Hacker 2/HACKER2.mdf/phreak/bioc.6

Text File | 1995-01-03 | 14KB | 488 lines

***************************************
*     BIOC Agent 003's course in      *
*                                     *
*     =BASIC TELECOMMUNICATIONS=      *
*                                     *
*               PART 6                *
***************************************

REVISED:  27-OCT-84

Preface:

This article will focus primarily on
the standard Western Electric single-
slot coin telephone (aka fortress fone)
which can be divided into 3 types:

- Dial-Tone First (DTF)

- Coin-First (CF):  (ie, it wants your
  $ before you receive a dial tone)

- Dial Post-Pay Service (PP):  you pay
  after the party answers


Depositing Coins (Slugs):
-------------------------

Once you have deposited your slug into
a fortress, it is subjected to a
gamut of tests.

The first obstacal for a slug is the
magnetic trap.  This will stop any
light-weight magnetic slugs and coins.
If it passes this, the slug is then
classified as a nickel, dime, or
quarter.  Each slug is then checked for
appropriate size and weight.  If these
tests are passed, it will then travel
through a nickel, dime, or quarter
magnet as appropriate.  These magnets
set up an eddy current effect which
causes coins of the appropriate
characteristics to slow down so they
will follow the correct trajectory.  If
all goes well, the coin will follow the
correct path (such as bouncing off of
the nickel anvil) where it will
hopefully fall into the narrow accepted
coin channel.

The rather elaborate tests that are
performed as the coin travels down the
coin chute will stop most slugs and
other undesirable coins, such as
pennies, which must then be retrieved
using the coin release lever.

If the slug miraculously survives the
gamut, it will then strike the
appropriate totalizer arm causing a
ratchet wheel to rotate once for every
5-cent increment (eg, a quarter will
cause it to rotate 5 times).

The totalizer then causes the coin
signal oscillator to readout a dual-
frequency signal indicating the value
deposited to ACTS (a computer) or the
TSPS operator. These are the same tones
used by phreaks in the infamous red
boxes.

For a quarter, 5 beep tones are
outpulsed at 12-17 pulses per second
(PPS).  A dime causes 2 beep tones at
5 - 8.5 PPS while a nickel causes one
beep tone at 5 - 8.5 PPS.  A beep
consists of 2 tones:  2200 + 1700 Hz.

A relay in the fortress called the "B
relay" (yes, there is also an 'A
relay') places a capacitor across the
speech circuit during totalizer read-
out to prevent the "customer" from
hearing the red box tones.

In older 3 slot phones:  one bell (1050
-1100 Hz) for a nickel, two bells for a
dime, and one gong (800 Hz) for a
quarter are used instead of the modern
dual-frequency tones.

=============
=TSPS & ACTS=
=============

While fortresses are connected to the
CO of the area, all transactions are
handled via the Traffic Service
Position System (TSPS).  In areas that
do not have ACTS, all calls that
require operator assistance, such as
calling card and collect, are
automatically routed to a TSPS operator
position.

In an effort to automate fortress
service, a computer system known as
Automated Coin Toll Service (ACTS) has
been implemented in many areas.  ACTS
listens to the red box signals from the
fones and takes appropriate action.  It
is ACTS which says, "Two dollars please
(pause) Please deposit two dollars for
the next ten seconds" (and other
variations). Also, if you talk for more
than three minutes and then hang-up,
ACTS will call back and demand your
money.  ACTS is also responsible for
Automated Calling Card Service.

ACTS also provide trouble diagnosis for
craftspeople (repairmen specializing in
fortresses).  For example, there is a
coin test which is great for tuning up
red boxes.  In many areas this test can
be activated by dialing 09591230 at a
fortress (thanks to Karl Marx for this
information).  Once activated it will
request that you deposit various coins.
It will then identify the coin and
outpulse the appropriate red box
signal.  The coins are usually returned
when you hang up.

To make sure that there is actually
money in the fone, the CO initiates a
"ground test" at various times to
determine if a coin is actually in the
fone.  This is why you must deposit at
least a nickel in order to use a red
box!

