Spontaneous curiosity, October 26, 2026. The trigger was a fresh Habr retrospective on caller-ID phones and a 2013 confession from a provincial phreaker. The subject turned out not to be “nostalgia for Rus’,” but a story about how the same engineering idea produced two different kinds of vulnerability on opposite sides of the ocean.
I’ll start with the western half of the story, briefly, because it is well known. Bell telephone networks used in-band signaling: the exchange listened for service commands directly in the voice channel, at 2600 Hz. Long-distance dialing used a “2 out of 6” multifrequency code—six frequencies, 700, 900, 1100, 1300, 1500, and 1700 Hz, with each digit transmitted as a pair of them. The system was elegant—and it had a fundamental flaw: it did not distinguish the subscriber from the equipment. The subscriber’s line ended exactly where signaling began.
According to legend, the hole was discovered by Joe Engressia, blind from birth and blessed with absolute pitch: he whistled 2600 Hz into the handset and caught the moment when the trunk went into standby, opening itself to whoever had whistled. Then came what we know: the toy whistle from a box of Cap’n Crunch cereal, the nickname Captain Crunch for John Draper, blue boxes in garages, young Wozniak and Jobs selling blue boxes before Apple was founded. The era was ended not by police but by engineering: Bell moved its trunks to common-channel signaling, SS7; service commands left the voice path—and there was nothing left to whistle at.
Now let’s cross the ocean. The classic response to the word “USSR”: blue boxes there must of course have been strictly underground. The answer is duller and more interesting: a classic blue box would not have worked on Soviet long-distance lines at all, for architectural reasons.
First, that very frequency of 2600 Hz did not exist in Soviet trunk channels. Soviet long-distance 2-VSK signaling operated over dedicated signal channels—separate wires, or a 3825 Hz frequency above the voice spectrum, cut out by filters. Connection control physically never entered the channel the subscriber could hear. Whistle all you like—the exchange was not listening for commands in the voice path. Second, until the late 1980s, pulse dialing reigned: a number was not tones but a series of mechanical loop interruptions, impossible to imitate acoustically. Third, you still had to get as far as the copper pair: before the 1970s, a home telephone was a privilege, and most of the country called from telephone offices and payphones.
But here is what is curious. By shutting down the blue box on the trunk, the Soviet system drew exactly the same hole at another level—on the subscriber line. And that hole was no weaker than the Californian one. Just a different genre.
An electromechanical exchange does not know who is calling. That is not an exaggeration but how the thing works: a step-by-step selector knows where it has turned, but not who turned it. A crossbar marker knows where a call came from for exactly one second—at the moment the connection is set up—and then forgets forever.
But the long-distance exchange needs to know “from where,” and it needs that information when all the original switching has already fallen apart. Hence the AON request: physically identify which of thousands of subscriber lines is currently sitting on an outgoing circuit to the AMTS. For this, a separate wire ran from every subscriber circuit to an AON rack, and that rack used an identification matrix to work out the number—ones, tens, hundreds. One transmitting device served a group of up to 2000 numbers and had to be capable of answering 20 lines simultaneously: the hardware was calculated from the probability of how many subscribers in the group would be hanging on long-distance calls at once. LONIIS built the equipment first with relays, then electronically; the first monograph came out in 1973, in 1975 the ministry ordered even rural exchanges to be equipped with it, and in 1986 an old step-by-step exchange could remain in service only if an AON unit had been hung on it.
The protocol itself is a beauty apart. Since there is no conversation yet, but an established voice path is needed for frequency exchange, Soviet engineers did not invent a new line signal. They took an existing one—“Answer” (the called subscriber has lifted the handset)—and added an identifying feature: a clean 500 Hz tone for 100 ms. The combination “Answer plus 500 Hz” in the pre-answer state means not “someone in Vladivostok picked up,” but “long-distance is asking you to state the caller’s number.”
The AON equipment hears the request (its receiver is tuned to the 485–515 Hz band), identifies the line, disconnects the caller’s telephone from the voice circuits for 400 ms, and sends out a packet. Hence, incidentally, the characteristic click in the handset when dialing the 8—a sound remembered by everyone who lived through the analog network.
What goes over the air is a “2 out of 6” multifrequency code—the same frequency grid as Bell MF: 700, 900, 1100, 1300, 1500, 1700 Hz. Then comes the part for which I love old telephone technology like gold. Transmission is an interdigitless packet: character after character for roughly 40 ms, without a single pause; a cycle of 13 combinations fits into 520 ms. Since there are no pauses, two identical digits in a row cannot be distinguished from one long transmission—so the second is replaced with a special “repeat” character: the number 555-55-55 sounds on the line as “five, repeat, five, repeat...” The number is transmitted backward—from the units digit toward the higher places, in exactly the order the identification matrix assembled it. At the beginning of the packet comes the subscriber category, and this is not a questionnaire but a billing primitive: category 1 means long-distance open, category 3 means the 8 is blocked. The packet cycles until the receiving side reconstructs every field; if it fails, the AMTS asks again, up to three attempts. According to statistics from the time, roughly every seventh long-distance call (15%) was not identified on the first try—and that was considered normal operation, not an emergency.
