230 lines
12 KiB
Plaintext
230 lines
12 KiB
Plaintext
BIOC.VI
|
||
|
||
|
||
|
||
|
||
|
||
|
||
BIOC Agent 003's Course in Basic Telecommunications: Part VI
|
||
|
||
Revised: 27-oct-84
|
||
|
||
Preface:
|
||
|
||
This article will focus primarily on the standard Western Electric
|
||
single-slot coin telephone (aka fortress fone) which can be divided into 3
|
||
types:
|
||
|
||
- Dial-Tone First (DTF)
|
||
- Coin-First (CF): (ie, it wants your money before you receive a dial tone)
|
||
- Dial Post-Pay Service (PP): you pay after the party answers
|
||
|
||
Depositing Coins (Slugs):
|
||
|
||
Once you have deposited your slug into a fortress, it is subjected to a
|
||
--More--(4%)
|
||
gamut of tests.
|
||
The first obstacle for a slug is the magnetic trap. This will stop any
|
||
light-weight magnetic slugs and coins. If it passes this, the slug is then
|
||
classified as a nickel, dime, or quarter. Each slug is then checked for ap-
|
||
propriate size and weight. If these tests are passed, it will then travel
|
||
through a nickel, dime, or quarter magnet as appropriate. These magnets set up
|
||
an eddy current effect which causes coins of the appropriate characteristics to
|
||
slow down so they will follow the correct trajectory. If all goes well, the
|
||
coin will follow the correct path (such as bouncing off of the nickel anvil)
|
||
where it will hopefully fall into the narrow accepted coin channel.
|
||
The rather elaborate tests that are performed as the coin travels down
|
||
the coin chute will stop most slugs and other undesirable coins, such as pen-
|
||
nies, which must then be retrieved using the coin release lever.
|
||
If the slug miraculously survives the gamut, it will then strike the
|
||
appropriate totalizer arm causing a ratchet wheel to rotate once for every 5-
|
||
cent increment (eg, a quarter will cause it to rotate 5 times).
|
||
The totalizer then causes the coin signal oscillator to readout a dual-
|
||
frequency signal indicating the value deposited to ACTS (a computer) or the
|
||
TSPS operator. These are the same tones used by phreaks in the infamous red
|
||
boxes.
|
||
For a quarter, 5 beep tones are outpulsed at 12-17 pulses per second
|
||
(PPS). A dime causes 2 beep tones at 5 - 8.5 PPS while a nickel causes one
|
||
--More--(17%)
|
||
beep tone at 5 - 8.5 PPS. A beep consists of 2 tones: 2200 + 1700 Hz.
|
||
A relay in the fortress called the "B relay" (yes, there is also an 'A
|
||
relay') places a capacitor across the speech circuit during totalizer readout
|
||
to prevent the "customer" from hearing the red box tones.
|
||
In older 3 slot phones: one bell (1050-1100 Hz) for a nickel, two
|
||
bells for a dime, and one gong (800 Hz) for a quarter are used instead of the
|
||
modern dual-frequency tones.
|
||
|
||
TSPS & ACTS
|
||
|
||
While fortresses are connected to the CO of the area, all transactions
|
||
are handled via the Traffic Service Position System (TSPS). In areas that do
|
||
not have ACTS, all calls that require operator assistance, such as calling card
|
||
and collect, are automatically routed to a TSPS operator position.
|
||
In an effort to automate fortress service, a computer system known as
|
||
Automated Coin Toll Service (ACTS) has been implemented in many areas. ACTS
|
||
listens to the red box signals from the fones and takes appropriate action. It
|
||
is ACTS which says, "Two dollars please (pause) Please deposit two dollars for
|
||
the next ten seconds" (and other variations). Also, if you talk for more than
|
||
three minutes and then hang-up, ACTS will call back and demand your money.
|
||
ACTS is also responsible for Automated Calling Card Service.
|
||
ACTS also provide trouble diagnosis for craftspeople (repairmen speci-
|
||
--More--(29%)
|
||
alizing in fortresses). For example, there is a coin test which is great for
|
||
tuning up red boxes. In many areas this test can be activated by dialing
|
||
09591230 at a fortress. Once activated it will request that you deposit vari-
|
||
ous coins. It will then identify the coin and outpulse the appropriate red box
|
||
signal. The coins are usually returned when you hang up.