Green Boxes:
------------

Paying the initial rate in order to
use a red box (on certain fortresses)
left a sour taste in many red boxer's
mouths thus the GREEN BOX was invented.
The green box generates useful tones
such as COIN COLLECT, COIN RETURN, and
RINGBACK.  These are the tones that
ACTS or the TSPS operator would send to
the CO when appropriate. Unfortunately,
the green box cannot be used at a
fortress station but it must be used by
the CALLED party.

Here are the tones:

     COIN COLLECT       700 + 1100 Hz
     COIN RETURN       1100 + 1700 Hz
     RINGBACK           700 + 1700 Hz

Before the called party sends any of
these tones, an operator released
signal should be sent to alert the MF
detectors at the CO.  This can be
accomplished by sending 900 + 1500 Hz
or a single 2600 Hz wink (90 ms)
followed by a 60 ms gap and then the
appropriate signal for at least 900 ms.

Also, do not forget that the initial
rate is collected shortly before the 3
minute period is up.

Incidentally, once the above MF tones
for collecting and returning coins
reach the CO, they are converted into
an appropriate DC pulse (-130 volts for
return & +130 volts for collect). This
pulse is then sent down the tip to the
fortress.  This causes the coin relay
to either return or collect the coins.

The alleged "T-Network" takes advantage
of this information.  When a pulse for
COIN COLLECT (+130 VDC) is sent down
the line, it must be grounded
somewhere.  This is usually either the
yellow or black wire.  Thus, if the
wires are exposed, these wires can be
cut to prevent the pulse from being
grounded.  When the three minute
initial period is almost up, make sure
that the black & yellow wires are
severed; then hang up, wait about 15
seconds in case of a second pulse,
reconnect the wires, pick up the fone,
hang up again, and if all goes well it
should be "JACKPOT" time.

Physical Attack:
----------------

A typical fortress weighs roughly 50
lbs. with an empty coin box.  Most of
this is accounted for in the armor
plating.  Why all the security?  Well,
Bell contributes it to the following:

  "Social changes during the 1960's
made the multislot coin station a prime
target for:  vandalism, strong arm
robbery, fraud, and theft of service.
This brought about the introduction of
the more rugged single slot coin
station and a new environment for coin
service."

As for picking the lock, I will quote
Mr. Phelps:  "We often fantasize about
'picking the lock' or 'getting a master
key.'  Well, you can forget about it.
I don't like to discourage people, but
it will save you from wasting alot of
your time--time which can be put to
better use (heh, heh)."

As for physical attack, the coin plate
is secured on all four side by hardened
steel bolts which pass through two
slots each.  These bolts are in turn
interlocked by the main lock.

One phreak I know did manage to take
one of the 'mothers' home (which was
attached to a piece of plywood at a
construction site; otherwise, the
permanent ones are a bitch to detach
from the wall!).  It took him almost
ten hours to open the coin box using a
power drill, sledge hammers, and crow
bars (which was empty -- perhaps next
time, he will deposit a coin first to
hear if it slushes down nicely or hits
the empty bottom with a clunk.)

Taking the fone offers a higher margin
of success.  Although this may be
difficult often requiring brute force
and there has been several cases of
back axles being lost trying to take
down a fone!  A quick and dirty way to
open the coin box is by using a
shotgun.  In Detroit, after ecologists
cleaned out a municipal pond, they
found 168 coin phone rifled.

In colder areas, such as Canada, some
shrewd people tape up the fones using
duct tape, pour in water, and come back
the next day when the water will have
froze thus expanding and cracking the
fone open.

In one case, "unauthorized coin
collectors" where caught when they
brought $6,000 in change to a bank and
the bank became suspicious...

At any rate, the main lock is an eight
level tumbler located on the right side
of the coin box.  This lock has 390,625
possible positions (5 ^ 8, since there
are 8 tumblers each with 5 possible
positions) thus it is highly pick
resistant!  The lock is held in place
by 4 screws.  If there is sufficient
clearance to the right of the fone, it
is conceivable to punch out the screws
using the drilling pattern below
(provided by Alexander Mundy in TAP
#32):

