366 lines
16 KiB
Plaintext
366 lines
16 KiB
Plaintext
|
R e n e g a d e L e g i o n
|
|||
|
|
T e c h n i c a l R e p o r t s
|
|||
|
|
|
|||
|
|
|
|||
|
|
Technical Report #2
|
|||
|
|
|
|||
|
|
....
|
|||
|
|
........
|
|||
|
|
.........
|
|||
|
|
... ....
|
|||
|
|
... ....
|
|||
|
|
.....
|
|||
|
|
....
|
|||
|
|
....
|
|||
|
|
... ...
|
|||
|
|
... ...
|
|||
|
|
.. ...
|
|||
|
|
...
|
|||
|
|
|
|||
|
|
February 1991
|
|||
|
|
|
|||
|
|
Report Number: 4.0
|
|||
|
|
|
|||
|
|
COCOTS: Uses for privatly operated public telephones. How to make free calls
|
|||
|
|
use their maintenance features, and plans for a tone dialer to fool
|
|||
|
|
COCOT security systems.
|
|||
|
|
|
|||
|
|
Compiled : 03/25/91
|
|||
|
|
Author : Count Zero
|
|||
|
|
System : COCOT Payphones
|
|||
|
|
Uses : Free calling to most of the world
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
-RL-----------------------------------------------------------------Page 1
|
|||
|
|
|
|||
|
|
|
|||
|
|
So you're walking down the street and you see a payphone gotta make an
|
|||
|
|
important call, so you dig into your pocket to get a dime picking up the
|
|||
|
|
handset, you suddenly notice that the payphone wants a QUARTER for a local
|
|||
|
|
call! What the hell, and WHERE did this synthesized voice come from?
|
|||
|
|
|
|||
|
|
Let's make this phile short and to the point a COCOT is an acronym for
|
|||
|
|
Customer Owned Coin Operated Telefone in other words, a COCOT is a fone
|
|||
|
|
OWNED or RENTED by a PAYING CUSTOMER (most likely, a hotel or donut shop) a
|
|||
|
|
COCOT is NOT a normal payfone the Telco doesn't own it, and the actual fone
|
|||
|
|
line is usually a normal customer loop (unlike payfones, where the fone line
|
|||
|
|
is a "special" payfone loop, allowing the use of "coin tones" to indicate
|
|||
|
|
money dropped in more on this later) SO!..A COCOT may LOOK and SMELL like
|
|||
|
|
a telco payphone, but it is NOT.
|
|||
|
|
|
|||
|
|
* Why do COCOTs exist?
|
|||
|
|
|
|||
|
|
Simple $$$$$$$! A customer owned payfone is money in the bank! You pay
|
|||
|
|
MORE for local calls and long distance is typically handled by sleazy
|
|||
|
|
carriers that offer bad/EXPENSIVE service the owner/renter of the COCOT opens
|
|||
|
|
the coinbox and keeps the money him/herself! Also, a particularly SLEAZY
|
|||
|
|
quality of a COCOT is the fact that it DOES NOT RECIEVE INCOMING CALLS this,
|
|||
|
|
of course, is because of $$ if people are calling IN to a COCOT, the COCOT
|
|||
|
|
is not making money and businesses always want to make as much $$ as
|
|||
|
|
possible...even if it hurts the consumer (think about it..it REALLY sucks
|
|||
|
|
calling someone at home from a COCOT, then not be able to have him/her call
|
|||
|
|
you back to save $$ "Guess I'll have to keep feeding the COCOT quarters!")
|
|||
|
|
|
|||
|
|
* Where is a good place to look for COCOTs?
|
|||
|
|
|
|||
|
|
Outside Dunkin Donut shops, restaurants, clubs, bars, and outside/inside
|
|||
|
|
hotels "convenient" locations
|
|||
|
|
|
|||
|
|
|
|||
|
|
* How do I figure out if I have found a COCOT?
|
|||
|
|
|
|||
|
|
Simple a COCOT will have NO TELCO LOGOS on it no New England Telephone
|
|||
|
|
symbols it may look just like a Telco fone chrome, with blue stickers and
|
|||
|
|
all that ALSO a COCOT typically charges MORE for a local call than a regular
|
|||
|
|
Telco payfone (in Massachusetts, local calls are a dime, in places like NYC,
|
|||
|
|
they are 25 cents.) a COCOT will most often have a synthesized voice that
|
|||
|
|
asks you to "please deposit 25 cents" or whatever ALSO some FaNcY COCOTS
|
|||
|
|
will not look like payfones at all some in hotels have weird LCD displays
|
|||
|
|
and look totally different but the ALWAYS charge you more than a normal
|
|||
|
|
payphone.
|
|||
|
|
|
|||
|
|
* OK, I found this weird payphone in Boston that wants a quarter, and this
|
|||
|
|
synthesized voice is harassing me when does the phun begin?
