336 lines
14 KiB
Plaintext
336 lines
14 KiB
Plaintext
File: BASIC TELCOM VI
|
||
Read 22 times
|
||
|
||
******BIOC Agent 003's course in*******
|
||
* *
|
||
* ========================== *
|
||
* =BASIC TELECOMMUNICATIONS= *
|
||
* ========================== *
|
||
* Part VI *
|
||
***************************************
|
||
|
||
REVISED: 27-OCT-84
|
||
|
||
Preface:
|
||
|
||
This article will focus primarily on the standard Western Electric single- slot
|
||
coin telephone (aka fortress fone) which can be divided into 3 types:
|
||
|
||
- Dial-Tone First (DTF)
|
||
- Coin-First (CF): (ie, it wants your $ before you receive a dial tone)
|
||
- Dial Post-Pay Service (PP): you pay after the party answers
|
||
|
||
|
||
Depositing Coins (Slugs):
|
||
-------------------------
|
||
|
||
Once you have deposited your slug into a fortress, it is subjected to a gamut
|
||
of tests.
|
||
|
||
The first obstacal for a slug is the magnetic trap. This will stop any
|
||
light-weight magnetic slugs and coins. If it passes this, the slug is then
|
||
classified as a nickel, dime, or quarter. Each slug is then checked for
|
||
appropriate size and weight. If these tests are passed, it will then travel
|
||
through a nickel, dime, or quarter magnet as appropriate. These magnets set up
|
||
an eddy current effect which causes coins of the appropriate characteristics to
|
||
slow down so they will follow the correct trajectory. If all goes well, the
|
||
coin will follow the correct path (such as bouncing off of the nickel anvil)
|
||
where it will hopefully fall into the narrow accepted coin channel.
|
||
|
||
The rather elaborate tests that are performed as the coin travels down the coin
|
||
chute will stop most slugs and other undesirable coins, such as pennies, which
|
||
must then be retrieved using the coin release lever.
|
||
|
||
If the slug miraculously survives the gamut, it will then strike the
|
||
appropriate totalizer arm causing a ratchet wheel to rotate once for every
|
||
5-cent increment (eg, a quarter will cause it to rotate 5 times).
|
||
|
||
The totalizer then causes the coin signal oscillator to readout a dual-
|
||
frequency signal indicating the value deposited to ACTS (a computer) or the
|
||
TSPS operator. These are the same tones used by phreaks in the infamous red
|
||
boxes.
|
||
|
||
For a quarter, 5 beep tones are outpulsed at 12-17 pulses per second (PPS). A
|
||
dime causes 2 beep tones at 5 - 8.5 PPS while a nickel causes one beep tone at
|
||
5 - 8.5 PPS. A beep consists of 2 tones: 2200 + 1700 Hz.
|
||
|
||
A relay in the fortress called the "B relay" (yes, there is also an 'A relay')
|
||
places a capacitor across the speech circuit during totalizer read- out to
|
||
prevent the "customer" from hearing the red box tones.
|
||
|
||
In older 3 slot phones: one bell (1050-1100 Hz) for a nickel, two bells for a
|
||
dime, and one gong (800 Hz) for a quarter are used instead of the modern
|
||
dual-frequency tones.
|
||
|
||
=============
|
||
=TSPS & ACTS=
|
||
=============
|
||
|
||
While fortresses are connected to the CO of the area, all transactions are
|
||
handled via the Traffic Service Position System (TSPS). In areas that do not
|
||
have ACTS, all calls that require operator assistance, such as calling card and
|
||
collect, are automatically routed to a TSPS operator position.
|
||
|
||
In an effort to automate fortress service, a computer system known as Automated
|
||
Coin Toll Service (ACTS) has been implemented in many areas. ACTS listens to
|
||
the red box signals from the fones and takes appropriate action. It is ACTS
|
||
which says, "Two dollars please (pause) Please deposit two dollars for the next
|
||
ten seconds" (and other variations). Also, if you talk for more than three
|
||
minutes and then hang-up, ACTS will call back and demand your money. ACTS is
|
||
also responsible for Automated Calling Card Service.
|
||
|
||
ACTS also provide trouble diagnosis for craftspeople (repairmen specializing in
|
||
fortresses). For example, there is a coin test which is great for tuning up
|
||
red boxes. In many areas this test can be activated by dialing 09591230 at a
|
||
fortress (thanks to Karl Marx for this information). Once activated it will
|
||
request that you deposit various coins. It will then identify the coin and
|
||
outpulse the appropriate red box signal. The coins are usually returned when
|
||
you hang up.
|
||
|
||
To make sure that there is actually money in the fone, the CO initiates a
|
||
"ground test" at various times to determine if a coin is actually in the fone.
|
||
This is why you must deposit at least a nickel in order to use a red box!
|
||
|
||
Green Boxes:
|
||
------------
|
||
|
||
Paying the initial rate in order to use a red box (on certain fortresses) left
|
||
a sour taste in many red boxer's mouths thus the GREEN BOX was invented. The
|
||
green box generates useful tones such as COIN COLLECT, COIN RETURN, and
|
||
RINGBACK. These are the tones that ACTS or the TSPS operator would send to the
|
||
CO when appropriate. Unfortunately, the green box cannot be used at a fortress
|
||
station but it must be used by the CALLED party.