|
||
To make sure that there is actually money in the fone, the CO initiates
|
||
a "ground test" at various times to determine if a coin is actually in the
|
||
fone. This is why you must deposit at least a nickel in order to use a red
|
||
box!
|
||
|
||
Green Boxes:
|
||
|
||
Paying the initial rate in order to use a red box (on certain for-
|
||
tresses) left a sour taste in many red boxers' mouths thus the GREEN BOX was
|
||
invented. The green box generates useful tones such as COIN COLLECT, COIN RE-
|
||
TURN, and RINGBACK. These are the tones that ACTS or the TSPS operator would
|
||
send to the CO when appropriate. Unfortunately, the green box cannot be used
|
||
at a fortress station but it must be used by the CALLED party.
|
||
|
||
Here are the tones:
|
||
COIN COLLECT 700 + 1100 Hz
|
||
COIN RETURN 1100 + 1700 Hz
|
||
--More--(38%)
|
||
RINGBACK 700 + 1700 Hz
|
||
|
||
Before the called party sends any of these tones, an operator released
|
||
signal should be sent to alert the MF detectors at the CO. This can be accom-
|
||
plished by sending 900 + 1500 Hz or a single 2600 Hz wink (90 ms) followed by a
|
||
60 ms gap and then the appropriate signal for at least 900 ms.
|
||
Also, do not forget that the initial rate is collected shortly before
|
||
the 3 minute period is up.
|
||
Incidentally, once the above MF tones for collecting and returning
|
||
coins reach the CO, they are converted into an appropriate DC pulse (-130 volts
|
||
for return & +130 volts for collect). This pulse is then sent down the tip to
|
||
the fortress. This causes the coin relay to either return or collect the coins.
|
||
The alleged "T-Network" takes advantage of this information. When a
|
||
pulse for COIN COLLECT (+130 VDC) is sent down the line, it must be grounded
|
||
somewhere. This is usually either the yellow or black wire. Thus, if the
|
||
wires are exposed, these wires can be cut to prevent the pulse from being
|
||
grounded. When the three minute initial period is almost up, make sure that the
|
||
black & yellow wires are severed; then hang up, wait about 15 seconds in case
|
||
of a second pulse, reconnect the wires, pick up the fone, hang up again, and if
|
||
all goes well it should be "JACKPOT" time.
|
||
|
||
Physical Attack:
|
||
--More--(50%)
|
||
|
||
|
||
A typical fortress weighs roughly 50 lbs. with an empty coin box. Most
|
||
of this is accounted for in the armor plating. Why all the security? Well,
|
||
Bell contributes it to the following:
|
||
"Social changes in the 1960's made the multislot coin station a prime
|
||
target for: vandalism, strong arm robbery, fraud, and theft of service. This
|
||
brought about the introduction of the more rugged single slot coin station and
|
||
a new environment for coin service."
|
||
As for picking the lock, I will quote Mr. Phelps: "We often fantasize
|
||
about `picking the lock' or finding a `master key.' Well, you can forget about
|
||
it. I don't like to discourage people, but it will save you from wasting a lot
|
||
of your time--time which can be put to better use (heh heh)."
|
||
As for physical attack, the coin plate is secured on all four side by
|
||
hardened steel bolts which pass through two slots each. These bolts are in
|
||
turn interlocked by the main lock.
|
||
One phreak I know did manage to take one of the 'mothers' home (which
|
||
was attached to a piece of plywood at a construction site; otherwise, the per-
|
||
manent ones are a bitch to detach from the wall!). It took him almost ten
|
||
hours to open the coin box using a power drill, sledge hammers, and crow bars
|
||
(which was empty -- perhaps next time, he will deposit a coin first to hear if
|
||
it slushes down nicely or hits the empty bottom with a clunk.)
|
||
Taking the fone offers a higher margin of success. Although this may
|
||
--More--(62%)
|
||
be difficult often requiring brute force and there has been several cases of
|
||
back axles being lost trying to take down a fone! A quick and dirty way to
|
||
open the coin box is by using a shotgun. In Detroit, after ecologists drained
|
||
out a municipal pond, they found 168 coin phones rifled.
|
||
In colder areas, such as Canada, some shrewd people tape up the fones
|
||
using duct tape, pour in water, and come back the next day when the water will
|
||
have froze thus expanding and cracking the fone open.
