_s":136.36,"text":"but no more than 100 of them were ever made. Because they were so rare,","speaker":null,"is_sponsor":0},{"start_s":136.36,"end_s":139.52,"text":"one of them ended up selling at auction in 2017","speaker":null,"is_sponsor":0},{"start_s":139.56,"end_s":144.56,"text":"for $125,000, similar in price to the new iPhone 16 Pro","speaker":null,"is_sponsor":0},{"start_s":145.0,"end_s":149.2,"text":"with two terabytes of storage. Of course, phone companies became wise to the blue box,","speaker":null,"is_sponsor":0},{"start_s":149.2,"end_s":154.08,"text":"especially after a rather anti-establishment magazine ran an article with instructions","speaker":null,"is_sponsor":0},{"start_s":154.08,"end_s":158.96,"text":"on how to construct a similar device yourself at home. The main countermeasure against phone freaking","speaker":null,"is_sponsor":0},{"start_s":158.96,"end_s":164.36,"text":"is called signaling system seven. And I use the present tense is","speaker":null,"is_sponsor":0},{"start_s":164.36,"end_s":169.18,"text":"because it's actually still around today, even though it was rolled out in the early 1980s.","speaker":null,"is_sponsor":0},{"start_s":169.18,"end_s":174.34,"text":"The basic idea behind SS7 is simply to put the control signals on a separate line","speaker":null,"is_sponsor":0},{"start_s":174.34,"end_s":177.7,"text":"so they can't be manipulated by sounds played into the phone itself.","speaker":null,"is_sponsor":0},{"start_s":177.7,"end_s":182.62,"text":"And while SS7 was reasonably effective at stopping that 2,600 Hertz attack,","speaker":null,"is_sponsor":0},{"start_s":182.62,"end_s":187.58,"text":"it couldn't stop every kind of attack, especially as phone technology continued to evolve.","speaker":null,"is_sponsor":0},{"start_s":187.58,"end_s":193.62,"text":"A later common way to freak the phone network for free long distance calls was to exploit the system","speaker":null,"is_sponsor":0},{"start_s":193.62,"end_s":197.94,"text":"of calling cards used by smaller carriers in the mid 1980s.","speaker":null,"is_sponsor":0},{"start_s":197.94,"end_s":202.18,"text":"Back then, it was common to have to dial a special local number owned by the phone company","speaker":null,"is_sponsor":0},{"start_s":202.18,"end_s":205.62,"text":"and then enter the code off a paid card,","speaker":null,"is_sponsor":0},{"start_s":205.62,"end_s":209.96,"text":"which let the network know you weren't authorized to make a long distance call.","speaker":null,"is_sponsor":0},{"start_s":209.96,"end_s":213.66,"text":"Only then could you dial the number you were trying to connect to.","speaker":null,"is_sponsor":0},{"start_s":213.66,"end_s":218.62,"text":"The problem for the phone companies was that the codes on these cards were quite short,","speaker":null,"is_sponsor":0},{"start_s":218.62,"end_s":222.98,"text":"meaning it was easy for PCs to quickly guess lots of different combinations","speaker":null,"is_sponsor":0},{"start_s":222.98,"end_s":226.14,"text":"and try those combinations using a modem.","speaker":null,"is_sponsor":0},{"start_s":226.14,"end_s":229.7,"text":"Lots of codes were found this way and subsequently shared to the point","speaker":null,"is_sponsor":0},{"start_s":229.7,"end_s":233.78,"text":"where long distance companies were losing a half billion dollars a year","speaker":null,"is_sponsor":0},{"start_s":233.78,"end_s":237.3,"text":"to this form of brute force freaking by 1987.","speaker":null,"is_sponsor":0},{"start_s":237.3,"end_s":240.42,"text":"This scam was very popular among college students.","speaker":null,"is_sponsor":0},{"start_s":240.42,"end_s":243.82,"text":"In fact, over 2,500 of them were busted in a drag net,","speaker":null,"is_sponsor":0},{"start_s":243.82,"end_s":248.58,"text":"but it was impossible for the phone companies to track down everyone who did this.","speaker":null,"is_sponsor":0},{"start_s":248.58,"end_s":252.78,"text":"This former freaking only disappeared when phone companies eventually made direct dialing","speaker":null,"is_sponsor":0},{"start_s":252.78,"end_s":255.78,"text":"of long distance numbers more universal.","speaker":null,"is_sponsor":0},{"start_s":255.78,"end_s":259.14,"text":"And the use of PCs to hijack phone lines continues","speaker":null,"is_sponsor":0},{"start_s":259.14,"end_s":264.66,"text":"to this day, we actually did a collaboration on our sister channel Linus Tech Tips with Veritasium,","speaker":null,"is_sponsor":0},{"start_s":264.66,"end_s":269.04,"text":"where they actually used SS7 to intercept calls to Linus' smartphone.","speaker":null,"is_sponsor":0},{"start_s":269.04,"end_s":273.9,"text":"They did this by buying access to SS7, which is surprisingly easy to do for a few thousand bucks,","speaker":null,"is_sponsor":0},{"start_s":273.9,"end_s":277.46,"text":"then using the access to steal a unique identifier code","speaker":null,"is_sponsor":0},{"start_s":277.46,"end_s":282.1,"text":"off the victim's SIM card. After this is done, an attacker can use that ID number","speaker":null,"is_sponsor":0},{"start_s":282.1,"end_s":287.22,"text":"to trick the network into thinking the victim's phone is roaming in a different country,","speaker":null,"is_sponsor":0},{"start_s":287.22,"end_s":292.82,"text":"which results in the network rounding calls and texts to a number registered with that