336 lines
14 KiB
Plaintext
336 lines
14 KiB
Plaintext
|
File: BASIC TELCOM VI
|
|||
|
|
Read 22 times
|
|||
|
|
|
|||
|
|
******BIOC Agent 003's course in*******
|
|||
|
|
* *
|
|||
|
|
* ========================== *
|
|||
|
|
* =BASIC TELECOMMUNICATIONS= *
|
|||
|
|
* ========================== *
|
|||
|
|
* Part VI *
|
|||
|
|
***************************************
|
|||
|
|
|
|||
|
|
REVISED: 27-OCT-84
|
|||
|
|
|
|||
|
|
Preface:
|
|||
|
|
|
|||
|
|
This article will focus primarily on the standard Western Electric single- slot
|
|||
|
|
coin telephone (aka fortress fone) which can be divided into 3 types:
|
|||
|
|
|
|||
|
|
- Dial-Tone First (DTF)
|
|||
|
|
- Coin-First (CF): (ie, it wants your $ before you receive a dial tone)
|
|||
|
|
- Dial Post-Pay Service (PP): you pay after the party answers
|
|||
|
|
|
|||
|
|
|
|||
|
|
Depositing Coins (Slugs):
|
|||
|
|
-------------------------
|
|||
|
|
|
|||
|
|
Once you have deposited your slug into a fortress, it is subjected to a gamut
|
|||
|
|
of tests.
|
|||
|
|
|
|||
|
|
The first obstacal for a slug is the magnetic trap. This will stop any
|
|||
|
|
light-weight magnetic slugs and coins. If it passes this, the slug is then
|
|||
|
|
classified as a nickel, dime, or quarter. Each slug is then checked for
|
|||
|
|
appropriate size and weight. If these tests are passed, it will then travel
|
|||
|
|
through a nickel, dime, or quarter magnet as appropriate. These magnets set up
|
|||
|
|
an eddy current effect which causes coins of the appropriate characteristics to
|
|||
|
|
slow down so they will follow the correct trajectory. If all goes well, the
|
|||
|
|
coin will follow the correct path (such as bouncing off of the nickel anvil)
|
|||
|
|
where it will hopefully fall into the narrow accepted coin channel.
|
|||
|
|
|
|||
|
|
The rather elaborate tests that are performed as the coin travels down the coin
|
|||
|
|
chute will stop most slugs and other undesirable coins, such as pennies, which
|
|||
|
|
must then be retrieved using the coin release lever.
|
|||
|
|
|
|||
|
|
If the slug miraculously survives the gamut, it will then strike the
|
|||
|
|
appropriate totalizer arm causing a ratchet wheel to rotate once for every
|
|||
|
|
5-cent increment (eg, a quarter will cause it to rotate 5 times).
|
|||
|
|
|
|||
|
|
The totalizer then causes the coin signal oscillator to readout a dual-
|
|||
|
|
frequency signal indicating the value deposited to ACTS (a computer) or the
|
|||
|
|
TSPS operator. These are the same tones used by phreaks in the infamous red
|
|||
|
|
boxes.
|
|||
|
|
|
|||
|
|
For a quarter, 5 beep tones are outpulsed at 12-17 pulses per second (PPS). A
|
|||
|
|
dime causes 2 beep tones at 5 - 8.5 PPS while a nickel causes one beep tone at
|
|||
|
|
5 - 8.5 PPS. A beep consists of 2 tones: 2200 + 1700 Hz.
|
|||
|
|
|
|||
|
|
A relay in the fortress called the "B relay" (yes, there is also an 'A relay')
|
|||
|
|
places a capacitor across the speech circuit during totalizer read- out to
|
|||
|
|
prevent the "customer" from hearing the red box tones.
|
|||
|
|
|
|||
|
|
In older 3 slot phones: one bell (1050-1100 Hz) for a nickel, two bells for a
|
|||
|
|
dime, and one gong (800 Hz) for a quarter are used instead of the modern
|
|||
|
|
dual-frequency tones.