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
-RL-----------------------------------------------------------------Page 2
|
|||
|
|
|
|||
|
|
Soon..first of all, you must understand that the COCOT is a mimic.
|
|||
|
|
Essentially, it wants you to think that it is just a plain ol' payfone pick
|
|||
|
|
up the handset..hear that dialtone? hah! that dialtone is fake, synthesized
|
|||
|
|
by the innards of the COCOT you are at the mercy of the COCOT. Remember
|
|||
|
|
a COCOT runs off of a normal customer loop so unlike a Telco payphone where
|
|||
|
|
you must deposit money to generate coin tones that are read by the CO, the
|
|||
|
|
security of a COCOT depends solely on the COCOT fone itself its as if you
|
|||
|
|
took your own fone and put a sign on it saying "Please put 10 cents in this
|
|||
|
|
jar for every call you make." COCOTS are not naiive they won't let you near
|
|||
|
|
the unrestricted dialtone until you fork over the cash-ola heh heh. Or so
|
|||
|
|
they THINK!
|
|||
|
|
|
|||
|
|
See, the Achilles heel of the COCOT is the FACT that ALL PAYFONES MUST LET
|
|||
|
|
YOU MAKE 1-800 CALLS FOR FREE! It's not just a fact, it's the LAW so, now
|
|||
|
|
pick up the handset again and place a 1-800 call any 1-800 number will do.
|
|||
|
|
When they answer at the other end, just sit there do nothing ignore them.
|
|||
|
|
wait for them to hang up the fone here's an example.
|
|||
|
|
|
|||
|
|
<DIAL 1-800-LOAN-YES>
|
|||
|
|
|
|||
|
|
<Ring, Ring>.....<click> "Hello, you wanna buy some money? Hello? HELLO?!"
|
|||
|
|
|
|||
|
|
<CLICK>
|
|||
|
|
|
|||
|
|
<You will now hear some static and probably a strange "waffling" noise, like
|
|||
|
|
chh,chh,chh,chh,chh>
|
|||
|
|
|
|||
|
|
<CLICK>......DIALTONE!
|
|||
|
|
|
|||
|
|
NOW!.what have we got here? a dialtone? yes, you guessed it, the dialtone
|
|||
|
|
you now hear is the UNRESTRICED dialtone of the COCOT's customer loop.
|
|||
|
|
|
|||
|
|
* So what?..So I got an "unrestricted dialtone"...big deal?
|
|||
|
|
|
|||
|
|
Meathead! with an UNRESTRICTED dialtone, all you need to do is place a call
|
|||
|
|
via DTMF tones (the tones a touch-tone keypad generates) now, try dialing a
|
|||
|
|
number with the COCOTs keypad WHOA! waitasec, no sound! this is a typical
|
|||
|
|
lame attempt at protection by the COCOT. Just whip out your Radio Shack
|
|||
|
|
pocket tone dialer, and try calling a number ANY number place it just as
|
|||
|
|
if you were calling from a home phone call a 1-900 sex line call Guam you
|
|||
|
|
are FREE and the COCOTs customer loop is being billed!
|
|||
|
|
|
|||
|
|
|
|||
|
|
***NOTE: some COCOTS are more sophisticated at protecting themselves..some
|
|||
|
|
will RESET when they hear the dialtone to get around this, make a loud
|
|||
|
|
hissing sound with your mouth into the mouthpiece after the 1-800 number hangs
|
|||
|
|
up also, get your tone dialer ready near the mouthpiece when u hear the
|
|||
|
|
dialtone, quickly dial the first digit of your number to call if you hiss
|
|||
|
|
loudly enough, you MAY be able to mask the sound of the dialtone and prevent
|
|||
|
|
the COCOT from resetting and once you dial the first digit of the number
|
|||
|
|
you are calling, the dialtone will disappear (naturally) ok, you can stop
|
|||
|
|
hissing like an idiot now finish dialing your PHREE fone call.
