E-C-H-E-L-O-N  M-A-G-A-Z-I-N-E
--------------------------------------------------------------------                                  ______
                      ____________|  ___ |___
                     /|  _________  | | |___ |_
                    | | | |   |   |_|_| | __|_ |___
                    | | | | | |  |     | ____|_   |
                    | | |_|_|_|___|_____|_______| 8|
                    | |____________________________|
                    |______________________________/
            ...:::$$|    n0de8 -Presents- n0de8    |$$:::...
            ...:::$$| Written for Echelon Magazine |$$:::...
            ...:::$$|  UK Redboxing and Payphones  |$$:::...

                            Shouts fly out to
             [ViV] [SaMaN] [pr0d] [Phed] [RedBlade] [Murte]
                  [PsyB0rg] [Lucky225] [GPI] [erazzer]

...:::$$|UK Redboxing
	Uk redboxing is a simple and effective way of getting a free call.Wether
you wish to ring international or local,redboxing WILL allow you to do it.In this
article I intend to explain how it works,how to do it and lastly the dangers of
doing it.

Redboxing is simulating the tones that a coin makes when it is inserted in the
coinslot of a payphone.However it is NOT the same as USA redboxing where you
can simple play the nickel,quarter and dime tones into a payphone and it credits
them onto a call.UK Redboxing requires the use of a live operator.Lets look at
a legit call made by say, Fred, from a Payphone.

Fred walks upto the payphone and when he begins dialing his number the 8 button
will not respond with DTMF.So he rings 100 and tells them.The operator will
then report the payphone as damaged(important) and offers to place a call through
for Fred.Fred happily agrees and the Operator rings Fred's number for him and
on answering,informs the person at the other end that he has a "Call from a Cash
Coin Box",the person on the other end agrees to wait.The Operator then asks Fred
for his money,Fred inserts 10p into the coinslot which emits a low beep to the
Operator,the Operator then places Fred's call through.

When we redbox,all we do is say that one of the buttons is broken,sticky,gooey,
speaking, etc. etc.The operator should then report the phone and ask if you want
them to place a call for you.If they don't hang up and dial again.After asking
if you want a call placed they will ring the number you give them and tell the
person on the line to hold.You CAN ask them if you can insert the money before
the call is placed and then the person won't have to listen to the operator(and
waste your virtual money),but BT don't like doing this.So when the Operator comes
back on the line and ask's you to insert a minimum of whatever,play the following
tones into the Microphone of the handset.

10 Pence   - 1000hz for 200ms
20 Pence   - 1000hz for 200ms then a 50ms gap then 1000hz for 200ms again
50 Pence   - 1000hz for 350ms
1.00 pound - 1000hz for 350ms then a 66ms gap then 1000hz for 350ms.

They will then Place the call through.Now despite what alot of people think you
can Redbox both local and international calls,for local calls or national calls
dial 100 and for international calls dial 155.When you dial through the 155 Op
there is a charge of around 2 pounds for connecting the call,they WILL try and
convince you to use another phone but just say this is the only one for a few
miles or something.

Alot of people also think that you can only redbox of certain payphones,this is
not true.When you ring the operator from a payphone,any payphone(except COCOT'S)
the operator hears a cuckoo tone(the pleepy noise) and the flag on his/her monitor
will say payphone,it will NOT say what kind of payphone etc. etc. so you can
Redbox from any payphone as they all appear the same to the BT Operator!

Now remeber the little (important) message i gave you about the operator reporting
the payphone as damaged? Well the answer is simple,if the same payphone appears
damaged 100 times a week and someone keeps getting thier calls routed through the
operator they will suss onto what your doing and may wait for you to box it(they
flag payphones sometimes).If you wish to avoid this alternate your excuse or say
that when your call is put through to a number it rings and when they answer it
hangs up and gives you your money back but it worked FINE on the last 3 calls.

If your wondering how you can get the tones from your PC to the Payphone,you have
a few options.

1)Use a Laptop
  Define the coins as trunks in a blueboxing program such as Bluebeep and play
  them directly into the phone from your laptop(or use the two .wav's included).