|
||
|
||
Here are the tones:
|
||
|
||
COIN COLLECT 700 + 1100 Hz
|
||
COIN RETURN 1100 + 1700 Hz
|
||
RINGBACK 700 + 1700 Hz
|
||
|
||
Before the called party sends any of these tones, an operator released signal
|
||
should be sent to alert the MF detectors at the CO. This can be accomplished
|
||
by sending 900 + 1500 Hz or a single 2600 Hz wink (90 ms) followed by a 60 ms
|
||
gap and then the appropriate signal for at least 900 ms.
|
||
|
||
Also, do not forget that the initial rate is collected shortly before the 3
|
||
minute period is up.
|
||
|
||
Incidentally, once the above MF tones for collecting and returning coins reach
|
||
the CO, they are converted into an appropriate DC pulse (-130 volts for return
|
||
& +130 volts for collect). This pulse is then sent down the tip to the
|
||
fortress. This causes the coin relay to either return or collect the coins.
|
||
|
||
The alleged "T-Network" takes advantage of this information. When a pulse for
|
||
COIN COLLECT (+130 VDC) is sent down the line, it must be grounded somewhere.
|
||
This is usually either the yellow or black wire. Thus, if the wires are
|
||
exposed, these wires can be cut to prevent the pulse from being grounded. When
|
||
the three minute initial period is almost up, make sure that the black & yellow
|
||
wires are severed; then hang up, wait about 15 seconds in case of a second
|
||
pulse, reconnect the wires, pick up the fone, hang up again, and if all goes
|
||
well it should be "JACKPOT" time.
|
||
|
||
Physical Attack:
|
||
----------------
|
||
|
||
A typical fortress weighs roughly 50 lbs. with an empty coin box. Most of
|
||
this is accounted for in the armor plating. Why all the security? Well, Bell
|
||
contributes it to the following:
|
||
|
||
"Social changes during the 1960's made the multislot coin station a prime
|
||
target for: vandalism, strong arm robbery, fraud, and theft of service. This
|
||
brought about the introduction of the more rugged single slot coin station and
|
||
a new environment for coin service."
|
||
|
||
As for picking the lock, I will quote Mr. Phelps: "We often fantasize about
|
||
'picking the lock' or 'getting a master key.' Well, you can forget about it. I
|
||
don't like to discourage people, but it will save you from wasting alot of your
|
||
time--time which can be put to better use (heh, heh)."
|
||
|
||
As for physical attack, the coin plate is secured on all four side by hardened
|
||
steel bolts which pass through two slots each. These bolts are in turn
|
||
interlocked by the main lock.
|
||
|
||
One phreak I know did manage to take one of the 'mothers' home (which was
|
||
attached to a piece of plywood at a construction site; otherwise, the permanent
|
||
ones are a bitch to detach from the wall!). It took him almost ten hours to
|
||
open the coin box using a power drill, sledge hammers, and crow bars (which was
|
||
empty -- perhaps next time, he will deposit a coin first to hear if it slushes
|
||
down nicely or hits the empty bottom with a clunk.)
|
||
|
||
Taking the fone offers a higher margin of success. Although this may be
|
||
difficult often requiring brute force and there has been several cases of back
|
||
axles being lost trying to take down a fone! A quick and dirty way to open the
|
||
coin box is by using a shotgun. In Detroit, after ecologists cleaned out a
|
||
municipal pond, they found 168 coin phone rifled.
|
||
|
||
In colder areas, such as Canada, some shrewd people tape up the fones using
|
||
duct tape, pour in water, and come back the next day when the water will have
|
||
froze thus expanding and cracking the fone open.
|
||
|
||
In one case, "unauthorized coin collectors" where caught when they brought
|
||
$6,000 in change to a bank and the bank became suspicious...
|
||
|
||
At any rate, the main lock is an eight level tumbler located on the right side
|
||
of the coin box. This lock has 390,625 possible positions (5 ^ 8, since there
|
||
are 8 tumblers each with 5 possible positions) thus it is highly pick
|
||
resistant! The lock is held in place by 4 screws. If there is sufficient
|
||
clearance to the right of the fone, it is conceivable to punch out the screws
|
||
using the drilling pattern below (provided by Alexander Mundy in TAP #32):
|
||
|
||
====================================
|
||
!! ^
|
||
!! !
|
||
! 1- 3/16 " !! !
|
||
!<--- --->!! 1-1/2"
|
||
-------------------- !
|
||
! ! !! ! !
|
||
! (+) (+)-! -----------
|
||
---! !! ! ^
|
||
! ! !! ! !
|
||
! ! (Z) !! ! !
|
||
! ! !! ! 2-3/16"
|
||
---! !! ! !
|
||
! (+) (+) ! !
|
||
! !! ! !
|
||
-------------------- -----------
|
||
!!
|
||
!!
|
||
(Z) Keyhole (+) Screws
|
||
!!
