textfiles/phreak/BOXES/tollfrau.phk

			$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
			$				      $
			$  ---------------------------------  $
			$  ! ELECTRONIC TOLL FRAUD DEVICES !  $
			$  !-------------------------------!  $
			$				      $
			$				      $
			$	 Typed and Uploaded by:       $
			$				      $
			$$$$$$$$$$$$-=>Lex Luthor<=-$$$$$$$$$$$
			$				      $
			$				      $
			$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$


This phile is designed to identify various kinds of ETF (electronic toll fraud)
devices and to describe thier operation, according to a bookled put out by Bell
entitled:  THE INVESTIGATION AND PROSECUTION OF ELECTRONIC TOLL FRAUD DEVICES.
(For official use only).


The characteristics of each type of device are discussed below.


-=-=-=-=-=-=-=-=-=-=-= =-=-=-=-=-=-=-=-

*BLUE BOX*
----- ----

The "Blue Box" was so named because of the color of the first one found.  The
design and hardware used in the Blue Box is fairly sophisticated, and its size
varies from a large piece of apparatus to a miniaturized unit that is
approximately the size of a "king size" package of cigarettes.

The Blue Box contains 12 or 13 buttons or switches that emit multi- frequency
tones characteristic of the tones used in the normal operation of the telephone
toll (long distance) switching network.  The Blue Box enables its user to
originate fraudulent ("free") toll calls by circumventing toll billing
equipment.  The Blue Box may be directly connected to a phone line, or it may
be acoustically coupled to a telephone handset by placing the Blue Box's
speaker next to the trans mitter or the telephone handset.  The operation of a
Blue Box will be dis- cussed in more detail below.

To understand the nature of a fraudulent Blue Box call, it is necessary to
understand the basic operation of the Direct Distance Dialing (DDD) telephone
network.  When a DDD call is properly originated, the calling number is
identified as an integral part of establishing the connection.	This may be
done either automatically or, in some cases, by an operator asking the calling
party for his telephone number.  This information is entered on a tape in the
Automatic Message Accounting (AMA) office.  This tape also contains t+number
assigned to the trunk line over which the aall is to be sent.  The information
relating to the call contained on the tape includes:  called number
indentification , time of origination of call, and info that the called number
answered + call.  The time of disconnect at the end of the call is also
reForded.

Although the tape contains info with respect to many different calls, the
various data entries with respect to a single call are eventually correlated to
provide billing info for use by your Bell's accounting department.

The typical Blue Box user usually dials a number that will route the call into
the telephone network without charge.  For example, the user will very often
call a well-known INWATS (toll- free) customer's number.  The Blue Box user,
after gaining this access to the network and, in effect, "seizing" control
qcomplete dominion over the line, operates a key on the Blue Box which emits a
2600 Hertz (cycles per second) tone.This tone causes the switching equipment to
release the conn ection to the INWATS customer's line.  The 2600Hz tone is a
signal that the calling party has hung up.  The Blue Box simulates this
condition.  However, in fact the lo,1trunk on the calling party's end is still
connected to the toll network.	The Blue Box user now oterates the "KP" (Key
Pulse) key on the Blue Box to notify the toll switch- ing equipment that
switching signals are about to be emitted.  The user then pushes the "number"
buttons on the Blue Box corresponding to the telephone # being called.	After
doing so he/she operates the "ST" (Start) key to indicate to the switching
equipment that signalling is complete.	If the call is completed, only the
portion of the original call prior to the emission of 2600Hz tone is recorded
on the AMA tape.  The tones emitted by the Blue Box are not recorded on the AMA
tape.  There foref, because the original call to the INWATS # is toll-free, no
billing is rendered in connection with the call.

Although the above is a description og a typical Blue Box operation using a
common method of entry into the network, the operation of a Blue Box may vary
in any one or all of the following respects:

(a) The Blue Box may include a rotary dial to apply the 2600Hz tone and the
switching signals.  This type of Blue Box is called a "dial pulser" or
"rotarySF" Blue box.

(b) Entrance into the DDD toll network may be effected by a pretext call to any
other toll-free # such as Universal Directory ASSistance (555-1212) or any # in
the INWATS network, either inter-state or intra- state, working or non-working.