2)Record them onto a Tape
  Use Bluebeep or Bluedial(TLO even?) and take your output of your sound card
  and insert the cables into the AUX of a stereo,play the coins and you now
  have them on tape!You could do this to the MIC of a dictaphone also.

3)Build One
  Unfortunatley, I cannot find ANY Uk redbox plans.However never fear I have
  a friend who is doing it as a project,so expect a UK Redbox plan soon!

4)Use a PSION
  A Psion can be used to play the tones from a menu,which allows you to define
  a freq.However as far as I know this is only the newer PSION's which can do
  this,and they can cost over 400 pounds!So you could get a PSION II and use
  the included program which often works,but the tones are a bit high even tho
  all the checks on the algebra appear to work out fine.However alot of Operators
  fell for it with me!

...:::$$|----PSION II Program for REDBOX tones 10p and 50p!
...:::$$|----Cut Here
CLS
PRINT "UK REDBOX"
PRINT "BY n0de 8"
PRINT "VERSION 2.0"
GET
CLS
PRINT "10 PENCE TONE"
BEEP 200,421.8
GET
CLS
PRINT "50 PENCE TONE"
BEEP 350,421.8
GET
...:::$$|----Stop!

 Save this program as Redbox.opl and then on the menu press mode and type redbox
 and you add it as an opl file,it will now run the program from the menu!

So you should now have a pretty in-depth Idea on how to Redbox from the UK.I hope
you enjoyed reading this article and I also hope that it cleared up many of the
questions that often appear on IRC and newsgroups.Some other usefull information
is that putting 2 pence into the coinslot as you box the tones convinces the operator
a lot easier as they hear a coin going through the payphone in the background!

Standard payphone phreaking
Most of the time to perform payphone related phreaking you are gonna need the following
items.

*A biege Box and phone
*Nails and hacksaw handle.
*A few quid in pound coins(one or two will do)
*Wirecutters
*Wirestrippers(Not the dancing kind plz)
*A pocket tone Dialer
*A redbox(See above)

A biege box
<if you know how to build a Biege(and you should) then skip this>
Ok so you need a biege box?Right,go to a store and buy some crocodile clips
(or steal some) and get a phone extension cord. Cut the end with the bit that
plugs into the socket off,you should have a bit of wire and the bit that the
phone connects to left.Strip the wire back and find the red and white wires.

Attach crocodile clips to those two wires(either use solder or screw the wire
down onto them.You have a biege box.To test it works find a phone line and get
the wire cutters out,cut the wire and strip it and find the two red and white
wires.Strip them.Attach the crocodile clips to the correct wires(red to red
and white to white) and then plug your phone into the end of the biege box.
You should hear a dialtone,make a call hell its not your phone bill!If your
wires aren't red and green then your looking for the ring and tip,it may
be red and blue or even blue and orange,just take your best guess!

Secondly find a payphone you wish to phreak,simply walk around until you find
a payphone.Then you need to identify it :)

The main types of payphones in the Uk are:-

Payphone 2000 - Have a card slot and coin slot above handset and keypad,small
		lcd display and ugly looking.These can be found all over city
		and town centres.

Payphone 1990 - Standard payphones,large LCD with only a coin slot,handset on
		left with follow on call button behind it,keypad on a slant
		inwards.Wires often exposed at top or hidden behind silver
		panels.There are loads of these around.

COCOT'S       - Found in various places,ugly grey brown or black boxes which
		plug into a normal phone line and are mainly in schools etc. etc.
		Try Kwik Save or Tesco :).

There are also some other payphones but I only have experince of those three and most
methods can be addapted anyhow!

Found a payphone you want to phreak?Good.Now discover the methods of how to phreak it.

Payphone 2000 - Baaad Choice,Only way to phreak this is shear vandalism( :-) ).If the wire is exposed
                attach your biege box to it.If not get a nail and a hacksaw blade.Connect it to the
                metal sheet where the wires run in to it,undo the hex-shaped bolts by whacking the nail
                into em and using the handle blade to unscrew em(via the nail).You should find a nasty
                little box with wires going in and out.You can biege from this.

