TAP YIPL/TAP_and_YIPL_Collection_CD.iso/PHREAK/BOXES/BOXREVW3.TXT

Text File | 1998-04-08 | 24KB | 433 lines

                               The Fixer
                                Presents

                             Colored Boxes
                             a 1998 Review

                              File 3 of 4
                            Tone Generators,
                      Bridges, Cheese and Gold Box


   .---------------------------------------------------------------.
   |                        Tone Generators                        |
   `---------------------------------------------------------------'

                                Blue Box
                     (Generates MF signaling tones)

   Since its invention in the early 1960's, more has been written, and
   more programs have been released, on the Blue Box than any other box.

   And no wonder; the Blue Box got spectacular press when it came to
   light in the early 1970's.  There are still a LOT of new text files
   and tone generators being written on the Blue Box, even though it is
   almost completely obsolete in North America and rapidly falling into
   obsolescence everywhere else.  In its heyday, Blue Boxing was like
   playing a guitar: easy to learn, difficult to master.  The masters of
   Blue Boxing had control of the toll network that the phone company's
   brightest engineers and security personnel could not understand.  The
   Joe-Average boxer (likely a college kid impressing friends and chicks or
   a mafioso who bought a box to avoid showing up on phone records) could
   make all the free calls he wanted, with no downside.

   The Blue Box, of course, is that box which siezes control of a toll
   trunk, giving the user the same abilities as a long-distance
   operator. There are now two problems with the Blue Box.  First, the
   system's technology has advanced so that most toll trunks no longer
   use the inband signaling (meaning: signaling is no longer done with
   audible tones) that Blue Boxes rely on.  There are still a precious
   few left in North America but they will be gone soon.  Second, every
   telco security person knows about Blue Boxes very well, and as a
   result, most local exchanges have tone detectors that will either cut
   off the call or sound an alarm or write an entry to a fraud log if
   you attempt to box.

   If you can box from an exchange that has no such detectors, and if you
   can find an inband toll trunk that you can get onto for free (1-800
   number, etc), and if you don't do it from a line where fraudulent
   calls can be traced back to you, THEN you can still blue box and do
   it safely.  Otherwise, you'll find that its day is long gone.

   Plausibility: 100% real.  These boxes were as real as the system they
                 cheated.
   Obsolescence: Almost total - Inband trunks exist but try and find one!
   Skill:        Difficult.  Somewhat complex to construct and use.
                 Usage is not as simple as dialing a phone.
   Risks:        Very High.  You will be caught if you use your own line.




                                 Green Box
                     (Generates Payphone Control Tones)

   The Green Box generates three tones, which are suspiciously the same
   as three particular Blue Box Tones.  The function of these tones were
   to command a payphone to return the caller's money, collect the money
   from a holding chamber into the main coin box, or to have the switch
   call the phone back.  The idea was that an operator would have some
   powers when dealing with payphone callers.

   These are described by text files as part of ACTS but really they are
   just selected MF bluebox tones.  Every blue box is also a green box.

   Although the files written about the green box are credible, the
   whole ACTS system is on its way out and the green box tones
   themselves were scrapped with inband signaling anyway (operators
   today DO NOT have blue boxes at their fingertips).  So green box
   tones no longer work.

   Plausibility: It was a real box but it was far more talked about than
                 actually used, so it's really now more the stuff of
                 legend than anything else.
   Obsolescence: Totally obsolete.  Correct me on this one if I'm wrong.
   Skill:        To build the tone generator would have taken some
                 doing, but taped or PC-Generated tones are a total
                 no-brainer.
   Risks:        Don't try it.  The phone company may have MF detectors
                 set up and think you're trying to blue box.




                                 Pearl Box
                               aka Smurf Box
                        (Variable SF Tone Generator)

   The Pearl Box just generates SF (Single Frequency) tones.  It features
   the ability to "dial up" a tone with a series of knobs, a scheme that
   does offer some precision once the settings for a particular frequency
   are known.

   The usefulness of a Pearl box is *very* limited, at least to a phreak.
   It can generate 2600 and 1850 cps, as well as other SF trunk control
   tones (2280 comes to mind).  But since Blue Boxing is dead anyway, and
   since a Blue Box already has the SF tones you need, a working phreak
   really wouldn't need a box like this.

   The Smurf Box is VAS's twist on the Pearl Box.  VAS correctly
   understands that an IBM-compatible PC can generate SF tones through its
   speaker, but they incorrectly assume that (a) you can connect it to a
   phone line directly without frying anything, (b) that the PC will
   generate SF tones to 32767 Hz, (c) that any phone system anywhere even
   uses SF tones outside the 300-3000 Hz voice band on inband signaling
   systems, (d) that the phone system will properly interpret your PC's
   square wave output when most phone tones use sine waves, and (e) that
   the human ear can only hear tones to 5010 Hz.  All of these things are
   wrong.  Anyway, a novice programmer can write a Pearl/Smurf Box program
   in GWBasic or Turbo Pascal in about 30 seconds, and you didn't need VAS
   to tell you that.