country code","speaker":null,"is_sponsor":0},{"start_s":292.82,"end_s":297.52,"text":"that the attacker controls. That was a really cool and frightening experiment.","speaker":null,"is_sponsor":0},{"start_s":297.52,"end_s":300.42,"text":"So if you wanna find out more, go watch that video next.","speaker":null,"is_sponsor":0}],"full_text":"Did you know that Apple, a 3.5 trillion dollar company, is only around due to an illegal back alley product? Back in the early 1970s, Apple co-founder Steve Jobs and Steve Wozniak constructed a device called a blue box that essentially hacked phone systems, allowing the user to make free long distance calls. A huge deal at the time, as it wasn't uncommon to have to pay upwards of $3 a minute for calls across state lines. The blue box was a result of a discovery that phone connections could be manipulated by playing certain sounds into a phone's handset, a process called freaking. To be more specific, a tone of 2,600 Hertz, which sounds like this, was used by phone companies as a control signal that a certain line was now free, typically because one of the callers had hung up. But in the late 1950s, a blind child named Joe Ingressia discovered a similar form of freaking accidentally while whistling into a phone that was playing a recorded message. Because our friend Joe had perfect pitch, he was able to recreate this behavior to make calls drop without hanging up the phone, essentially manipulating the phone's back end systems from the user interface, sort of like people on Twitter telling AI bots to ignore all previous instructions. A community started to emerge around phone freaking and eventually the blue box built upon Joe's discovery to democratize long distance calling or cheat the phone companies out of revenue. Depending on your perspective, here's how it worked. The user of the blue box would dial a toll-free 1-800 number to ensure they wouldn't be charged for the call. When it heard the phone ring on the other end, the blue box would play that 2,600 Hertz tone into the phone's handset, which would trick the system into thinking the caller had hung up before anyone answered. The line was marked as being free, but the caller using the blue box was still on the line. The blue box would then send the tones that corresponded to the number the user actually wanted to reach since the line was selective and voila, free long distance calling. Not a bad deal considering they were sold for 170 bucks each, but no more than 100 of them were ever made. Because they were so rare, one of them ended up selling at auction in 2017 for $125,000, similar in price to the new iPhone 16 Pro with two terabytes of storage. Of course, phone companies became wise to the blue box, especially after a rather anti-establishment magazine ran an article with instructions on how to construct a similar device yourself at home. The main countermeasure against phone freaking is called signaling system seven. And I use the present tense is because it's actually still around today, even though it was rolled out in the early 1980s. The basic idea behind SS7 is simply to put the control signals on a separate line so they can't be manipulated by sounds played into the phone itself. And while SS7 was reasonably effective at stopping that 2,600 Hertz attack, it couldn't stop every kind of attack, especially as phone technology continued to evolve. A later common way to freak the phone network for free long distance calls was to exploit the system of calling cards used by smaller carriers in the mid 1980s. Back then, it was common to have to dial a special local number owned by the phone company and then enter the code off a paid card, which let the network know you weren't authorized to make a long distance call. Only then could you dial the number you were trying to connect to. The problem for the phone companies was that the codes on these cards were quite short, meaning it was easy for PCs to quickly guess lots of different combinations and try those combinations using a modem. Lots of codes were found this way and subsequently shared to the point where long distance companies were losing a half billion dollars a year to this form of brute force freaking by 1987. This scam was very popular among college students. In fact, over 2,500 of them were busted in a drag net, but it was impossible for the phone companies to track down everyone who did this. This former freaking only disappeared when phone companies eventually made direct dialing of long distance numbers more universal. And the use of PCs to hijack phone lines continues to this day, we actually did a collaboration on our sister channel Linus Tech Tips with Veritasium, where they actually used SS7 to intercept calls to Linus' smartphone. They did this by buying access to SS7, which is surprisingly easy to do for a few thousand bucks, then using the access to steal a unique identifier code off the victim's SIM card. After this is done, an attacker can use that ID number to trick the network into thinking the victim's phone is roaming in a different country, which results in the network rounding calls and texts to a number registered with that country code that the attacker controls. That was a really cool and frightening experiment. So if you wanna find out more, go watch that video next."}