Starting in the mid-1960s, boxes of Cap'n Crunch came with a prize: a little plastic bosun's whistle. Kids blew it at their siblings. A handful of curious people blew it into a telephone, and got free long-distance calls.
The magic number was 2600
The whistle happened to produce a clean 2,600 hertz tone. AT&T's long-distance network used that exact tone internally to signal that a trunk line was free. Play it into the mouthpiece and the network assumed you were part of the network. From there, the right sequence of tones let you route a call almost anywhere, without paying for it.
The people who figured this out were called phone phreaks. One of them, John Draper, liked the whistle trick so much he took the nickname "Captain Crunch."
From whistles to blue boxes
Whistles were hit-or-miss, so phreaks built "blue boxes," small electronic devices that generated the tones on demand. A 1971 Esquire article about them caught the attention of two young guys in California named Steve Wozniak and Steve Jobs. Their first business together was building and selling blue boxes. Jobs later said there probably wouldn't have been an Apple without them.
It didn't end well for everyone. Draper served time for toll fraud, and the phone company eventually redesigned the network so the trick stopped working.
The real bug: control and content on the same wire
The underlying flaw has a name: in-band signaling. The network's control signals traveled on the same channel as the customer's voice, so a customer could speak the network's language. That same mistake still shows up today. It's the root of a whole family of attacks where user input gets treated as instructions. Fifty years later, we're still learning not to let the content give orders.
Go see one
A collection of the original whistles is on display at the Telephone Museum in Waltham, Massachusetts. Wozniak's handmade blue box is at the Computer History Museum in Mountain View, California.