CSM Issue #3 @ Sept 1990 * MENU * (Use Mouse To Change Page > ) Welcome, Once Again, to this, the only disk magazine dedicated to Amiga 68000 Coders & Hackers & Phreakers & Crackers & Swappers & Dudes....(C+H+P+C+S+D !) Article Page | Article Page -------------------------------- | -------------------------------- About Issue Number III........0 | Hacking The WANG O/S.........21 Editor's Comment Page.........1 | Classified Ads...............23 Surveillance Techniques.......2 | The State Of A Nation........25 Count Zero's Coding Page.....12 | Collecting Traffic Beacons!..27 Book Store Addresses.........15 | Reader's Letter Page.........29 Co-Editor's Comment Page.....17 | Order Issue #4 From Us !.....31 Code A Disk Mag Part II......18 | CSM Prize WordSearch.........20 | ** Exit Magazine ** (Nooo)...32 ~From Bugging To Buggery, From Tapping To Hacking, It's all here, In The CSM!~ Instructions: Select Desired Article, Then Move Mouse To Alter The Page Number (Top Right) To The Correct Page. Now Press LEFT Mouse Button. Now, Either Press RIGHT Mouse To Progress A Page, Or LEFT Mouse To Return Here (MENU). To EXIT Select Last Page. Joy=Col Change: Up=B+, Left=G+, Right=R+, Fire=Def ------------------------------------------------------------------------------ Coded By/Editor: THE SNOWMAN. Co-Editor: COUNT ZERO. Material: VARIOUS. The Coder's Scene Magazine Issue #3. 1/1 | It's that time again! That time when fiction becomes fact, and the latest issue of CSM smacks you in the mouth! Oh, I luuuve that time! Seriously, it's getting bad. Read the editor's comment page and you'll get the gist of just HOW bad... I mean, the mag could be CLOSED down! Oh noooo! Notice the new format? Let me know if you prefer the old one, but I was fed up with seeing ~article...1~ ~article...2~ etc.. I think that this format works fairly well... Oh yes, coz I've re-written the format of the mag, the article on Write A Mag won't make much sense (The article talks about copper menu bars etc..), but, bare with it, and I'll put an update in after the last article to bring it all up to date with this format!?! What have we got this issue for you? Well, We've got a HUUUUGE bit on tapp- ing phones/bugging by The Dark Knight which was from a BBS, and also the addr- esses of some places that sell some great stuff (some bugging stuff!?).. And looooads of other interesting stuff! And finally, a note of interest.. there are 5 spiders on my ceiling... only little spiders, but they've been multipying each night... If they weren't small they'd die.. But as it is, they eat all the gnats and mosquitos... It's a good job I 'aint got ARACNOPHOBIA! (Looks like a good film huh?) ------------------------------------------------------------------------------ Send you articles, ads, abuse, advice, aardvarks, letters etc.. To either: The Snowman, Magazine Stuff, 18 Palm Grove, Whitby, Ellesmere Port, L66 2PU. Count Zero, Magazine Stuff, 40 Vine Road, Backford Cross, S.Wirral, L66 2XX. ------------------------------------------------------------------------------ NOTE: All information in this mag CANNOT be verified, and all hacking info is for Informational/Interest purposes ONLY (as is ALL the text in the mag....) laws CAN be broken if various instructions in texts were carried out, and I can accept NO responsability for ANY STUPID actions taken ! Editorial Comment Page 1/1 | Astounding! Absolute Zilch. No one has written anything of ANY INTEREST to the mag as yet. The only sensible things I can get are from BBSs or from my co-editor! What is it with you people? You can't even write a classified ad? You can't think of anyone you'd like to slag off in public? You can think of something to moan about/be happy about? Well, if you can't write something soon, then I'm gonna have to close down the mag after only a few issues... Come on! I mean, surely you have SOMETHING to write to me with? Want a pen- coder or a contact to help with your new adventure fanzine? Then write a good classified ad to me... Urg! God help us! Enough moans for now, and onto some more serious issues. Like, circulation! My main headache is trying to cirulate this mag to the Amiga Scene in a big enough way to get lots of publicty. Now, there are 2 ways of doing this.... 1. Start ~swapping~ with loads of people and get it done that way.. Problem: I have to swap, and I HATE swapping.. most people insist on swapping 15 dsks and I just don't have time to copy useless games etc.. 2. Give the mag to a select few, who DO swap with a mass amount of people, and spread it