|
|||
|
|
|
|||
|
|
=============
|
|||
|
|
=TSPS & ACTS=
|
|||
|
|
=============
|
|||
|
|
|
|||
|
|
While fortresses are connected to the CO of the area, all transactions are
|
|||
|
|
handled via the Traffic Service Position System (TSPS). In areas that do not
|
|||
|
|
have ACTS, all calls that require operator assistance, such as calling card and
|
|||
|
|
collect, are automatically routed to a TSPS operator position.
|
|||
|
|
|
|||
|
|
In an effort to automate fortress service, a computer system known as Automated
|
|||
|
|
Coin Toll Service (ACTS) has been implemented in many areas. ACTS listens to
|
|||
|
|
the red box signals from the fones and takes appropriate action. It is ACTS
|
|||
|
|
which says, "Two dollars please (pause) Please deposit two dollars for the next
|
|||
|
|
ten seconds" (and other variations). Also, if you talk for more than three
|
|||
|
|
minutes and then hang-up, ACTS will call back and demand your money. ACTS is
|
|||
|
|
also responsible for Automated Calling Card Service.
|
|||
|
|
|
|||
|
|
ACTS also provide trouble diagnosis for craftspeople (repairmen specializing in
|
|||
|
|
fortresses). For example, there is a coin test which is great for tuning up
|
|||
|
|
red boxes. In many areas this test can be activated by dialing 09591230 at a
|
|||
|
|
fortress (thanks to Karl Marx for this information). Once activated it will
|
|||
|
|
request that you deposit various coins. It will then identify the coin and
|
|||
|
|
outpulse the appropriate red box signal. The coins are usually returned when
|
|||
|
|
you hang up.
|
|||
|
|
|
|||
|
|
To make sure that there is actually money in the fone, the CO initiates a
|
|||
|
|
"ground test" at various times to determine if a coin is actually in the fone.
|
|||
|
|
This is why you must deposit at least a nickel in order to use a red box!
|
|||
|
|
|
|||
|
|
Green Boxes:
|
|||
|
|
------------
|
|||
|
|
|
|||
|
|
Paying the initial rate in order to use a red box (on certain fortresses) left
|
|||
|
|
a sour taste in many red boxer's mouths thus the GREEN BOX was invented. The
|
|||
|
|
green box generates useful tones such as COIN COLLECT, COIN RETURN, and
|
|||
|
|
RINGBACK. These are the tones that ACTS or the TSPS operator would send to the
|
|||
|
|
CO when appropriate. Unfortunately, the green box cannot be used at a fortress
|
|||
|
|
station but it must be used by the CALLED party.
|
|||
|
|
|
|||
|
|
Here are the tones:
|
|||
|
|
|
|||
|
|
COIN COLLECT 700 + 1100 Hz
|
|||
|
|
COIN RETURN 1100 + 1700 Hz
|
|||
|
|
RINGBACK 700 + 1700 Hz
|
|||
|
|
|
|||
|
|
Before the called party sends any of these tones, an operator released signal
|
|||
|
|
should be sent to alert the MF detectors at the CO. This can be accomplished
|
|||
|
|
by sending 900 + 1500 Hz or a single 2600 Hz wink (90 ms) followed by a 60 ms
|
|||
|
|
gap and then the appropriate signal for at least 900 ms.
|
|||
|
|
|
|||
|
|
Also, do not forget that the initial rate is collected shortly before the 3
|
|||
|
|
minute period is up.
|
|||
|
|
|
|||
|
|
Incidentally, once the above MF tones for collecting and returning coins reach
|
|||
|
|
the CO, they are converted into an appropriate DC pulse (-130 volts for return
|
|||
|
|
& +130 volts for collect). This pulse is then sent down the tip to the
|
|||
|
|
fortress. This causes the coin relay to either return or collect the coins.