(c) Entrance into the DDD toll network may also be in the form of "short haul"
calling.  A "short haul" call is a call to any # which will result in a lesser
amount of toll charges than the charges for the call to be completed by the
Blue Box.  For example, a call to Birmingham from Atlanta may cost $.80 for the
first 3 minutes while a call from Atlanta to Los Angeles is $1.85 for 3
minutes.  Thus, a short haul, 3-minute call to Birmingham from Atlanta,
switched by use of a Blue Box to Los Angeles, would result in a net fraud of
$1.05 for a 3 minute call.

(d) A Blue Box may be wired into the telephone line or acoustically coupled by
placing the speaker of the Blue Box near the transmitter of the phone handset.
The Blue Box may even be built inside a regular Touch-Tone phone, using the
phone's pushbuttons for the Blue Box's signalling tones.

(e) A magnetic tape recording may be used to record the Blue Box tones
representative of specific phone #'s.  Such a tape recording could be used in
lieu of a Blue Box to fraud- ulently place calls to the phone #'s recorded on
the magnetic tape.


All Blue Boxes, except "dial pulse" or "Rotary SF" Blue Boxes, must have the
following 4 common operating capabilities:

(a) It must have signalling capability in the form of a 2600Hz tone.  This tone
is used by the toll network to indicate, either by its presence or its absence,
an "on hook" (idle) or "off hook" (busy) condition of the trunk.

(b) The Blue Box must have a "KP" tones that unlocks or readies the
multi-frequency reciever at the called end to receive the tones corresponding
to the called phone #.

(c) The typical Blue Box must be able to emit MF tones which are used to
transmit phone #'s over the toll network.  Each digit of a phone # is
represented by a combination of 2 tones .  For example, the digit 2 is x-mitted
by a combination of 700Hz and 1100Hz.

(d) The Blue Box must have an "ST" key which consists of a combina- tion of 2
tones that tell the equipment at the called end that all digits have been sent
and that the equipment should start switching the call to the called number.

The "Dial Pulser" or "Rotary SF" Blue Box requires only a dial with a
signalling capability to produce a 2600Hz tone.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

*BLACK BOX*
------ ----


This ETF device is so-named because of the color of the first one found.  It
varies in size and usually has one or two switches or buttons.	Attached to the
telephone line of a called party, the Black Box provides toll-free calling *to*
that party's line.  A Black Box user informs other persons beforehand that they
will not be charged for any call placed to him.  The user then operates the
device causing a "non-charge" condition ("no answer" or "disconnect") to be
recorded on the telphone company's billing equip ment.  A Black Box is
relatively simple to construct and is much less sophisti- cated than a Blue
Box.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

*Cheese Box*
------- ----


This device is so-named for the container in which the first one was found.
Its design may be crude or very sophisticated.	Its size varies; one was found
the size of a half-dollar.

A Cheese Box is used most often by bookmakers or betters to place wagers
without detection from a remote location.  The device inter-connects 2 phone
lines, each having different #'s but each terminating at the same location.  In
effect, there are 2 phones at the same location which are linked together
through a Cheese Box.  It is usually foundn in an unoccupied apartment
connected to a phone jack or connecting block.	The bookmaker, at some remote
location, dials one of the numbers and stays on the line.  Various bettors dial
the other number but are automatically connected with the book maker by means
of the Cheese Box inter connection.  If, in addition to a cheese box, a Black
Box is included in the arrangement, the combined equipment would permit
toll-free calling on either line to the other line.  If a police raid were
conducted at the terminating point of the conversations -the location of the
Cheese Box- there would be no evidence of gambling activity.  This device is
sometimes difficult to identify.  Law enforcement officials have been advised
that when unusual devices are found associated with telephone connections the
phone company security representitives should be contacted to assist in
indentification.  (This probably would be good for a BBS , especially with the
Black Box set up.  and if you ever decided to take the board down, you wouldn't
have to change your phone #.  It also makes it so you yourself cannot be
traced.  I am not sure about calling out from one though)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

*RED BOX*
---- ----

This device it coupled acoustically to the handset transmitter of a single-
slot coin telephone.  The device emits signals identical to those tones emitted
when coins are deposited.  Thus, local or toll calls may be placed without the
actual deposit of coins.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


$$$$$$$$$$$$-=>Lex Luthor<=-$$$$$$$$$$$


OFF THE WALL (20 MEG)	   303 443-3367
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open