that way. Problem: Which select few want to swap 1 / 2 disks? And who says that those few have a large circulation anyway? Whatever I do I'm stuck. I get the mag out to a few people, but don't know how far it goes after that... It really depends on the compact it's on with, if it's good, the the mag will go far, but if it's bad, then it won't. The solution? It's as so: You get the mag, 2 possiblities: 1. The mag is on a crap compact, in which case, take it off and put it on one of your own... 2. It's on a GOOD compact, in which case, spread it.. Okay, that's easy eno- ugh... even for readers that can't write (or so it seems...) Finally.. did anyone see my CES show demo??? It wan't that bad... was it? The Snowman - A Peeved Editor. Surveillance Techniques. By The Dark Knight. 1/10 | %+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+ %+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+ %+% UNDER SURVEILLANCE +%+ %+% PHONE TAPPING +%+ %+% BY +%+ %+% THE DARK KNIGHT +%+ %+% 11/3/90 +%+ %+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+ %+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+ * DISCLAIMER: The author takes no responsiblity for, nor does he assume any liability for, damages resulting from the use of information in this document. This document is for informational purposes only. * WARNING: Connection of unauthorised equipment to a public (or indeed private system is illegal and could lead to prosecution. * INTRODUCTION: Now with the warnings over here is the equipment. Because of the highly sophisticated nature of the modern telephone network, the installation of the tap is a very tricky business indeed. It will take a capacitor (100nf), a pair of high impedance headphones, anything up to two crocodile clips and at least twelve seconds of concentrated effort. (See fig. 1) FIG 1: (Cont'd) Surveillance Techniques. By The Dark Knight. 2/10 | X---------------±---------------------------Y phone lines | | X---------------|----------±----------------Y | | --- | capacitor --- | | | |HEADPHONES| One alternative to hanging around waiting for the telephone to answer is to connect up a tape recorder. Now we come to the really sophisticated electronics: since it is waste of tape to run the recorder continuosly, it is useful to switch it on only when the phone is being used. Voice activated switches? Why bother. A relay will do the trick, connected in series with one of the lines. See plans on how to build a TAN box. There are plenty around. RADIO BUGS: The next step up is some kind of radio bug. In the days not so long ago when the BT issue phone was a wedge of cheese shaped affair with a dial on the front, a favourite bugging device used to be the 'drop in' mike. The handset microphone was a carbon granule device, quite bulky but easy to remove; unscrew the mouthpiece, slip off a pair of wires from their terminals and its out. The crafty buggers found a much better use for all that space than filling it with carbon granuals. Buying microphones from the very same people who supplied BT, they would empty out of the granuals, put in a much smaller mike and would empty out the granuals, put in a much smaller mike and (Cont'd) Surveillance Techniques. By The Dark Knight. 3/10 | a small radio transmitter, then seal the whole thing back together again. Drop it into the handset and off you go. It is estimated that the numbers made around the world ran into millions, so they were not uncommon! Still used for bugging public telephones, but not much good for the wide varity of office and home phones now in use. SERIES AND PARALLEL BUGS: Also very common and readily available are a variety of bugs which connect either in series with one telephone wire or in parallel across the two. The series bug has the advantage of only transmitting when the telephone is used; the parallel one transmits continuosly in its crudest form (and most commercial bugs are pretty crude) but can be a little more difficult to detect by simple voltage measurements. Let's face it, it would be a trivial matter to design a bug that is both triggered by use of the phone and virtually impossible to detect by voltage measurements, but since almost nobody takes seriously the idea that they may be a suitable target (do you think you are, for instance?) and therefore won't be checking, why bother with anything complicated? (See picture 1 and 2 for details. (End of file) ) INFINITY TRANSMITTER: The most exotic of the commonly used listerning devices is the 'infinity transmitter', so called because once the victim can be snooped on from anywhere in the world. Anywhere his phone can be reached by direct dialling, that is. This is what you do: dial up the victim's number and hold your little black mystery box close to the mouthpiece. In the simplest versions, the mystery box just sends a tone down the line which is picked up by a frequency selective circuit inside the bug. The mystery box activates the infinity transmitter, which you previously attached to the victim's phone. (Cont'd) Surveillance Techniques. By The Dark Knight. 