367 lines
16 KiB
Plaintext
367 lines
16 KiB
Plaintext
R e n e g a d e L e g i o n
|
||
T e c h n i c a l R e p o r t s
|
||
|
||
|
||
|
||
|
||
....
|
||
........
|
||
.........
|
||
... ....
|
||
... ....
|
||
.....
|
||
....
|
||
....
|
||
... ...
|
||
... ...
|
||
.. ...
|
||
...
|
||
|
||
|
||
|
||
Report Number: 4.0
|
||
|
||
COCOTS: Uses for privatly operated public telephones. How to make free calls
|
||
use their maintenance features, and plans for a tone dialer to fool
|
||
COCOT security systems.
|
||
|
||
Compiled : 03/25/91
|
||
Author : Count Zero
|
||
System : COCOT Payphones
|
||
Uses : Free calling to most of the world
|
||
|
||
|
||
|
||
-RL-----------------------------------------------------------------Page 1
|
||
|
||
|
||
So you're walking down the street and you see a payphone gotta make an
|
||
important call, so you dig into your pocket to get a dime picking up the
|
||
handset, you suddenly notice that the payphone wants a QUARTER for a local
|
||
call! What the hell, and WHERE did this synthesized voice come from?
|
||
|
||
Let's make this phile short and to the point a COCOT is an acronym for
|
||
Customer Owned Coin Operated Telefone in other words, a COCOT is a fone
|
||
OWNED or RENTED by a PAYING CUSTOMER (most likely, a hotel or donut shop) a
|
||
COCOT is NOT a normal payfone the Telco doesn't own it, and the actual fone
|
||
line is usually a normal customer loop (unlike payfones, where the fone line
|
||
is a "special" payfone loop, allowing the use of "coin tones" to indicate
|
||
money dropped in more on this later) SO!..A COCOT may LOOK and SMELL like
|
||
a telco payphone, but it is NOT.
|
||
|
||
* Why do COCOTs exist?
|
||
|
||
Simple $$$$$$$! A customer owned payfone is money in the bank! You pay
|
||
MORE for local calls and long distance is typically handled by sleazy
|
||
carriers that offer bad/EXPENSIVE service the owner/renter of the COCOT opens
|
||
the coinbox and keeps the money him/herself! Also, a particularly SLEAZY
|
||
quality of a COCOT is the fact that it DOES NOT RECIEVE INCOMING CALLS this,
|
||
of course, is because of $$ if people are calling IN to a COCOT, the COCOT
|
||
is not making money and businesses always want to make as much $$ as
|
||
possible...even if it hurts the consumer (think about it..it REALLY sucks
|
||
calling someone at home from a COCOT, then not be able to have him/her call
|
||
you back to save $$ "Guess I'll have to keep feeding the COCOT quarters!")
|
||
|
||
* Where is a good place to look for COCOTs?
|
||
|
||
Outside Dunkin Donut shops, restaurants, clubs, bars, and outside/inside
|
||
hotels "convenient" locations
|
||
|
||
|
||
* How do I figure out if I have found a COCOT?
|
||
|
||
Simple a COCOT will have NO TELCO LOGOS on it no New England Telephone
|
||
symbols it may look just like a Telco fone chrome, with blue stickers and
|
||
all that ALSO a COCOT typically charges MORE for a local call than a regular
|
||
Telco payfone (in Massachusetts, local calls are a dime, in places like NYC,
|
||
they are 25 cents.) a COCOT will most often have a synthesized voice that
|
||
asks you to "please deposit 25 cents" or whatever ALSO some FaNcY COCOTS
|
||
will not look like payfones at all some in hotels have weird LCD displays
|
||
and look totally different but the ALWAYS charge you more than a normal
|
||
payphone.
|
||
|
||
* OK, I found this weird payphone in Boston that wants a quarter, and this
|
||
synthesized voice is harassing me when does the phun begin?
