1
00:00:00,280 --> 00:00:07,000
did you know that Apple a $3.5 trillion

2
00:00:04,000 --> 00:00:09,040
company is only around due to an illegal

3
00:00:07,000 --> 00:00:14,679
back alley product back in the early 1970s Apple co-founders Steve Jobs and

4
00:00:11,639 --> 00:00:17,320
Steve wnac constructed a device called a

5
00:00:14,679 --> 00:00:22,279
blue box that essentially hacked phone systems allowing the user to make free

6
00:00:19,800 --> 00:00:27,160
long-distance calls a huge deal at the time as it wasn't uncommon to have to

7
00:00:24,320 --> 00:00:31,240
pay upwards of $3 a minute for calls across state lines the blue box was a

8
00:00:29,519 --> 00:00:35,760
result of a discovery that phone connections could be manipulated by

9
00:00:33,120 --> 00:00:43,200
playing certain sounds into a phone's handset a process called

10
00:00:39,800 --> 00:00:46,640
freaking to be more specific a tone of

11
00:00:43,200 --> 00:00:48,840
2600 Hertz which sounds like this was

12
00:00:46,640 --> 00:00:53,719
used by phone companies as a control signal that a certain line was now free

13
00:00:51,800 --> 00:00:59,239
typically because one of the callers had hung up but in the late 1950s a blind

14
00:00:56,719 --> 00:01:03,519
child named Joe Andia discovered a similar form of freaking accidentally

15
00:01:01,559 --> 00:01:08,680
while whistling into a phone that was playing a recorded message because our

16
00:01:06,080 --> 00:01:13,000
friend Joe had Perfect Pitch he was able to recreate this Behavior to make calls

17
00:01:10,840 --> 00:01:17,680
drop without hanging up the phone essentially manipulating the phone's

18
00:01:14,640 --> 00:01:19,600
backend systems from the user interface

19
00:01:17,680 --> 00:01:24,079
sort of like people on Twitter telling AI Bots to ignore all previous

20
00:01:21,799 --> 00:01:28,759
instructions a community started to emerge around phone freaking and

21
00:01:25,840 --> 00:01:32,799
eventually the blue box built upon Joe's Discovery to democ TI longdistance

22
00:01:31,040 --> 00:01:36,840
calling or cheat the phone companies out of Revenue depending on your perspective

23
00:01:35,000 --> 00:01:40,840
here's how it worked the user of the blue box would dial a toll-free 1800

24
00:01:39,320 --> 00:01:44,719
number to ensure they wouldn't be charged for the call when it heard the

25
00:01:42,640 --> 00:01:49,399
phone ring on the other end the blue box would play that 2600 HZ tone into the

26
00:01:47,399 --> 00:01:54,159
phone's handset which would trick the system into thinking the caller had hung

27
00:01:51,920 --> 00:01:59,360
up before anyone answered the line was marked as being free but the caller

28
00:01:56,479 --> 00:02:03,560
using the blue box was still on the line the blue box would then send the tones

29
00:02:01,600 --> 00:02:07,280
that corresponded to the number the user actually wanted to reach since the line

30
00:02:05,399 --> 00:02:11,400
was still active and voila free longdistance calling not a bad deal

31
00:02:09,119 --> 00:02:16,360
considering they were sold for 170 bucks each but no more than 100 of them were

32
00:02:13,920 --> 00:02:20,920
ever made because they were so rare one of them ended up selling at auction in

33
00:02:18,360 --> 00:02:26,760
2017 for $125,000 similar in price to the new

34
00:02:23,480 --> 00:02:28,480
iPhone 16 Pro with 2 TB of storage of

35
00:02:26,760 --> 00:02:32,400
course phone companies became wise to the blue box especially after a rather

36
00:02:30,519 --> 00:02:36,480
anti-establishment magazine ran an article with instructions on how to

37
00:02:34,440 --> 00:02:39,440
construct a similar device yourself at home we'll tell you about how the phone

38
00:02:38,200 --> 00:02:43,519
companies tried to put an end to freaking as well as how the freaking

39
00:02:41,360 --> 00:02:49,280
Community countered their counter right after we thank MSI their magx 870