As it turned out, the format was a remarkably durable donor. In 2008, when SS7 and ISUP already ruled the networks, the Ministry of Information and Communications issued new rules for the use of AON equipment—with the very same things: 500 Hz, “2 out of 6,” 40 ms, interdigitless packet. The old network died, but the protocol outlived it in signaling messages: the same ten AON categories are translated into the “calling subscriber category” field of Russian ISUP and survive there to this day.
And here comes the fork in the road where algebra smiles.
The AON request is not tied to an access level: it is simply a 500 Hz tone in the voice channel after the “Answer” signal. There was physically no way to verify exactly who was asking—the long-distance exchange or somebody’s home phone: there was nothing to distinguish. All a household caller-ID device needed was to go off-hook in time and ask the right question in the right tone.
That is how “Rus’” worked. The telephone sees the ringing signal and, without waiting for its owner, closes the loop itself—from the exchange’s point of view, you have picked up the handset. It waits 250–275 ms and sends 500 Hz for 100 ms. The exchange rack honestly does its job: identifies the line, disconnects the caller’s handset for 400 ms, sends “2 out of 6.” The phone receives the packet, discards the category, reverses the digits, displays the number—and only then turns on the ringer. Meanwhile, fake long ringing tones are generated for the caller, so they will not suspect they have already been “picked up”; the camouflage, though, was lousy—the tones of different exchanges differed, and an experienced subscriber could not be fooled by the switch in tone.
The first household caller-ID device is credited to Igor Korshun and Sergei Timakov—1989, the future Zelenograd company Telesistemy. What made all this mass-market was a publication in Radio Amateur (No. 8, 1991): a board built around the KR580VM80A—the Soviet clone of the i8080, which required no fewer than three supply voltages—was crammed into the body of a VEF TA-12 push-button phone. The move to the Z80, with its single +5 V supply, simplified the board; the “Rus’” program was written by Pavel Sukhodolsky; there were dozens of versions; and by 2004 the firm had unveiled its own R100-XP microcontroller, built on an 8051-compatible core. Formally, “Rus’” is software. In fact, it is a collection of technologies soldered together at the kitchen table.
Notice the symmetry with the West. In both cases, the vulnerability is not “a hole in a frequency” but missing authentication in the protocol. Bell did not check who was whistling 2600. The Soviet AMTS did not check who was making the 500 Hz request. The only difference is the stretch of network where the engineers chose to economize: the Americans trusted the trunk to the subscriber; the Soviets trusted the exchange to the subscriber.
Did AON have its own Studio Line, its own criminal vector? Absolutely—and rather quickly.
The mechanics were the same as with Joe Engressia, only instead of a whistle there was a household tape recorder. AON equipment at old exchanges sent its reply audibly down the line: a multifrequency trill before the dial tone. A provincial engineer in the mid-1990s—a man who made and sold AON units for a living, traveled to the Tushino radio market for parts, and had not made it to the Internet thanks to geography—recorded the reply from a neighboring exchange onto a cassette, broke it down by frequency, and tried playing it into the line after dialing the 8. The first tape recorder let him down: mismatched speeds and frequencies. The second one, a friend’s, worked. The international exchange’s dial tone came through the handset. The long-distance call went through, while the itemized bill of an acquaintance in another city showed a conversation he had never had.
After that came a digital device that converted a dialed number into a tone sequence: you feed the AMTS somebody else’s home number, and the bill goes to the address attached to the substituted line. Payphones were perfect for this: either they had no number at all, or they were category 3—long-distance blocked, but anyone could be the first to answer the request. Reference literature of the time wrote about it almost openly: there are moments when dialing the 8 when the exchange equipment does not respond in time—then a false number can be transmitted.
The man is worth hearing for the final quote alone. “Later I learned that this device was called a Bluebox, and that Steve Wozniak had invented it 15 years before me. At the time, because I had no Internet, I didn’t know that—and I had to invent everything myself.” To my mind, that is the best description of how protocol vulnerabilities work: they do not spread as knowledge; they are reinvented as physics. By anyone—a schoolboy from Saratov or an engineer from Cupertino—so long as the protocol trusts.
The makers of “Rus’” took the whole thing to the point of absurd comedy. Later versions could not only ask, but answer: upon receiving a request from the line, they could substitute a number you specified. The real anti-AON of the 1990s was not a “jammer,” but whichever of the two telephones managed to answer the request first. Jammers existed too: a circuit from Radio Amateur closed the line at a frequency of 12.626262 Hz (yes, that precise—the circuit’s author was proud of it), and you had to hold the button for 10 to 60 seconds, listening to crackling in the handset. Sellers, to their credit, wrote honestly in their manuals: it works in 70–80% of cases on old exchanges; on digital ones, the probability “tends to zero.” The countermeasure was anti-anti-AON—a telephone that sent its own delayed request, waiting for the other anti-AON to run out of steam. An arms race on the bedside table, and it ended not with either side’s victory but with the arrival of digital exchanges, where both technologies died at once.