                You can also redbox from these payphones(see above).

Payphone 1990 - Best choice for a phreak.There are a handfull of ways of phreaking this including non
                vandalism ways.Firstly vandalism.

                Biege Box it
                The wires can be found entering the top of the payphone or entering via the silver box
                at the bottom(follow payphone 2000 steps for removing this).

                Hit it(Serious)
                Put in 20p,see the flat bit below the keypad and up from the coin return slot?Hit it as
                hard as you can and your 20p should drop down to the coin return box.

                Wiggle it
                Use a screwdriver or something strong to remove the flap off the coin return slot,Use a
                pair of pliars to rip the circular thing out.Put your money in and slide your fingers up
                the coin return slot to wiggle your 20p down.

                And now the ways of non violent nature!

                Firtly insert a pound into the payphone.Make your call and at around 15-20 pence.Press
                follow on call and Dial 141 141 141 141 (141 four times) then keep pressing 0 until your
                money is returned to you.Display may flash "No coin call"(never seen but been told!).Ohh
		shit,your moneys back,now carry on using the phone ;)

                Insert a pound into the phone,press 141 141 and then 0 hundreds of times until your pound is
                returned,Ring someone and you still have your trusty pound :)

                Insert 20p ring someone,wait until credits are at 9,press follow on call and when 9 is still
                flashin put in a pound.Keep pressing the follow on call button as your putting your pound in.
                Your pound should drop out.You now have 1.09 pound's worth of credit.

                Some people have had problems getting the non-vandalism methods to work.The only reason I can
                think as to why they don't work is that the payphone has been renewed or modifyed.I have had
                these methods working so if they don't work from one phone,try another!

                You can also redbox from these payphones(see above).

COCOT's       - Ok choice,but there usally in pretty public places.Note,they are often left on pulse dialing
                press and hold # to turn them into DTMF(Doesn't always work).

                Biegeing it.
                Put those wirecutters away!Look for where the phone is plugged into,it should be the same as
                a normal phone socket,unplug it and plug your phone in.

                Try dialing *#2580 and then the number you want to call(MKII Cocots).

                Ring back trick
                Ring someone and when they answer hang up and ring them back quickly,it should be engaged.Press
                5 and hang up.Ring back rings and you pick up the phone,You then ring them but the phone thinks
                they rang you.

                Tone Dialing
                Most COCOTS allow you to dial 0800 numbers.So dial one that isn't working.When the phone hears
                the duhhhhhh noise it clicks off and onto a dialtone,use your pocket tone dialer to ring someone!
                If your asking why not use one anyway?Well simple,the dialtone you hear first is made by the phone
                NOT the phone line,the second one is the phone's actual dialtone.This is simply to stop people
                doing what I just described to you ;)

                Sometimes you may find a phone like this that just dials taxi's.Pick it up and play a recording
                of the number you wish to dial in the mouth piece,it should ring.If not try sending the first
                number while the latch to hang up is held down,Wait and then dial the number(Including the first
                digit that you held down!).

                You can NOT redbox from these payphones as it is the phone that recognise's the coin insertation.

                While trying to tone dial off an unrestricted dialtone recently on a BT Solitaire COCOT (6000)
                i found the speech path to the phone was closed until I inserted money.If anyone elses encounters
                this problem,give up on trying to tone dial it(or if you find out how,get in touch!)


Not all the methods work on all phones,you have to experiment im afraid(:().Eventually you'll find a phone to phunk
with ;).Oh if you lose money(or want to 'claim' you lost some) ring 151 report that the payphone swallowed your
calling card/money/penis whatever and they will ask you for name and address,you should recieve a calling card for
the amount your claiming within a few days(don't do this too often otherwise they wise up and won't send you anymore).

If your intrested in stealing from the cash box's remember that they have alarms on them and the police will be there
within 5 minutes(FACT).

           -n0de8-
"Step By Step...How to root a ganja plant by F. Acosta" - Phed

**Private note to all BT security Personel...
**My ass?You can kiss it!BUT I'm gonna charge YOU 10p for the pleasure!
<Plip>-<Plip>