|
|||
|
|
|
|||
|
|
The alleged "T-Network" takes advantage of this information. When a pulse for
|
|||
|
|
COIN COLLECT (+130 VDC) is sent down the line, it must be grounded somewhere.
|
|||
|
|
This is usually either the yellow or black wire. Thus, if the wires are
|
|||
|
|
exposed, these wires can be cut to prevent the pulse from being grounded. When
|
|||
|
|
the three minute initial period is almost up, make sure that the black & yellow
|
|||
|
|
wires are severed; then hang up, wait about 15 seconds in case of a second
|
|||
|
|
pulse, reconnect the wires, pick up the fone, hang up again, and if all goes
|
|||
|
|
well it should be "JACKPOT" time.
|
|||
|
|
|
|||
|
|
Physical Attack:
|
|||
|
|
----------------
|
|||
|
|
|
|||
|
|
A typical fortress weighs roughly 50 lbs. with an empty coin box. Most of
|
|||
|
|
this is accounted for in the armor plating. Why all the security? Well, Bell
|
|||
|
|
contributes it to the following:
|
|||
|
|
|
|||
|
|
"Social changes during the 1960's made the multislot coin station a prime
|
|||
|
|
target for: vandalism, strong arm robbery, fraud, and theft of service. This
|
|||
|
|
brought about the introduction of the more rugged single slot coin station and
|
|||
|
|
a new environment for coin service."
|
|||
|
|
|
|||
|
|
As for picking the lock, I will quote Mr. Phelps: "We often fantasize about
|
|||
|
|
'picking the lock' or 'getting a master key.' Well, you can forget about it. I
|
|||
|
|
don't like to discourage people, but it will save you from wasting alot of your
|
|||
|
|
time--time which can be put to better use (heh, heh)."
|
|||
|
|
|
|||
|
|
As for physical attack, the coin plate is secured on all four side by hardened
|
|||
|
|
steel bolts which pass through two slots each. These bolts are in turn
|
|||
|
|
interlocked by the main lock.
|
|||
|
|
|
|||
|
|
One phreak I know did manage to take one of the 'mothers' home (which was
|
|||
|
|
attached to a piece of plywood at a construction site; otherwise, the permanent
|
|||
|
|
ones are a bitch to detach from the wall!). It took him almost ten hours to
|
|||
|
|
open the coin box using a power drill, sledge hammers, and crow bars (which was
|
|||
|
|
empty -- perhaps next time, he will deposit a coin first to hear if it slushes
|
|||
|
|
down nicely or hits the empty bottom with a clunk.)
|
|||
|
|
|
|||
|
|
Taking the fone offers a higher margin of success. Although this may be
|
|||
|
|
difficult often requiring brute force and there has been several cases of back
|
|||
|
|
axles being lost trying to take down a fone! A quick and dirty way to open the
|
|||
|
|
coin box is by using a shotgun. In Detroit, after ecologists cleaned out a
|
|||
|
|
municipal pond, they found 168 coin phone rifled.
|
|||
|
|
|
|||
|
|
In colder areas, such as Canada, some shrewd people tape up the fones using
|
|||
|
|
duct tape, pour in water, and come back the next day when the water will have
|
|||
|
|
froze thus expanding and cracking the fone open.
|
|||
|
|
|
|||
|
|
In one case, "unauthorized coin collectors" where caught when they brought
|
|||
|
|
$6,000 in change to a bank and the bank became suspicious...
|
|||
|
|
|
|||
|
|
At any rate, the main lock is an eight level tumbler located on the right side
|
|||
|
|
of the coin box. This lock has 390,625 possible positions (5 ^ 8, since there
|
|||
|
|
are 8 tumblers each with 5 possible positions) thus it is highly pick
|
|||
|
|
resistant! The lock is held in place by 4 screws. If there is sufficient
|
|||
|
|
clearance to the right of the fone, it is conceivable to punch out the screws
|
|||
|
|
using the drilling pattern below (provided by Alexander Mundy in TAP #32):
|
|||
|
|
|
|||
|
|
====================================
|
|||
|
|
!! ^
|
|||
|
|
!! !