|
|||
|
|
|
|||
|
|
Also, some COCOTs actually disable the handset after a call hangs up
|
|||
|
|
(in other words, you can't send DTMF tones thru the mouthpiece) oh well,
|
|||
|
|
better luck next time.
|
|||
|
|
|
|||
|
|
-RL-----------------------------------------------------------------Page 3
|
|||
|
|
|
|||
|
|
|
|||
|
|
HOWEVER MOST of the COCOTs I have run across ONLY disable the DTMF keypad..
|
|||
|
|
so all you need is a pocket dialer to circumvent this!
|
|||
|
|
|
|||
|
|
OTHER THINGS TO KNOW: Sure, you can't call a COCOT, but it DOES have a number
|
|||
|
|
to find out the COCOT's number, call 1-800-933-3258..this automated ANI
|
|||
|
|
service will tell you the number you're dialing from now, try calling the
|
|||
|
|
COCOT from another fone you will hear one of 2 things:
|
|||
|
|
|
|||
|
|
1) synthesized voice "Thank you"...CLICK..<hang up>
|
|||
|
|
2) weird carrier
|
|||
|
|
|
|||
|
|
A COCOT's number is ONLY used by the company that BUILT the COCOT by calling
|
|||
|
|
up a COCOT, a tech. can monitor its functioning, etc in case (1), you must
|
|||
|
|
enter a 3 or 4 digit password and then you'll get into a voice menu driven
|
|||
|
|
program that'll let you do "maintenance" stuff with the COCOT in case (2),
|
|||
|
|
you are hooked to the COCOT's 300 bps modem (YES, a MODEM in a PAYFONE)..
|
|||
|
|
likewise, if you can figure out the communication settings, you'll be into the
|
|||
|
|
COCOT's maintenance routines.
|
|||
|
|
|
|||
|
|
Personally, I haven't had much luck (or patience) with calling up and hacking
|
|||
|
|
COCOT maintenance functions. I just like making free fone calls from 'em!
|
|||
|
|
|
|||
|
|
|
|||
|
|
COCOT ETIQUETTE:
|
|||
|
|
Now, remember, you are making free fone calls but SOMEONE has to pay for
|
|||
|
|
'em...and that is the OWNER the COCOT's customer loop is billed the cost of
|
|||
|
|
the calls, and if the OWNER sees a big difference in the profits made on the
|
|||
|
|
COCOT (profit=coins from COCOT - bill from Telco for customer loop)..they'll
|
|||
|
|
know SOMETHING is up so moral is DON'T ABUSE THEM! don't call a 1-900
|
|||
|
|
number and stay on the line for 12 hours! If a COCOT is abused SEVERLY, an
|
|||
|
|
owner will eventually LOSE money on the damn thing!, and that means BYE BYE
|
|||
|
|
COCOT also, remember that a RECORD of ALL LONG DISTANCE calls is made to the
|
|||
|
|
COCOT's customer loop..and COCOT companies will sometimes investigate "billing
|
|||
|
|
discrepencies" so don't call anyone you personally know unless you are
|
|||
|
|
sure they are "cool".
|
|||
|
|
|
|||
|
|
<RING RING> "Hello?"
|
|||
|
|
|
|||
|
|
"Hello...this is Cointel, Inc....we'd like to ask you a few
|
|||
|
|
questions about a call you received from Boston on 2/12/91.
|
|||
|
|
Could you tell us the name and address of the person who
|
|||
|
|
placed the call?"
|
|||
|
|
|
|||
|
|
COOL dude -> "What?...I don't remember...go to hell! <SLAM>"
|
|||
|
|
MEATHEAD -> "Uh, sure, his name is John Smith...you want his address too?"
|
|||
|
|
|
|||
|
|
Get the picture? Good...
|
|||
|
|
|
|||
|
|
COCOTs are a great resource if we use them wisely like our environment, we
|
|||
|
|
gotta be careful not to plunder them make a few long distance calls and
|
|||
|
|
then leave that particular COCOT alone for awhile chances are, your bills
|
|||
|
|
will be "absorbed" by the profit margin of the owner and probably ignored
|
|||
|
|
but the smaller the owner's profit margin gets,the more likely suspicions will
|
|||
|
|
be aroused 'nuff said!