 ====================================
                     !!        ^
                     !!        !
         ! 1- 3/16 " !!        !
         !<---   --->!!      1-1/2"
     --------------------      !
     !   !           !! !      !
     !  (+)         (+)-! -----------
  ---!               !! !      ^
  !  !               !! !      !
  !  !        (Z)    !! !      !
  !  !               !! !   2-3/16"
  ---!               !! !      !
     !  (+)         (+) !      !
     !               !! !      !
     -------------------- -----------
                     !!
                     !!
      (Z) Keyhole   (+) Screws
                     !!
  ===================================


After this is accomplished, the lock
can be pushed backwards disengaging
the lock from the cover plate.  The
four bolts of the cover plate can then
be retracted by turning the boltworks
with a simple key in the shape of the
hole on the coin plate (see diagram
below).  Of course, there are other
methods and drilling patterns.

:-------------------------------------:

                  ! !
                  ( )
                  !
               [roughly]
    Diagram of cover plate keyhole
:-------------------------------------:

The top cover uses a similar (but not
as strong) locking method with the
keyhole depicted above on the top left
side and a regular lock (probably
tumbler also) on the top right-hand
side. It is interesting to experiment
with the coin shute and the fortresses
own "red box" (which Bell didn't have
the 'balls' to color red).

Miscellaneous:
--------------

In a few areas (rural & Canada), post-
pay service exists.  With this type of
service, the mouthpiece is cut off
until the caller deposits money when
the called party answers.  This also
allows for free calls to weather and
other DIAL-IT services!  Recently, 2600
magazine announced the CLEAR BOX which
consists of a telephone pickup coil and
a small amp.  It is based on the
principal that the receiver is also a
weak transmitter and that by amplifying
your signal you can talk via the
transmitter thus avoiding costly
telephone charges!

Most fortresses are found in the 9xxx
area.  Under former Bell areas, they
usually start at 98xx (right below the
99xx official series) and move
downward.

Since the line, not the fonE,
determines whether or not a deposit
must be made, DTF & Charge-A-Call fones
make great extensions!

Finally, fortress fones allow for a new
hobby--instruction plate collecting.
All that is required is a flat-head
screwdriver and a pair of needle-nose
pliers.  Simply use the screwdriver to
lift underneath the plate so that you
can grab it with the pliers and yank
downwards. I would suggest covering the
tips of the pliers with electrical tape
to prevent scratching.  Ten cent plates
are definitely becoming a "rarity!"

Fortress Security:
------------------

While a lonely fortress may seem the
perfect target, beware!  The Gestapo
has been known to stake out fortresses
for as long as 6 years according to the
Grass Roots Quarterly.  To avoid any
problems, do not use the same fones
repeatedly for boxing, calling cards, &
other experiments.  The telco knows how
much money should be in the coin box
and when its not there they tend to get
perturbed (read:  pissed off).

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Disclaimer:
-----------

The preceding is intended for
"information purposes only" and I do
not advocate that you participate in
any subversive activities...


Coming sooner or later:
-----------------------

Part VII will deal with blue boxing.


References/Suggested Reading:
-----------------------------

Various hard-to-find Bell System
publications.

"Alternate Method of Opening the
Fortress Phone Coin Box," Alexander
Mundy, TAP #32.

"Build a T-Network for Fun & Profit,"
TAP #15.

"Coiners & Other Thieves," The Phone
Book, J. Edgar Hyde, pp 88-91.

"Fortress Fun-ding," TAP #66.

"The Green & Brown Box," Ted Veil &
Nick Haflinger, TAP #68.

"Introducing the Clear Box!," 2600,
July 1984.

"More Fortress Fun," TAP #49

"Notes on the Network," AT&T, 1980,
[The definitive technical reference
guide!].

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

2600:

Box 752
Middle Island, NY 11953

Subscriptions:  $10/year
                    (published monthly)

Last Issue (as of 10/27/84):
                           October 1984

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

TAP:

Room 603
147 W 42 Street
New York, NY 10036

Subscriptions:  $10/10 issues or so
    (published sporadically since 1971)

Last Issue (as of 10/27/84):
            January/February 1984 [#90]

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Acknowledgements:  Hertz Tone, Tuc,
& Karl Marx.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

*****BIOC           (p) 1984 BIOC
*=$=*Agent          International, Ltd.
*****003

Created: October 6, 1984

           <<=-FARGO 4A-=>>