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
-RL-----------------------------------------------------------------Page 2
|
||
|
||
Soon..first of all, you must understand that the COCOT is a mimic.
|
||
Essentially, it wants you to think that it is just a plain ol' payfone pick
|
||
up the handset..hear that dialtone? hah! that dialtone is fake, synthesized
|
||
by the innards of the COCOT you are at the mercy of the COCOT. Remember
|
||
a COCOT runs off of a normal customer loop so unlike a Telco payphone where
|
||
you must deposit money to generate coin tones that are read by the CO, the
|
||
security of a COCOT depends solely on the COCOT fone itself its as if you
|
||
took your own fone and put a sign on it saying "Please put 10 cents in this
|
||
jar for every call you make." COCOTS are not naiive they won't let you near
|
||
the unrestricted dialtone until you fork over the cash-ola heh heh. Or so
|
||
they THINK!
|
||
|
||
See, the Achilles heel of the COCOT is the FACT that ALL PAYFONES MUST LET
|
||
YOU MAKE 1-800 CALLS FOR FREE! It's not just a fact, it's the LAW so, now
|
||
pick up the handset again and place a 1-800 call any 1-800 number will do.
|
||
When they answer at the other end, just sit there do nothing ignore them.
|
||
wait for them to hang up the fone here's an example.
|
||
|
||
<DIAL 1-800-LOAN-YES>
|
||
|
||
<Ring, Ring>.....<click> "Hello, you wanna buy some money? Hello? HELLO?!"
|
||
|
||
<CLICK>
|
||
|
||
<You will now hear some static and probably a strange "waffling" noise, like
|
||
chh,chh,chh,chh,chh>
|
||
|
||
<CLICK>......DIALTONE!
|
||
|
||
NOW!.what have we got here? a dialtone? yes, you guessed it, the dialtone
|
||
you now hear is the UNRESTRICED dialtone of the COCOT's customer loop.
|
||
|
||
* So what?..So I got an "unrestricted dialtone"...big deal?
|
||
|
||
Meathead! with an UNRESTRICTED dialtone, all you need to do is place a call
|
||
via DTMF tones (the tones a touch-tone keypad generates) now, try dialing a
|
||
number with the COCOTs keypad WHOA! waitasec, no sound! this is a typical
|
||
lame attempt at protection by the COCOT. Just whip out your Radio Shack
|
||
pocket tone dialer, and try calling a number ANY number place it just as
|
||
if you were calling from a home phone call a 1-900 sex line call Guam you
|
||
are FREE and the COCOTs customer loop is being billed!
|
||
|
||
|
||
***NOTE: some COCOTS are more sophisticated at protecting themselves..some
|
||
will RESET when they hear the dialtone to get around this, make a loud
|
||
hissing sound with your mouth into the mouthpiece after the 1-800 number hangs
|
||
up also, get your tone dialer ready near the mouthpiece when u hear the
|
||
dialtone, quickly dial the first digit of your number to call if you hiss
|
||
loudly enough, you MAY be able to mask the sound of the dialtone and prevent
|
||
the COCOT from resetting and once you dial the first digit of the number
|
||
you are calling, the dialtone will disappear (naturally) ok, you can stop
|
||
hissing like an idiot now finish dialing your PHREE fone call.
|
||
|
||
Also, some COCOTs actually disable the handset after a call hangs up
|
||
(in other words, you can't send DTMF tones thru the mouthpiece) oh well,
|
||
better luck next time.
|
||
|
||
-RL-----------------------------------------------------------------Page 3
|
||
|
||
|
||
HOWEVER MOST of the COCOTs I have run across ONLY disable the DTMF keypad..
|
||
so all you need is a pocket dialer to circumvent this!
|
||
|
||
OTHER THINGS TO KNOW: Sure, you can't call a COCOT, but it DOES have a number
|
||
to find out the COCOT's number, call 1-800-933-3258..this automated ANI
|
||
service will tell you the number you're dialing from now, try calling the
|
||
COCOT from another fone you will hear one of 2 things:
|
||
|
||
1) synthesized voice "Thank you"...CLICK..<hang up>
|
||
2) weird carrier
|
||
|
||
A COCOT's number is ONLY used by the company that BUILT the COCOT by calling
|
||
up a COCOT, a tech. can monitor its functioning, etc in case (1), you must
|
||
enter a 3 or 4 digit password and then you'll get into a voice menu driven
|
||
program that'll let you do "maintenance" stuff with the COCOT in case (2),
|
||
you are hooked to the COCOT's 300 bps modem (YES, a MODEM in a PAYFONE)..
|
||
likewise, if you can figure out the communication settings, you'll be into the
|
||
COCOT's maintenance routines.
|
||
|
||
Personally, I haven't had much luck (or patience) with calling up and hacking
|
||
COCOT maintenance functions. I just like making free fone calls from 'em!