|
|||
|
|
|
|||
|
|
|
|||
|
|
-RL-----------------------------------------------------------------Page 4
|
|||
|
|
|
|||
|
|
|
|||
|
|
I have found COCOTs EVERYWHERE some of my personal favorites are on Route 1
|
|||
|
|
North of Boston check out the Dunkin Donut shops and the Burger King also,
|
|||
|
|
in front of the Rat in Kenmore look around they are lurking everywhere.
|
|||
|
|
(BUT..COCOT technology is relatively new..don't expect them EVERYWHERE..I know
|
|||
|
|
many towns that have NONE..check out big cities....) Here are some numbers of
|
|||
|
|
COCOTs:
|
|||
|
|
Kenmore Square,Boston,MA The Rat
|
|||
|
|
617/247-8195
|
|||
|
|
617/247-7913
|
|||
|
|
617/247-8208
|
|||
|
|
617/247-9437
|
|||
|
|
|
|||
|
|
Random ones: 617/720-4430 617/233-9872
|
|||
|
|
|
|||
|
|
Here are some companies that deal with COCOTs...try out your social
|
|||
|
|
engineering skill on them:
|
|||
|
|
|
|||
|
|
Cointel, Inc. Int'l Telecharge, Inc.
|
|||
|
|
130 Broadway St. P.O. Box 50579
|
|||
|
|
Somerville, MA Dallas, TX
|
|||
|
|
02145 1800/999-5152
|
|||
|
|
1800/322-7741
|
|||
|
|
|
|||
|
|
|
|||
|
|
As for a Tone Dialer, don't leave home without one!...a true phreak always has
|
|||
|
|
a DTMF tone dialer at hand..along with a red box!....My personal favorite is
|
|||
|
|
the COMBO-BOX (red box plus DTMF) take a Radio Shack 33-memory Pocket Dialer..
|
|||
|
|
open up the back...remove the little 3.579 MHz crystal (looks like a metal
|
|||
|
|
cylinder..unsolder it)...solder on a couple of thin, insulated wires where the
|
|||
|
|
crystal was attached...thread the wires thru one of the "vents" in the back of
|
|||
|
|
the tone dialer....get ahold of a 6.5536 MHz crystal (available thru Fry's
|
|||
|
|
Electronics, 89 cents a piece, phone number 415/770-3763)..go out and get some
|
|||
|
|
quick drying epoxy and a Radio Shack mini Toggle Switch, DPDT, cat. no 275-626
|
|||
|
|
|
|||
|
|
Close the tone dialer, with the two wires sticking out one of the back vents..
|
|||
|
|
screw it up tight...now, attact the crystals and wires to the switch like this
|
|||
|
|
with solder:
|
|||
|
|
I^^^^^I
|
|||
|
|
I xx <3.579 crystal>small one
|
|||
|
|
I I
|
|||
|
|
toggle switch -> oooooo X xxxxs <two wires>
|
|||
|
|
I I
|
|||
|
|
I xx <6.5536 crystal>big one
|
|||
|
|
I I
|
|||
|
|
^^^^^^
|
|||
|
|
|
|||
|
|
Each "xx" prong in the diagram is actually TWO prongs....hook up the two leads
|
|||
|
|
from the crystals to separate prongs (same with the wires).
|
|||
|
|
|
|||
|
|
Now, epoxy this gizmo to the side of the tone dialer use ALOT of epoxy, as you
|
|||
|
|
must make the switch/crystals essentially EMBEDDED in epoxy resin. like this:
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
-RL-----------------------------------------------------------------Page 5
|
|||
|
|
|
|||
|
|
|
|||
|
|
Front View -> ----------------------
|
|||
|
|
I I T <-toggle switch
|
|||
|
|
I oo oo oo I---
|
|||
|
|
I I |
|
|||
|
|
I I---
|
|||
|
|
I 1 2 3 I B s <-two crystals(b=big,s=small)
|
|||
|
|
I I | in epoxy "blob"
|
|||
|
|
I 4 5 6 I _
|
|||
|
|
I I
|
|||
|
|
I 7 8 9 I ^two wires running to back of unit
|
|||
|
|
I I
|
|||
|
|
I * 0 # I
|
|||
|
|
I I
|
|||
|
|
----------------------
|
|||
|
|
|
|||
|
|
----------------------
|
|||
|
|
Back View -> I I
|
|||
|
|
T I o ---- o-----------------------vent (1 of 4)
|
|||
|
|
--- I / \ I
|
|||
|
|
| I | -----------------speaker
|
|||
|
|
--- I | | I
|
|||
|
|
s B I | | I
|
|||
|
|
2 wires -> \-----o ---- o I
|
|||
|
|
running into I I
|
|||
|
|
vent I I
|
|||
|
|
I I
|
|||
|
|
I I
|
|||
|
|
I I
|
|||
|
|
----------------------
|
|||
|
|
|
|||
|
|
Make sure the epoxy is really gobbed on there..you want to be certaint the
|
|||
|
|
switch and crystals are firmly attached and secure in a matrix of epoxy (it
|
|||
|
|
doesn't conduct electricity, so don't worry about shorting out the connections
|
|||
|
|
to the toggle switch)...just don't gum up the action of the switch!