   Plausibility: Not much.  YES you can build a variable tone generator
                 but there's a reason why Esquire hasn't published any
                 articles called "Secrets Of The Little Pearl Box".
   Obsolescence: If you're checking the frequency response of your
                 stereo, it's not obsolete.  If you're blue boxing, then
                 the Pearl Box and the Blue Box and you for that matter
                 are all relics from the 1960's.  Watch Austin Powers a
                 few million times for a clue.
   Skill:        It's not a very complicated construction project but it
                 shouldn't be your first.
   Risks:        Since its use is limited to Blue Boxing, risks are the
                 same as for Blue Boxing.




                                  Red Box
                        (Generates ACTS coin tones)

   As much as the Blue Box was talked about in the 1970s and 1980s, the
   Red Box is the topic of discussion in the 1990s.  The Red Box makes
   the same tones that ACTS payphones use to signal the phone company
   that coins have been deposited.

   If you saw the movie "Hackers" you saw a crude approximation of how
   red box tones could once have been gathered straight from a payphone.
   This really doesn't work; you'll find the tones are muted if you try
   it.  The best way is to make them yourself with one of zillions of
   computer box tone generator programs out there.

   In order for red box tones to work, the payphone you are calling from
   has to be an ACTS payphone - it has to use Red Box tones itself.  The
   audio quality of the tones has to be good, not because of any
   anti-fraud devices the telco has set up but simply because the coin
   tone detectors have a narrow tolerance to avoid false detection of
   speech and background noise as coin tones.

   If an operator comes on and accuses you of boxing, it's because she
   was already listening.  The phone mutes the mic while playing its red
   box tones, she knows this and knows that there shouldn't be any
   street noise, bumping of a tape recorder into the handset, breathing,
   and other sounds while the tones play.  She also knows that the tones
   should be loud, clear and undistorted.  The system doesn't make those
   judgments; a human does and she does so only when the boxer's other
   messing around with the phone has triggered an exception alarm.  Or
   if you were calling long distance and your three minutes are up...

   The red box does still work and is still widely used; those who say
   it doesn't either don't have access to ACTS phones or played really
   bad tones.  It won't work at all on any phone where the party you're
   calling complains about really bad speech quality - those phones are
   likely to be marked "modified to prevent fraud" and the distortion from
   the mouthpiece is the means used to prevent red boxing on those phones.

   There are many, many text files on red box tones; the best method
   involves the use of a tape recorder and an acoustically-sealed (like
   an acoustic coupler modem) speaker for best sound quality and
   elimination of suspicious noise.  The worst methods involve
   "ingenious" means - whistles, recordable hallmark cards, modified
   pocket dialers, yada yada.  None of those things really work well and
   all involve the phreak spending extra money on junk, when the whole
   idea behind phreaking is to not spend money.

   Plausibility: 100 percent fact, and well documented.
   Obsolescence: Doesn't work everywhere, and gradually decreasing in
                 availability.  Forget it on COCOTs, Nortel Millennium
                 Payphones and any payphone not using the ACTS system.
   Skill:        Very little.  It's almost as easy as Razor and Blade
                 demonstrated in "Hackers."  That's probably why it gets so
                 much discussion.
   Risks:        Few if you are careful.  Don't mess with the phone and
                 no operators will come on.  Play good tones and it will
                 work.  And remember, any kind of payphone phreaking
                 that involves gadgets looks suspicious, so there is
                 always the risk that someone might see you and call the
                 police.




                               White Box
                   (Generates DTMF Tones - portable)
                               Silver Box
                (Generates DTMF Tones including A,B,C,D)

   The White Box and Silver Box are almost the same thing - both boxes
   produce the DTMF tones that every pushbutton phone uses.  The difference
   is that the White Box produces the 12 tones we are all familiar with,
   and the Silver Box produces an additional "column" of tones, normally
   placed to the right of the others, marked A, B, C, and D.

   The usefulness of both these boxes is quite limited.

   For starters, you can buy a proper white box at Radio Shack.  It's
   just a portable tone generator.  Amazing, then, that people have been
   arrested just for possessing this commonly available, perfectly legal
   device. Hell, I have even seen wristwatches with white boxes built
   in.  A white box is nothing more than a tone dialer.