|
||
In one case, "unauthorized coin collectors" were caught when they
|
||
brought $6,000 in change to a bank and the bank became suspicious...
|
||
At any rate, the main lock is an eight level tumbler located on the
|
||
right side of the coin box. This lock has 390,625 possible positions (5 ^ 8,
|
||
since there are 8 tumblers each with 5 possible positions) thus it is highly
|
||
pick resistant!
|
||
The lock is held in place by 4 screws. If there is sufficient clearance
|
||
to the right of the fone, it is conceivable to punch out the screws using the
|
||
drilling pattern below (provided by Alexander Mundy in TAP #32):
|
||
|
||
====================================
|
||
|| ^
|
||
||
|
||
| 1- 3/16 " || |
|
||
|<--- --->|| 1-1/2"
|
||
--More--(73%)
|
||
-------------------- |
|
||
| | || | |
|
||
| (+) (+)-| -----------
|
||
---| || | ^
|
||
| | || | |
|
||
| | (Z) || | |
|
||
| | || | 2-3/16"
|
||
---| || | |
|
||
| (+) (+) | |
|
||
| || | |
|
||
-------------------- -----------
|
||
||
|
||
||
|
||
(Z) keyhole (+) Screws
|
||
||
|
||
===================================
|
||
|
||
|
||
After this is accomplished, the lock can be pushed backwards, disengag-
|
||
ing the lock from the cover plate. The four bolts of the cover plate can then
|
||
be retracted by turning the boltworks with a simple key in the shape of the
|
||
hole on the coin plate (see diagram below). Of course, there are other methods
|
||
--More--(80%)
|
||
and drilling patterns.
|
||
|
||
:-------------------------------------:
|
||
| |
|
||
( )
|
||
|_|
|
||
[roughly]
|
||
Diagram of cover plate keyhole
|
||
:-------------------------------------:
|
||
|
||
The top cover uses a similar (but not as strong) locking method with
|
||
the keyhole depicted above on the top left side and a regular lock (probably
|
||
tumbler also) on the top right-hand side. It is interesting to experiment with
|
||
the coin chute and the fortress's own "red box" (which Bell didn't have the
|
||
'balls' to color red).
|
||
|
||
Miscellaneous:
|
||
|
||
In a few areas (rural & Canada), post-pay service exists. With this
|
||
type of service, the mouthpiece is cut off until the caller deposits money when
|
||
the called party answers. This also allows for free calls to weather and other
|
||
DIAL-IT services! Recently, 2600 magazine announced the CLEAR BOX which con-
|
||
--More--(87%)
|
||
sists of a telephone pickup coil and a small amp. It is based on the principal
|
||
that the receiver is also a weak transmitter and that by amplifying your signal
|
||
you can talk via the transmitter thus avoiding costly telephone charges!
|
||
Most fortresses are found in the 9xxx area. Under former Bell areas,
|
||
they usually start at 98xx (right below the 99xx official series) and move
|
||
downward.
|
||
Since the line, not the fone, determines whether or not a deposit must
|
||
be made, DTF & Charge-A-Call fones make great extensions!
|
||
Finally, fortress fones allow for a new hobby--instruction plate col-
|
||
lecting. All that is required is a flathead screwdriver and a pair of
|
||
needlenose pliers. Simply use the screwdriver to lift underneath the plate so
|
||
that you can grab it with the pliers and yank downwards. I would suggest cov-
|
||
ering the tips of the pliers with electrical tape to prevent scratching. Ten
|
||
cent plates are definitely becoming a "rarity!"
|
||
|
||
Fortress Security:
|
||
|
||
While a lonely fortress may seem the perfect target, beware! The Ges-
|
||
tapo has been known to stake out fortresses for as long as 6 years according to
|
||
the Grass Roots Quarterly. To avoid any problems, do not use the same fones
|
||
repeatedly for boxing, calling cards, & other experiments. The telco knows how
|
||
much money should be in the coin box and when its not there they tend to get
|
||
--More--(99%)
|
||
perturbed (read: pissed off).
|
||
|
||
|
||
|
||
|
||
{G-Files} Command <?>:
|
||
|
||
Please enter either [file-name], [l], [h], [q], or [?] |