Captain Crunch (the 2600 Hz whistle)

securityops culture

The phone-phreaking legend that a toy whistle emitting 2600 Hz could seize AT&T long-distance trunks.

John Draper took the handle Captain Crunch after a whistle packaged in the cereal happened to produce the 2600 Hz tone that old telephone switches used to signal an idle trunk, letting phreakers place free calls. The 1971 Esquire article that publicized it inspired a generation of hackers, including the young Wozniak and Jobs, and named the later magazine 2600.

John Draper earned the name Captain Crunch from the discovery that a toy whistle in a cereal box produced a tone at 2600 Hz, which happened to be the frequency AT&T's long distance network used to signal that a trunk line was idle. Blowing it into a phone handset seized the line and handed control of the switching system to the caller.

The vulnerability was architectural rather than accidental. The network carried its control signalling in the same channel as the voice, so anything that could produce sound could produce commands, and the security of the entire long distance system rested on nobody knowing which tones mattered. Phone phreaking was the systematic exploration of that fact, and the eventual fix was out-of-band signalling, which moved control onto a separate channel where users could not reach it.

The principle generalizes far beyond telephony and is the reason the story is still taught. Any system that mixes control and data in one channel is exposed to whoever controls the data, which is the same structural flaw behind SQL injection, cross-site scripting and command injection. Different decades, different technologies, identical mistake: the boundary between what is being carried and what is doing the carrying has to be enforced, not assumed.

Also known as: John Draper, Cap'n Crunch whistle, phreaking, 2600 Hz

← All glossary entries