|
|||
|
|
! 1- 3/16 " !! !
|
|||
|
|
!<--- --->!! 1-1/2"
|
|||
|
|
-------------------- !
|
|||
|
|
! ! !! ! !
|
|||
|
|
! (+) (+)-! -----------
|
|||
|
|
---! !! ! ^
|
|||
|
|
! ! !! ! !
|
|||
|
|
! ! (Z) !! ! !
|
|||
|
|
! ! !! ! 2-3/16"
|
|||
|
|
---! !! ! !
|
|||
|
|
! (+) (+) ! !
|
|||
|
|
! !! ! !
|
|||
|
|
-------------------- -----------
|
|||
|
|
!!
|
|||
|
|
!!
|
|||
|
|
(Z) Keyhole (+) Screws
|
|||
|
|
!!
|
|||
|
|
===================================
|
|||
|
|
|
|||
|
|
|
|||
|
|
After this is accomplished, the lock can be pushed backwards disengaging the
|
|||
|
|
lock from the cover plate. The four bolts of the cover plate can then be
|
|||
|
|
retracted by turning the boltworks with a simple key in the shape of the hole
|
|||
|
|
on the coin plate (see diagram below). Of course, there are other methods and
|
|||
|
|
drilling patterns.
|
|||
|
|
|
|||
|
|
:-------------------------------------:
|
|||
|
|
_
|
|||
|
|
! !
|
|||
|
|
( )
|
|||
|
|
!_!
|
|||
|
|
[roughly]
|
|||
|
|
Diagram of cover plate keyhole
|
|||
|
|
:-------------------------------------:
|
|||
|
|
|
|||
|
|
The top cover uses a similar (but not as strong) locking method with the
|
|||
|
|
keyhole depicted above on the top left side and a regular lock (probably
|
|||
|
|
tumbler also) on the top right-hand side. It is interesting to experiment with
|
|||
|
|
the coin shute and the fortresses own "red box" (which Bell didn't have the
|
|||
|
|
'balls' to color red).
|
|||
|
|
|
|||
|
|
Miscellaneous:
|
|||
|
|
--------------
|
|||
|
|
|
|||
|
|
In a few areas (rural & Canada), post- pay service exists. With this type of
|
|||
|
|
service, the mouthpiece is cut off until the caller deposits money when the
|
|||
|
|
called party answers. This also allows for free calls to weather and other
|
|||
|
|
DIAL-IT services! Recently, 2600 magazine announced the CLEAR BOX which
|
|||
|
|
consists of a telephone pickup coil and a small amp. It is based on the
|
|||
|
|
principal that the receiver is also a weak transmitter and that by amplifying
|
|||
|
|
your signal you can talk via the transmitter thus avoiding costly telephone
|
|||
|
|
charges!
|
|||
|
|
|
|||
|
|
Most fortresses are found in the 9xxx area. Under former Bell areas, they
|
|||
|
|
usually start at 98xx (right below the 99xx official series) and move downward.
|
|||
|
|
|
|||
|
|
Since the line, not the fone, determines whether or not a deposit must be made,
|
|||
|
|
DTF & Charge-A-Call fones make great extensions!
|
|||
|
|
|
|||
|
|
Finally, fortress fones allow for a new hobby--instruction plate collecting.
|
|||
|
|
All that is required is a flat-head screwdriver and a pair of needle-nose
|
|||
|
|
pliers. Simply use the screwdriver to lift underneath the plate so that you
|
|||
|
|
can grab it with the pliers and yank downwards. I would suggest covering the
|
|||
|
|
tips of the pliers with electrical tape to prevent scratching. Ten cent plates
|
|||
|
|
are definitely becoming a "rarity!"