|
||
|
||
|
||
COCOT ETIQUETTE:
|
||
Now, remember, you are making free fone calls but SOMEONE has to pay for
|
||
'em...and that is the OWNER the COCOT's customer loop is billed the cost of
|
||
the calls, and if the OWNER sees a big difference in the profits made on the
|
||
COCOT (profit=coins from COCOT - bill from Telco for customer loop)..they'll
|
||
know SOMETHING is up so moral is DON'T ABUSE THEM! don't call a 1-900
|
||
number and stay on the line for 12 hours! If a COCOT is abused SEVERLY, an
|
||
owner will eventually LOSE money on the damn thing!, and that means BYE BYE
|
||
COCOT also, remember that a RECORD of ALL LONG DISTANCE calls is made to the
|
||
COCOT's customer loop..and COCOT companies will sometimes investigate "billing
|
||
discrepencies" so don't call anyone you personally know unless you are
|
||
sure they are "cool".
|
||
|
||
<RING RING> "Hello?"
|
||
|
||
"Hello...this is Cointel, Inc....we'd like to ask you a few
|
||
questions about a call you received from Boston on 2/12/91.
|
||
Could you tell us the name and address of the person who
|
||
placed the call?"
|
||
|
||
COOL dude -> "What?...I don't remember...go to hell! <SLAM>"
|
||
MEATHEAD -> "Uh, sure, his name is John Smith...you want his address too?"
|
||
|
||
Get the picture? Good...
|
||
|
||
COCOTs are a great resource if we use them wisely like our environment, we
|
||
gotta be careful not to plunder them make a few long distance calls and
|
||
then leave that particular COCOT alone for awhile chances are, your bills
|
||
will be "absorbed" by the profit margin of the owner and probably ignored
|
||
but the smaller the owner's profit margin gets,the more likely suspicions will
|
||
be aroused 'nuff said!
|
||
|
||
|
||
-RL-----------------------------------------------------------------Page 4
|
||
|
||
|
||
I have found COCOTs EVERYWHERE some of my personal favorites are on Route 1
|
||
North of Boston check out the Dunkin Donut shops and the Burger King also,
|
||
in front of the Rat in Kenmore look around they are lurking everywhere.
|
||
(BUT..COCOT technology is relatively new..don't expect them EVERYWHERE..I know
|
||
many towns that have NONE..check out big cities....) Here are some numbers of
|
||
COCOTs:
|
||
Kenmore Square,Boston,MA The Rat
|
||
617/247-8195
|
||
617/247-7913
|
||
617/247-8208
|
||
617/247-9437
|
||
|
||
Random ones: 617/720-4430 617/233-9872
|
||
|
||
Here are some companies that deal with COCOTs...try out your social
|
||
engineering skill on them:
|
||
|
||
Cointel, Inc. Int'l Telecharge, Inc.
|
||
130 Broadway St. P.O. Box 50579
|
||
Somerville, MA Dallas, TX
|
||
02145 1800/999-5152
|
||
1800/322-7741
|
||
|
||
|
||
As for a Tone Dialer, don't leave home without one!...a true phreak always has
|
||
a DTMF tone dialer at hand..along with a red box!....My personal favorite is
|
||
the COMBO-BOX (red box plus DTMF) take a Radio Shack 33-memory Pocket Dialer..
|
||
open up the back...remove the little 3.579 MHz crystal (looks like a metal
|
||
cylinder..unsolder it)...solder on a couple of thin, insulated wires where the
|
||
crystal was attached...thread the wires thru one of the "vents" in the back of
|
||
the tone dialer....get ahold of a 6.5536 MHz crystal (available thru Fry's
|
||
Electronics, 89 cents a piece, phone number 415/770-3763)..go out and get some
|
||
quick drying epoxy and a Radio Shack mini Toggle Switch, DPDT, cat. no 275-626
|
||
|
||
Close the tone dialer, with the two wires sticking out one of the back vents..
|
||
screw it up tight...now, attact the crystals and wires to the switch like this
|
||
with solder:
|
||
I^^^^^I
|
||
I xx <3.579 crystal>small one
|
||
I I
|
||
toggle switch -> oooooo X xxxxs <two wires>
|
||
I I
|
||
I xx <6.5536 crystal>big one
|
||
I I
|
||
^^^^^^
|
||
|
||
Each "xx" prong in the diagram is actually TWO prongs....hook up the two leads
|
||
from the crystals to separate prongs (same with the wires).