40
00:02:47,040 --> 00:02:54,800
Tomahawk Wi-Fi motherboard is built for the most intense use cases be it AAA

41
00:02:52,360 --> 00:02:59,080
gaming or triple overtime grinding it comes loaded with four m.2 slots built

42
00:02:57,159 --> 00:03:04,560
in Wi-Fi 7 capabilities and supports ryzen 9 ,000 8,000 and 7,000 processors

43
00:03:02,840 --> 00:03:10,200
your absolutely baller builds call for a motherboard that can support them so

44
00:03:06,599 --> 00:03:12,480
check out msi's magx 870 Tomahawk Wi-Fi

45
00:03:10,200 --> 00:03:17,640
using our link today the main countermeasure against phone freaking is

46
00:03:14,159 --> 00:03:20,480
called signaling System 7 and I use the

47
00:03:17,640 --> 00:03:24,640
present tense is because it's actually still around today even though it was

48
00:03:21,879 --> 00:03:29,480
rolled out in the early 1980s the basic idea behind ss7 is simply to put the

49
00:03:27,519 --> 00:03:34,000
control signals on a separate line so they be manipulated by sounds played

50
00:03:31,280 --> 00:03:38,920
into the phone itself and while ss7 was reasonably effective at stopping that

51
00:03:35,840 --> 00:03:40,599
2600 htz attack it couldn't stop every

52
00:03:38,920 --> 00:03:45,239
kind of attack especially as phone technology continued to evolve a later

53
00:03:43,200 --> 00:03:50,319
common way to freak the phone network for free long-distance calls was to

54
00:03:47,280 --> 00:03:53,040
exploit the system of calling cards used

55
00:03:50,319 --> 00:03:56,319
by smaller carriers in the mid1 1980s back then it was common to have to dial

56
00:03:54,640 --> 00:04:01,640
a special local number owned by the phone company and then enter the code

57
00:03:59,079 --> 00:04:06,079
off a page card which let the network know you were authorized to make a

58
00:04:03,760 --> 00:04:09,879
long-distance call only then could you dial the number you were trying to

59
00:04:07,400 --> 00:04:14,120
connect to the problem for the phone companies was that the codes on these

60
00:04:11,560 --> 00:04:18,799
cards were quite short meaning it was easy for PCs to quickly guess lots of

61
00:04:16,959 --> 00:04:23,479
different combinations and try those combinations using a modem lots of codes

62
00:04:21,919 --> 00:04:27,960
were found this way and subsequently shared to the point where long-distance

63
00:04:25,639 --> 00:04:33,240
companies were losing a half billion dollars a year to this form of Brute

64
00:04:30,039 --> 00:04:35,639
Force freaking by 1987 this scam was

65
00:04:33,240 --> 00:04:40,199
very popular among college students in fact over 2500 of them were busted in a

66
00:04:38,080 --> 00:04:44,759
drag net but it was impossible for the phone companies to track down everyone

67
00:04:42,479 --> 00:04:47,960
who did this this form of freaking only disappeared when phone companies

68
00:04:46,039 --> 00:04:53,240
eventually made direct dialing of long-distant numbers more Universal and

69
00:04:50,919 --> 00:04:57,800
the use of PCS to hijack phone lines continues to this day we actually did a

70
00:04:55,960 --> 00:05:02,800
collaboration on our sister Channel L Tech tips with veritasium where they

71
00:05:00,120 --> 00:05:06,600
actually used ss7 to intercept calls to Linus's smartphone they did this by

72
00:05:04,680 --> 00:05:10,639
buying access to ss7 which is surprisingly easy to do for a few

73
00:05:08,080 --> 00:05:15,440
thousand bucks then using the access to steal a unique identifier code off the

74
00:05:12,919 --> 00:05:19,400
victim's SIM card after this is done an attacker can use that ID number to trick

75
00:05:17,600 --> 00:05:23,919
the network into thinking the victim's phone is roaming in a different country

76
00:05:22,280 --> 00:05:29,000
which results in the network routing calls and texts to a number registered

77
00:05:26,520 --> 00:05:33,080
with that country code that the attacker controls that was a really cool and

78
00:05:31,520 --> 00:05:37,880
frightening experiment so if you want to find out more go watch that video next