|
|||
|
|
|
|||
|
|
Fortress Security:
|
|||
|
|
------------------
|
|||
|
|
|
|||
|
|
While a lonely fortress may seem the perfect target, beware! The Gestapo has
|
|||
|
|
been known to stake out fortresses for as long as 6 years according to the
|
|||
|
|
Grass Roots Quarterly. To avoid any problems, do not use the same fones
|
|||
|
|
repeatedly for boxing, calling cards, & other experiments. The telco knows how
|
|||
|
|
much money should be in the coin box and when its not there they tend to get
|
|||
|
|
perturbed (read: pissed off).
|
|||
|
|
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|||
|
|
|
|||
|
|
Disclaimer:
|
|||
|
|
-----------
|
|||
|
|
|
|||
|
|
The preceding is intended for "information purposes only" and I do not advocate
|
|||
|
|
that you participate in any subversive activities...
|
|||
|
|
|
|||
|
|
|
|||
|
|
Coming sooner or later:
|
|||
|
|
-----------------------
|
|||
|
|
|
|||
|
|
Part VII will deal with blue boxing.
|
|||
|
|
|
|||
|
|
|
|||
|
|
References/Suggested Reading:
|
|||
|
|
-----------------------------
|
|||
|
|
|
|||
|
|
Various hard-to-find Bell System publications.
|
|||
|
|
|
|||
|
|
"Alternate Method of Opening the Fortress Phone Coin Box," Alexander Mundy, TAP
|
|||
|
|
#32.
|
|||
|
|
|
|||
|
|
"Build a T-Network for Fun & Profit," TAP #15.
|
|||
|
|
|
|||
|
|
"Coiners & Other Thieves," The Phone Book, J. Edgar Hyde, pp 88-91.
|
|||
|
|
|
|||
|
|
"Fortress Fun-ding," TAP #66.
|
|||
|
|
|
|||
|
|
"The Green & Brown Box," Ted Veil & Nick Haflinger, TAP #68.
|
|||
|
|
|
|||
|
|
"Introducing the Clear Box!," 2600, July 1984.
|
|||
|
|
|
|||
|
|
"More Fortress Fun," TAP #49
|
|||
|
|
|
|||
|
|
"Notes on the Network," AT&T, 1980, [The definitive technical reference
|
|||
|
|
guide!].
|
|||
|
|
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|||
|
|
|
|||
|
|
2600:
|
|||
|
|
Box 752
|
|||
|
|
Middle Island, NY 11953
|
|||
|
|
|
|||
|
|
Subscriptions: $10/year (published monthly)
|
|||
|
|
Last Issue (as of 10/27/84): October 1984
|
|||
|
|
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|||
|
|
|
|||
|
|
TAP:
|
|||
|
|
Room 603
|
|||
|
|
147 W 42 Street
|
|||
|
|
New York, NY 10036
|
|||
|
|
|
|||
|
|
Subscriptions: $10/10 issues or so (published sporadically since 1971)
|
|||
|
|
Last Issue (as of 10/27/84): January/February 1984 [#90]
|
|||
|
|
|
|||
|
|
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
|||
|
|
*****BIOC (p) 1984 BIOC
|
|||
|
|
*=$=*Agent International, Ltd.
|
|||
|
|
*****003
|
|||
|
|
|
|||
|
|
October 6, 1984
|
|||
|
|
|
|||
|
|
<<=-FARGO 4A-=>>
|
|||
|
|
|
|||
|
|
[Sherwood Forest ][ - (914) 359-1517]
|
|||
|
|
[20 Megs On-Line]
|
|||
|
|
|
|||
|
|
PS Sysops of BBS's are welcome to use this material providing that nothing is
|
|||
|
|
altered.
|
|||
|
|
|
|||
|
|
PPS Any and all threats, comments, corrections, suggestions, & subpoenas are
|
|||
|
|
welcome.
|
|||
|
|
|
|||
|
|
-----End of File
|
|||
|
|
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open
|
|||
|
|
|