   One of the misconceptions commonly put forth in Silver Box text files is
   that the A, B, C, and D tones are used by the military.  This is
   actually not quite true - the U.S. military used a completely different
   set of DTMF-like tones.  The military tones supported 16 keys like the
   extended DTMF but the frequencies were different.  The familiar 12
   buttons were on every phone, but they sounded different, and a fourth
   column of tones was used to prioritize calls.

   With that said, I find it inconceivable that no phone system anywhere
   out there aside from Autovon has fourth-column tones in use *somewhere*
   - for internal testing, and so on.  A, B, C, and D will break dial tone
   on most digital switches.  It's just that no one has published any
   inside information on this yet.

   If a way to take advantage of silver box tones ever surfaces, then
   building a hardware silver box may be worthwhile.  Until then, the
   tones themselves are a technical curiosity best left to computer tone
   generators.

   The Silver Box is sometimes also called a Gray Box.

   Plausibility: 100% real
   Obsolescence: Of little use to most phreaks.
   Skill:        Construction is average difficulty; single chip DTMF
                 generators are easy to find.  Usage is straightforward.
   Risks:        The phone company probably logs the use of tones that
                 subscribers are not supposed to have.



   .---------------------------------------------------------------.
   |                  Bridges, Cheese and Gold Box                 |
   `---------------------------------------------------------------'

                                 Brown Box
                      aka Conference Box aka Party Box
                         aka Switch Box aka Hoz Box
             (Joins 2 lines to effectively give 3 way calling)

   The [Conference] [Party] [Switch] [Hoz] [Brown] Box (hereinafter just
   called the Brown Box) joins together two lines to effectively give a
   3-way conversation.  If you already have two phone lines (for a BBS,
   fax, whatever) you can save the 50 cents per use charge on three-way
   calling by either building this box OR buy a 2-Line phone at Office
   Depot or Radio Shack that has a 3-way feature. Since you're not
   really stealing the three-way custom calling service, Brown Boxing is
   not fraud.  That's why you can buy 3-way 2-line phones on the open
   market.

   Of these boxes, the plans and description for the Conference Box is
   the only one worth paying any attention to.  Its ASCII diagram is
   easy to follow and it isolates the two lines with a 1:1 transformer,
   as they should be.  It's also the only text file which mentions that
   if you have 3-way calling on both lines, you can effectively get a
   5-way conversation going without anyone else in the conference having
   3-way calling.

   Note: Some text files have described a Brown Box as simply a homemade
         lineman's handset, or a Bud Box (see above).

   Plausibility: 100 percent real.
   Obsolescence: More pointless than obsolete.  Get a 2-line phone!
   Skill:        Some electronics skills useful.
   Risks:        Zero - perfectly legal.  The only way you could get in
                 trouble is if you screw up and damage your phone line.




                                 Cheese Box
   (creates an anonymous loop, purported to turn your phone into a payphone)

   There are two types of cheese box out there, and one seems to be getting
   much more coverage than the other, which is unfortunate because the
   first kind (more commonly seen) is bullshit. The textfile explains that
   the box is so named for the "kind of the box the first one was found in"
   but then goes on to describe something that isn't a box at all!

   The gist of the first cheese box type is that it effectively turns your
   phone into a payphone, untraceable and unreachable by law enforcement.
   This is accomplished by forwarding calls to an operator.

   The problem here is that no matter *who* or *what* you forward calls to,
   your own ANI and Caller ID data still get passed.  Traces still come
   back to you.  And incoming calls go to the operator.  It seems to me
   that it would make more sense to find a way to forward calls dialed to a
   payphone to your home number, if payphones had call forwarding.

   The second type of cheese box is a lot more believable.  It's an
   electronic device which connects two lines, much like a Gold Box, and
   makes them an anonymous loop.  Two people could call either line of this
   loop and not know the other's real phone number, which would have some
   privacy advantages.  If installed between two payphones, even a reverse
   directory lookup of the loop numbers would reveal nothing.  It is likely
   because payphones were used for this that the idea got perverted into
   the first type of box - after all, what use would it be to turn your
   line into a payphone?  Payphones in groups of two or more are common in
   public places, so there was an abundant supply - especially in big
   cities where bookies and organized crime families operate.