|
||
===================================
|
||
|
||
|
||
After this is accomplished, the lock can be pushed backwards disengaging the
|
||
lock from the cover plate. The four bolts of the cover plate can then be
|
||
retracted by turning the boltworks with a simple key in the shape of the hole
|
||
on the coin plate (see diagram below). Of course, there are other methods and
|
||
drilling patterns.
|
||
|
||
:-------------------------------------:
|
||
_
|
||
! !
|
||
( )
|
||
!_!
|
||
[roughly]
|
||
Diagram of cover plate keyhole
|
||
:-------------------------------------:
|
||
|
||
The top cover uses a similar (but not as strong) locking method with the
|
||
keyhole depicted above on the top left side and a regular lock (probably
|
||
tumbler also) on the top right-hand side. It is interesting to experiment with
|
||
the coin shute and the fortresses own "red box" (which Bell didn't have the
|
||
'balls' to color red).
|
||
|
||
Miscellaneous:
|
||
--------------
|
||
|
||
In a few areas (rural & Canada), post- pay service exists. With this type of
|
||
service, the mouthpiece is cut off until the caller deposits money when the
|
||
called party answers. This also allows for free calls to weather and other
|
||
DIAL-IT services! Recently, 2600 magazine announced the CLEAR BOX which
|
||
consists of a telephone pickup coil and a small amp. It is based on the
|
||
principal that the receiver is also a weak transmitter and that by amplifying
|
||
your signal you can talk via the transmitter thus avoiding costly telephone
|
||
charges!
|
||
|
||
Most fortresses are found in the 9xxx area. Under former Bell areas, they
|
||
usually start at 98xx (right below the 99xx official series) and move downward.
|
||
|
||
Since the line, not the fone, determines whether or not a deposit must be made,
|
||
DTF & Charge-A-Call fones make great extensions!
|
||
|
||
Finally, fortress fones allow for a new hobby--instruction plate collecting.
|
||
All that is required is a flat-head screwdriver and a pair of needle-nose
|
||
pliers. Simply use the screwdriver to lift underneath the plate so that you
|
||
can grab it with the pliers and yank downwards. I would suggest covering the
|
||
tips of the pliers with electrical tape to prevent scratching. Ten cent plates
|
||
are definitely becoming a "rarity!"
|
||
|
||
Fortress Security:
|
||
------------------
|
||
|
||
While a lonely fortress may seem the perfect target, beware! The Gestapo has
|
||
been known to stake out fortresses for as long as 6 years according to the
|
||
Grass Roots Quarterly. To avoid any problems, do not use the same fones
|
||
repeatedly for boxing, calling cards, & other experiments. The telco knows how
|
||
much money should be in the coin box and when its not there they tend to get
|
||
perturbed (read: pissed off).
|
||
|
||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||
|
||
Disclaimer:
|
||
-----------
|
||
|
||
The preceding is intended for "information purposes only" and I do not advocate
|
||
that you participate in any subversive activities...
|
||
|
||
|
||
Coming sooner or later:
|
||
-----------------------
|
||
|
||
Part VII will deal with blue boxing.
|
||
|
||
|
||
References/Suggested Reading:
|
||
-----------------------------
|
||
|
||
Various hard-to-find Bell System publications.
|
||
|
||
"Alternate Method of Opening the Fortress Phone Coin Box," Alexander Mundy, TAP
|
||
#32.
|
||
|
||
"Build a T-Network for Fun & Profit," TAP #15.
|
||
|
||
"Coiners & Other Thieves," The Phone Book, J. Edgar Hyde, pp 88-91.
|
||
|
||
"Fortress Fun-ding," TAP #66.
|
||
|
||
"The Green & Brown Box," Ted Veil & Nick Haflinger, TAP #68.
|
||
|
||
"Introducing the Clear Box!," 2600, July 1984.
|
||
|
||
"More Fortress Fun," TAP #49
|
||
|
||
"Notes on the Network," AT&T, 1980, [The definitive technical reference
|
||
guide!].
|
||
|
||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||
|
||
2600:
|
||
Box 752
|
||
Middle Island, NY 11953
|
||
|
||
Subscriptions: $10/year (published monthly)
|
||
Last Issue (as of 10/27/84): October 1984
|
||
|
||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||
|
||
TAP:
|
||
Room 603
|
||
147 W 42 Street
|
||
New York, NY 10036
|
||
|
||
Subscriptions: $10/10 issues or so (published sporadically since 1971)
|
||
Last Issue (as of 10/27/84): January/February 1984 [#90]
|
||
|
||
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
|
||
*****BIOC (p) 1984 BIOC
|
||
*=$=*Agent International, Ltd.
|
||
*****003
|
||
|
||
October 6, 1984
|
||
|
||
<<=-FARGO 4A-=>>
|
||
|
||
[Sherwood Forest ][ - (914) 359-1517]
|
||
[20 Megs On-Line]
|
||
|
||
PS Sysops of BBS's are welcome to use this material providing that nothing is
|
||
altered.
|
||
|
||
PPS Any and all threats, comments, corrections, suggestions, & subpoenas are
|
||
welcome.
|
||
|
||
-----End of File
|
||
Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open
|
||
|