Phreaking
Definition
Tone-based exploitation of the public switched telephone network, pioneered in the 1960s and 1970s. The 2600 Hz tone, generated by a toy whistle from a Cap'n Crunch cereal box, disconnected billing on AT&T trunks while keeping the call up. The modern descendant is signalling-layer abuse on SS7 and Diameter.
- Era
- 1960s to 1970s
- Key tone
- 2600 Hz
- Notable tool
- Cap'n Crunch cereal box toy whistle
- Modern form
- SS7 and Diameter signalling-layer abuse
Common questions
How exactly did the 2600 Hz tone allow free calls?+
AT&T's long-distance trunks used in-band signalling, where a 2600 Hz tone told the switch that a call had ended and billing could stop. A phreaker could play that tone mid-call to reset the trunk's billing state while the connection itself stayed up, then use in-band tones to dial a new number for free.
Why is SS7 and Diameter abuse considered the modern descendant of phreaking?+
Both exploit the same weakness: trust placed in a network's internal signalling channel rather than the call content. Modern attackers manipulate SS7 or Diameter signalling to intercept calls, texts, or location data instead of manipulating audible in-band tones, but the underlying idea of subverting the control layer is the same.
Related terms
- CLI Spoofing
- Caller Line Identification spoofing: the caller forges the Calling Party Number sent in the SS7 IAM or SIP From header so the...
- IMSI Catcher
- A rogue base station (commercial: Stingray, Hailstorm, KingFisher; research: USRP plus srsRAN or YateBTS) that impersonates a cellular cell, forces nearby phones...
- QRJacking
- Physical replacement or overlay of a legitimate merchant QR (typically a UPI QR at a shop counter) with a fraudster's QR pointing...
- SIM Swap
- Fraud pattern where the attacker convinces the telco to port the victim's MSISDN to a SIM the attacker holds. Once active, the...
- TRAI 24-Hour Cool-Off
- Telecom Regulatory Authority of India directive (2018 and tightened thereafter) requiring that after a SIM swap the new SIM cannot be used...