   Plausibility: Most of the textfiles you read on the Cheese Box aren't
                 worth the photons to read them.  Read the IIRG Cheese/Gold
                 Box file for the best description of the cheese box.
   Obsolescence: IIRG claims that the cheese box is obsolete but I see no
                 reason why even under ESS and DMS you couldn't still
                 cheesebox today.  Their rationale is that the old cheese
                 boxes included black boxes, which of course only work on
                 older Step by Step switches.  But with other ways of
                 calling for free, the black box part isn't necessary!  One
                 other note: you won't be able to use payphones marked
                 "Outgoing Calls Only".  These are getting more and more
                 common every day, which means that the obsolescence of
                 this box is increasing.
   Skill:        Construction of the device is comparable in difficulty to
                 the Gold Box, and installation would require stealth or a
                 good ruse.  Pose as a phone company technician with a fake
                 company ID tag (And look the part - 30+ years old,
                 clean shaven, short hair, work clothes & tool belt) and
                 no one will hassle you for messing with the payphones.
   Risks:        If the device were used too much, or if you were unlucky,
                 there's a chance someone trying to legitimately use one of
                 your payphones might report a problem to repair service,
                 who'd discover the box and likely alert telco security or
                 the police, who'd likely stake out the phones for a while
                 after.




                          Gold Box aka Divertor Box
          sometimes called Magenta Box or Slush Box or Dark Box
      (Joins two lines; call the first and get the second's dialtone)

   The Gold Box is a great idea that unfortunately is lost in the
   terrible quality of text files that have been written about it.

   The Gold Box joins together two phone lines.  You phone one, and
   immediately are connected to the other one's dial tone.  This, of
   course, has a few problems of its own.  For starters, if your victim
   expects calls to come in, all his normal callers will get his other
   line's dial tone.  They will then get a hold of him some other way
   and let him know of the problem.  Second, he's sure to hear at least
   an abortive mini-ring before the Gold Box picks up.  Some phones with
   electronic ringers will give a full-length ring even if it receives only
   a fractional pulse of ring voltage.  That would be suspicious to say the
   least.  Third, the Box's original design doesn't really have a way to
   terminate the call; your victim would be left with a phone line that
   does nothing but reorder shortly after your first call.  Some of the
   newer designs (after 1985 or so) will respond to the drop in line
   voltage that occurs after the person on the other end hangs up, and
   can terminate & reset that way.

   The Slush Box is an idea by Dispater (of Phrack fame).  It joins two
   business lines in a multi-line business phone system.  Call line 1,
   enter a password, get line 2.

   The solution, of course, is intelligent control of the Gold/Slush box
   by the phreak, and that is what Dispater was getting at (although I
   have never seen anything on the slush box beyond his proposal).

   Here's how I would design and implement something like this (although
   I am getting at the point of giving this box a low plausibility
   rating):  First, I would select at least one line that is not
   normally answered by a human.  A fax line, modem line, what have you.
   That would be the "hot" line which is called OUT from.  Call the
   "Hot" line and sound a tone.  The box I would use would be designed
   to listen for this tone with a PLL tone detector or something and
   when it hears it, would "activate" the box.  When the box is not
   active, both the "hot" and "cool" lines would function normally.
   When the box IS active, a call to the "cool" line causes the box to
   immediately "pick up" the phone and yield the "hot" line's dialtone.
   This would be best implemented against a business, a BBS or ISP, a
   person with a fax or modem line, etc.  The point is that the "hot"
   line has to be one where it is acceptable to the victim to receive
   calls that don't connect on a fairly regular basis, i.e. as often as
   you use the box.

   The Gold Box plans most people have read have none of these features
   and would therefore present a significant risk of detection - in
   which case a quick *69 would compromise you.

   Note that a properly designed Gold/Slush box would not allow the
   Telco to deliver your Caller ID data to the "cool" line, as pickup
   would normally occur instantly, before the signal could be
   transmitted.  Note also that the Caller ID data for the "Hot" line
   would be transmitted to the final dialing destination.  A devastating
   reality for blackmail/framing purposes.

   In 1988, someone named "Street Fighter" wrote a text file with a totally
   different design, that does the same thing as a Gold Box, and called it
   a "Magenta Box."  And in 1991, some plans emerged for a "Divertor
   Box" which specifically explain and handle the problem of call
   termination.  I have not verified either devices' functionality.

   Plausibility: The early plans don't work.  The IIRG plans are still
                 promoted by their authors, I don't know how well they
                 really work.  The basic concept, with development,
                 could work exceptionally well.  But be aware of
                 teenaged lamers who claim to be able to gold box you -
                 most teenaged hackers are NOT hardware hackers and
                 would never be able to make this box work.
   Obsolescence: As long as we have analog telephony, this is a
                 potentially effective method.
   Skill:        Design and construction of a box which would work to
                 this author's high standards would be an advanced
                 construction project requiring optimization of space
                 and power.  This is not for the beginner.
   Risks:        Installation involves some sort of prowling or false
                 pretense to gain initial physical access to the
                 victim's phone lines.  This is inherently somewhat
                 risky, depending on the skills of the installer.