|
|||
|
|
|
|||
|
|
Basically, you've altered the device so you can select between 2 crystals to
|
|||
|
|
generate the timing for the microprocessor in the tone dialer...
|
|||
|
|
|
|||
|
|
Now turn on the tone dialer NOW, you can easily switch between the 2 crystal
|
|||
|
|
types the small crystal will generate ordinary DTMF tones but, by simply
|
|||
|
|
flicking the switch, you generate HIGHER tones now, using the memory function
|
|||
|
|
of the tone dialer, save 5 "*" in the P1 location, now dial the P1 location
|
|||
|
|
using the BIG crystal, sure sounds like the tones for a QUARTER, doesn't it!
|
|||
|
|
|
|||
|
|
Carry this around with you always will come in handy with both Telco payphones
|
|||
|
|
AND COCOTs! no Phreak should be without one!
|
|||
|
|
|
|||
|
|
Anyway, that about wraps it up for me references for this article include
|
|||
|
|
Noah Clayton's EXCELLENT article on COCOTs in 2600 Magazine, Autumn 1990..
|
|||
|
|
also, The Plague's article on Tone Dialer conversion to Red Box, 2600
|
|||
|
|
Magazine, Summer 1990 (Which inspired me to create the COMBO-BOX (red box PLUS
|
|||
|
|
DTMF dialer)...I strongly urge people to subscribe to 2600 Magazine...call
|
|||
|
|
their office line for more details ->516/751-2600...
|
|||
|
|
Remember..you can READ all you want, but if you don't get your ASS out
|
|||
|
|
there and try stuff out for yourself, you are nothing but a POSER!
|
|||
|
|
|
|||
|
|
-RL-----------------------------------------------------------------Page 6
|
|||
|
|
|
|||
|
|
|
|||
|
|
Enough said...oh, also, I heard that SOME COCOTs have handsets in them
|
|||
|
|
that can be accessed..in other words, you call the COCOT and if you hit
|
|||
|
|
"0" or something else, the earpiece of the handset is activated and you can
|
|||
|
|
listen in on what's goin on around the COCOT...I dunno...never worked for me,
|
|||
|
|
but try these 2 "suspected" numbers...212/268-7538, -6129..try hitting "0" and
|
|||
|
|
listen for any sounds...I could be wrong, I could be right..I could be black,
|
|||
|
|
I could be white....
|
|||
|
|
|
|||
|
|
That's all folks remember, the purpose of this phile is to ENLIGHTEN, and I
|
|||
|
|
in no way condone or encourage illegal activities...so don't blame me for
|
|||
|
|
ANY MESS you get into this phile offered strictly as INFORMATIONAL ONLY! I
|
|||
|
|
am in no way responsible for your ass!
|
|||
|
|
Also, I am not into wanton destruction, vandalism, or fraud..seek the truth,
|
|||
|
|
and leave nothing but footsteps.
|
|||
|
|
|
|||
|
|
Remember...SHARE THE WEALTH...INFORMATION IS POWER...SHARE IT!
|
|||
|
|
|
|||
|
|
And drink massive amounts of Jolt cola...trust me, it's good for you.
|
|||
|
|
|
|||
|
|
|
|||
|
|
Keep the faith, and never stop searching for new frontiers....
|
|||
|
|
|
|||
|
|
..................................
|
|||
|
|
|
|||
|
|
..oooOO Count Zero OOooo..
|
|||
|
|
|
|||
|
|
..................................
|
|||
|
|
|
|||
|
|
|
|||
|
|
-RL-----------------------------------------------------------------Page 7
|
|||
|
|
EOF
|
|||
|
|
|
|||
|
|
|