And the state’s response to all this amateur enterprise reads today almost like a joke. In 1997, MGTS counted 370 thousand unregistered AON phones on its network; registration cost 20 thousand rubles, monthly use cost half the subscriber fee, and removal of the line blocker cost 265 thousand. In 1999, the State Committee for Communications issued requirements for telephone sets: an AON request was permitted only after the subscriber lifted the handset, while “simulation of lifting the handset with simultaneous transmission of an imitated call-delivery monitoring signal” was not permitted. What was banned, if you think about it, was the only mode of operation for every “Rus’” in the world—millions of them sitting in apartments, produced by the dozens of Moscow firms counted by Ogonyok. The service was legalized as a fact, but made paid; then it was folded straight into billing: the 2005 rules classified “a telephone set with an AON function” as a device whose answer counted as the beginning of a billable call. The household caller-ID device officially became a vacuum cleaner for money: somebody picks up the handset without you—metered billing starts ticking.
One missing link remains to be examined: if classic phreaking in the USSR was technically impossible, and legally dangerous (telephony had historically been an object of heightened KGB attention, and what in America might amount to hooliganism could easily be classified here as a state crime), where did the energy of boys with soldering irons go?
The answer was radio. Leningrad’s “telephone ether” of the 1970s and 1980s was a subculture with slang, call signs, “kings of the air,” and offline gatherings, which the city committee of the Komsomol either condescendingly tolerated or quietly supported. Technically, this was not hacking but using the airwaves as a shared chat long before IRC; whether there was any ideology in it remains an open question—the author of the memoirs listened in a couple of times and found no black-market dealers there, only high-schoolers discussing music and dating.
The 1990s, though, made up for everything at once. The great disaster of post-Soviet telephony happened not on the trunk and not on the bedside table, but in private branch exchanges: DISA mode—a call to a factory number, a pause, an internal dial tone, an access code, and you are making long-distance calls at the enterprise’s expense. Default codes: “9,” “0,” “1234”; newly installed Panasonic mini-PBXs from commercial kiosks—the same “1234” in the factory firmware. Moscow numbers were scanned for DISA tones, codes were tried in minutes, traffic was sold through chains of resellers, and exchange owners received bills for calls to Nauru that nobody had made. Arbitration courts were flooded with lawsuits. This was no longer blue boxes or AON—it was plain theft of traffic, and it ended only with digital exchanges featuring strict authentication and real-time billing.
The finale of the story is a rare case where bureaucracy looks more elegant than engineering. From September 1, 2005, MGTS enabled “digital AON” using the Western CLIP/FSK standard: the number arrived between the first and second ring, with no need to pick up the handset or exchange tonal signals, 10 digits instead of 7. In a year, the number of people paying for the service grew from 40 to 200 thousand—in a city where, eight years earlier, 370 thousand illegal “Rus’” units had been counted. The difference between “forbidden” and “legal” turned out to be purely a matter of price.
But hardware does not die that easily. For electromechanical exchanges limping on in the provinces, 500 Hz and “2 out of 6” remained the standard protocol until the very funeral of the step-by-step exchange. And on the shelves beside cordless phones, there is still the double label “AON up to 7 digits, Caller ID up to 10 digits”—a genuine artifact of two worlds colliding: the old one, where the telephone interrogates the exchange with a tone, and the new one, where the exchange itself voluntarily states the number.
I began this subject with the semi-folkloric formula “the Soviet AON is their blue box.” It proved half true, and the best way to understand why is to place the two architectures side by side.
Bell entrusted signaling to the voice channel—and got a vulnerability exploitable by anyone who could whistle into a handset. The USSR sealed long-distance signaling away from the subscriber completely—dedicated channels, 3825 Hz, battery interfaces—and left the blue box not a single chance. But on the subscriber line, that same principle of economy worked in reverse: by design, the AON protocol could not verify who was asking the question. We protect the perimeter for so long that we forget to ask who is knocking from inside.
The second lesson is about the fate of formats. Soviet AON was developed for one task—to bill long-distance calls correctly—and it was broken so that the bill would go to someone else. Along the way, the add-on managed to serve as a billiard table for the “Rus’-anti-AON-anti-anti-AON” race, survive State Committee for Communications bans, billing blockers, and its own legalization. And in the end—not die, but move into ISUP messages, where subscriber categories still live to this day. A format built on a simple, honest physical principle outlives both its infrastructure and its hackers longer than anything else.
And the third is the most engineering-minded of all. A provincial phreaker without the Internet reconstructed, using nothing but his ears and a frequency table, the same thing Joe Engressia found by whistling: a protocol without authentication is an invitation. A vulnerability is not a property of a frequency, nor a property of a country, but a property of trust. Until every party on the channel has to prove who it is, any system will sooner or later answer the questions of the first person it meets.