4/10 | Once activated, the transmitter prevents the phone from ringing, and instead sends down the line any sounds picked up by the victim's telephone, or by the bug's own internal microphone. This is how it works. On recieving the activating tone, the transmitter passes enough current between the two lines to fool BT's equipment into thinking that the phone has been answered, so the ringing tone is cancelled and the line is opened. Once connection is made, all the bug has to do is to modulate the line voltage in just the way the telephone itself would. Not very difficult. The victim is entirly unaware of anything happening and, with a hookswitch defeat installed, it could be his own telephone acting as a microphone for the transmitter. The bug will automatically cut out if the handset of the victim's phone is lifted, allowing it to be used normally. (See picture 2 for details. (End of file) ) HOOK SWITCH DEFEAT: Much simpler than the infinity transmitter, and used in much the same way,is the hookswitch defeat. When you hang up the telephone, a switch disconnects the handset... unless, that is, somebody has doctored the phone. The simplest method is just to wire a resistor across the switch. In use you phone the victim, apologise for having called up the wrong number, let him hang up but keep your phone off the hook to hold open the connection. Then you listen in. The sound level won't be very high, so you may need an amplifier. The difficulty with a plain hookswitch is that you need access to the telephone itself and enough time to dismantle it. There is also the possibility that an innocent caller may be slow to hang up and find himself accidently eavesdroping. A bit of a giveaway. Hookswitch defeats are easy to spot by anyone familiar with the insides of a telephone, but can often be overlooked in inspection by a suspicious buggee since, unlike infinity (Cont'd) Surveillance Techniques. By The Dark Knight. 5/10 | transmitters and the like, it could easily be part of the workings of the phone. Take the idea of 'looking as if it belongs' to its conclusion and you have the 'lost' tranmitter. What you do is to find a large-ish component in the telephone (or typewritter, calculator, or whatever) which itself uses any signal you need access to. You then rush home to your garden shed and knock up a device which not only does what this component does, but contains a transmitter too. You package it to look exactly like the component you're replacing. Then you pop back one night and swap the two around. Anyone inspecting the phone or whatever will find it contains exactly the components it should - no more and no less. The transmitter is really and truly lost. This really is big league stuff - the kind of trick employees of rival governments like to play on each other. Not the kind of thing you will personally come across unless you have access to very valuable information indeed. There's an American company called Fox which could be persuaded to come up with the goodies if you approach them in the right way and have the funds. They're in the phone book. Okay that is about it for this document,but do bear in mind that BT are very touchy about having alien equipment connected to their lines, even if it is just a capacitor and headphones. And stay away from my phone, if you don't mind!! +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + CIRCUIT DIAGRAMS: + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ (Cont'd) Surveillance Techniques. By The Dark Knight. 6/10 | CIRCUIT 1: SERIES PHONE BUG: -=-=-=-=-=-=-=-=- | | W | | å-------±-------------±------° | | | | | C1 % TC & C4 % | | L1 &) R2 $ ±------±----ß | | | | | | | | å------° | ±------±-----(+)Q1 | | æ-±----| ~ + |-ß | | | | | | | | | | | | | R1 $ | BR1 | R3 $ C2 % R4 $ C3 % | | | | | | | | | å-±----| ~ - |---------±------±------±------ß | | æ------ß | | % = CAPACITOR $ = RESISTOR (+) = TRANSISTOR & = TUNING COIL &) = INDUCER W = AERIAL NOTE: A ± indicates a join or a corner and a + indicates a wire cross over. PARTS NEEDED: R1 = 270K R2 = 10K R3 = 10K R4 = 1K0 C1 = 15pF C2 = 1nF0 C3 = 1nF0 C4 = 5pF0 Q1 = ZTX300 L1 = INDUCER 33uH BR1= BRIDGE RECTIFIER TC = TUNING COIL 3mm (4 OR 5 TURNS) (Cont'd) Surveillance Techniques. By The Dark Knight. 