|
||
|
||
Now, epoxy this gizmo to the side of the tone dialer use ALOT of epoxy, as you
|
||
must make the switch/crystals essentially EMBEDDED in epoxy resin. like this:
|
||
|
||
|
||
|
||
|
||
|
||
-RL-----------------------------------------------------------------Page 5
|
||
|
||
|
||
Front View -> ----------------------
|
||
I I T <-toggle switch
|
||
I oo oo oo I---
|
||
I I |
|
||
I I---
|
||
I 1 2 3 I B s <-two crystals(b=big,s=small)
|
||
I I | in epoxy "blob"
|
||
I 4 5 6 I _
|
||
I I
|
||
I 7 8 9 I ^two wires running to back of unit
|
||
I I
|
||
I * 0 # I
|
||
I I
|
||
----------------------
|
||
|
||
----------------------
|
||
Back View -> I I
|
||
T I o ---- o-----------------------vent (1 of 4)
|
||
--- I / \ I
|
||
| I | -----------------speaker
|
||
--- I | | I
|
||
s B I | | I
|
||
2 wires -> \-----o ---- o I
|
||
running into I I
|
||
vent I I
|
||
I I
|
||
I I
|
||
I I
|
||
----------------------
|
||
|
||
Make sure the epoxy is really gobbed on there..you want to be certaint the
|
||
switch and crystals are firmly attached and secure in a matrix of epoxy (it
|
||
doesn't conduct electricity, so don't worry about shorting out the connections
|
||
to the toggle switch)...just don't gum up the action of the switch!
|
||
|
||
Basically, you've altered the device so you can select between 2 crystals to
|
||
generate the timing for the microprocessor in the tone dialer...
|
||
|
||
Now turn on the tone dialer NOW, you can easily switch between the 2 crystal
|
||
types the small crystal will generate ordinary DTMF tones but, by simply
|
||
flicking the switch, you generate HIGHER tones now, using the memory function
|
||
of the tone dialer, save 5 "*" in the P1 location, now dial the P1 location
|
||
using the BIG crystal, sure sounds like the tones for a QUARTER, doesn't it!
|
||
|
||
Carry this around with you always will come in handy with both Telco payphones
|
||
AND COCOTs! no Phreak should be without one!
|
||
|
||
Anyway, that about wraps it up for me references for this article include
|
||
Noah Clayton's EXCELLENT article on COCOTs in 2600 Magazine, Autumn 1990..
|
||
also, The Plague's article on Tone Dialer conversion to Red Box, 2600
|
||
Magazine, Summer 1990 (Which inspired me to create the COMBO-BOX (red box PLUS
|
||
DTMF dialer)...I strongly urge people to subscribe to 2600 Magazine...call
|
||
their office line for more details ->516/751-2600...
|
||
Remember..you can READ all you want, but if you don't get your ASS out
|
||
there and try stuff out for yourself, you are nothing but a POSER!
|
||
|
||
-RL-----------------------------------------------------------------Page 6
|
||
|
||
|
||
Enough said...oh, also, I heard that SOME COCOTs have handsets in them
|
||
that can be accessed..in other words, you call the COCOT and if you hit
|
||
"0" or something else, the earpiece of the handset is activated and you can
|
||
listen in on what's goin on around the COCOT...I dunno...never worked for me,
|
||
but try these 2 "suspected" numbers...212/268-7538, -6129..try hitting "0" and
|
||
listen for any sounds...I could be wrong, I could be right..I could be black,
|
||
I could be white....
|
||
|
||
That's all folks remember, the purpose of this phile is to ENLIGHTEN, and I
|
||
in no way condone or encourage illegal activities...so don't blame me for
|
||
ANY MESS you get into this phile offered strictly as INFORMATIONAL ONLY! I
|
||
am in no way responsible for your ass!
|
||
Also, I am not into wanton destruction, vandalism, or fraud..seek the truth,
|
||
and leave nothing but footsteps.
|
||
|
||
Remember...SHARE THE WEALTH...INFORMATION IS POWER...SHARE IT!
|
||
|
||
And drink massive amounts of Jolt cola...trust me, it's good for you.
|
||
|
||
|
||
Keep the faith, and never stop searching for new frontiers....
|
||
|
||
..................................
|
||
|
||
..oooOO Count Zero OOooo..
|
||
|
||
..................................
|
||
|
||
|
||
-RL-----------------------------------------------------------------Page 7
|
||
EOF
|
||
|
||
|
||
[48] Tfiles: (1-48,?,Q) : |