During the mid 1900’s telephone companies where doing their best move away from having operators connect each individual call. As phone systems spread throughout the nations the system just didn’t scale well.

The original process of picking up the receiver and asking the operator to connect your call was pushed out. The solution that had gained traction was tonal commands. Beeps and boops from telephones would instruct central routers on how to handle a call, allowing a home phone to issue commands.

Like most people, I hadn’t really thought much about how my home phone worked, until one day a friend showed me that it was possible to dial numbers by clacking the “hang-up” button in quick succession.

So to dial 911:
Tap the “hang-up” button nine times, wait a moment, tap once, wait a moment, and once more. Boom, you are talking to dispatch.

This successive tapping is the same type of signal that rotary phones would use to send numbers to the switchboard machines. As the spring loaded wheel would return to its places it would send successive taps.

This trivial knowledge was useful once when attempting to use a payphone with a broken keypad and then never again in my life.

A telephone company’s routing computer would listen for more than just numbers being dialed. One piece of functionality was to listen for coins being inserted to a payphone.

A specific tone would play for each 5¢ value that was placed in the payphone and any media playback device could play these tones to get credit for a call.

Similarly it was possible to play a 2600hz tone allow for free calls to be placed.

Proof of Concept Steps:
Step 1: All phones of hung-up and nothing is happening.
Step 2: Attacker calls a toll-free number.
Step 3: Wait for the call to connect, then play a 2600 hz tone.
Step 4: Dial any new phone number, and get connected for free!

Technically what is happening?
When the E-signalling unit at the receiving side hears the 2600 hz tone, it thinks that the originating caller has hung up and it will release the call.
The originating trunk circuit still allows the call to stay connected and also allows audio to be passed from the phone.
When 2600hz tone stops playing on the line, the receiving E-signalling unit connects the caller to the trunk again, and will accept new input for dialing.

The above is a summary of this video:

So how does Cap’n Crunch fit into this?

In the 1960s Cap’n Crunch put a whistle prize in their cereal boxes that played a prefect 2600 hz if you sealed one of the two whistle holes.

df9999999999 has an amazing video demonstrating this bug:

You can still buy a piece of history today for a $100: https://www.ebay.com/itm/285741854935