7/10 | CIRCUIT 2: PARALLEL PHONE BUG: -=-=-=-=-=-=-=-=-=- L1 W | | å-------±----±------&)----° | | | + = | | å---±--± | | | | B1| | R3$C2% C4%T1&--ß %C6 | | - = | | | | | | | | R1 | | | | ±--±-----ß ±----+-$-±---+-%-±--(+)Q1 ±--±--(+)Q2 | | | | | | ±--± ±--± | | N1@ | R2$ | | %C3 R4$ %C5 | | | | | | | | | | | ±---±---±---±---)&(--±------±--ß | | A1 | | % = CAPACITOR $ = RESISTOR (+) = TRANSISTOR & = TUNING COIL &) = INDUCER )&( = AUDIO TRANSFORMER = | = BATTERY @ = NEON W = AERIAL = NOTE: A ± indicates a join or a corner and a + indicates a wire cross over. PARTS NEEDED: R1 = 10K R2 = 220K R3 = 12K R4 = 220R C1 = 10nF C2 = 47pF C3 = 1nF5 C4 = 25pF C5 = 1nF5 C6 = 10pF Q1 = ZTX500 Q2 = ZTX300 N1 = NEON A1 = AUDIO TRANSFORMER 25K )&( 1K0 B1 = 9V BATTERY L1 = INDUCER 1.8uH TC = TUNING COIL 3mm (4 OR 5 TURNS) (Cont'd) Surveillance Techniques. By The Dark Knight. 8/10 | CIRCUIT 3: INFINITY TRANSMITTER: -=-=-=-=-=-=-=-=-=-=- å---------±-----------------------------------±----------±----° | | | | | IMP | $R2 $R8 $R11 | A1 | | | R9 | | å--)&(-----+-----° ±---° å---+----$-----+--° | | | -----+-° | | | | | | | | | | | | %C2 $R3 | | ±--° | | | | %C1 | | | | | |Q4 | | | | | | | | | ±-$-±--(+)Q2 ±--(+) | | | | | | å---° | | |R7 | | C5 R5 R7 | | | ZD1 | | | ±--+--±-|~ +|-ß | ±--(+)Q1±---±-%-$-±---±->>-±---±-$-(+)Q3| ±-<_<--(+) | | | | | | | | | | | | | | | | | Q5 | | | |BR1| | %C3 | $R4 %C4 &)L1%C6 %C7 $R6 | | $R10 | | | | | | | | | | | | | | | | | | | ±--±----|~ -|---±---±---±---±---±-----±---±----±---±----±---±--± | | æ---ß | | | | | | D2 R12 | | | å------------------------------<<----$-------------+----------ß | | R13 | | ±--------------------$---° | | | | | | | | | | | | | | | | | | | | | (Cont'd) Surveillance Techniques. By The Dark Knight. 9/10 | | | | | | | | | | å---±---±---±-------+-------------------------+------------ß | | | | | | | | $R15%C10| | | | | ±---±--(+)Q8| | | å----±---(+)Q7| | | | | | | | | æ--(+)Q9 | | $R14 | | | | R18| | C8 | | | | ±---±-$-± | å-%--±---(+)Q6 | $R16 | | | | | | | | | | | | | ()MIC%C9 | | %C11 $R17%C12%C13 | | | | | | | | | | æ----±----±----±---±-------±---±---±-------------------------ß % = CAPACITOR $ = RESISTOR (+) = TRANSISTOR &) = INDUCER )&( = AUDIO TRANSFORMER () = MICROPHONE >> = DIODE << = DIODE (POLARITY REVERSED) <_< = ZENER DIODE NOTE: A ± indicates a join or corner and a + indicates a wire cross over. PARTS NEEDED: R2 = 33K R3 = 33K R4 = 4K7R R5 = 4K7 R6 = 1M0 R7 = 100K R8 = 68K R9 = 82K R10= 270K R11= 68K R12= 1K0 R13= 10K R14= 390K R15= 390K R16= 10K R17= 56R R18= 15K C1 = 4nF7 unpolarised C2 = 10nF unpolarised C3 = 10nF unpolarised C4 = 10uF polarised +'ve to top (Cont'd) Surveillance Techniques. By The Dark Knight. 10/10 | C5 = 10nF unpolarised C6 = CHOOSE TO TUNE C7 = 4uF7 polarised +'ve to top C8 = 4uF7 polarised +'ve to right C9 = 1nF0 unpolarised C10= 1nF0 unpolarised C11= 2uF2 polarised +'ve to top C12= 47uF polarised +'ve to top C13= 1uF0 polarised +'ve to top Q1-Q9 = BC108 A1 = AUDIO TRANSFORMER 500R )&( 10K D1 = 1N4148 D2 = 1N4148 ZD1= 6V8 ZENER DIODE L1 = INDUCER 40mH %+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+ % This document was written by The Dark Knight.+ % Contact me on ANGEL BBS - 0772 795476 24hrs. + % or on EQUALISER BBS - 0923 662127 24hrs. + %+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+%+ Count Zero's Coding Page 1/3 | Hello Guys (if there are any girls out there write to me!),it's Count Z on the keys.Welcome to what,hopefully,should be a regular feature,an article on coding,don't expect code and explanations like you find in Stolen Data disk mag,as mine will be understandable (I hope!).This Issue I've decide to write some source relating to the Soundmon,chip music replay routine,as chip music is becoming more widely used by coders,probably because it's a lot shorter. When I recieved a copy of the replay routine and some modules,I decided to see if I could modify it to play more than one module (not at the same time!) it took me 20 minutes to modify it!,as the solution is reasonably easy. Before I launch into an explanation,I'll explain the principle behind the modification.Many of you will be familiar with the technique of (what I call) ~double declaring labels~,that is using a label to store the address of another label,for example. Textpos DC.L Text The format is: