BIOC.VI






       BIOC Agent 003's Course in Basic Telecommunications:  Part  VI

 Revised: 27-oct-84

Preface:

        This article will focus primarily  on  the  standard  Western  Electric
single-slot  coin  telephone  (aka  fortress  fone) which can be divided into 3
types:

- Dial-Tone First (DTF) 
- Coin-First (CF):  (ie, it wants your money before you receive a dial tone)
- Dial Post-Pay Service (PP):  you pay after the party answers

Depositing Coins (Slugs):

        Once you have deposited your slug into a fortress, it is subjected to a
--More--(4%)
gamut of tests.
        The first obstacle for a slug is the magnetic trap.  This will stop any
light-weight  magnetic  slugs  and  coins.  If it passes this, the slug is then
classified as a nickel, dime, or quarter.  Each slug is then  checked  for  ap-
propriate  size  and  weight.   If  these tests are passed, it will then travel
through a nickel, dime, or quarter magnet as appropriate.  These magnets set up
an eddy current effect which causes coins of the appropriate characteristics to
slow down so they will follow the correct trajectory.  If all  goes  well,  the
coin  will  follow  the correct path (such as bouncing off of the nickel anvil)
where it will hopefully fall into the narrow accepted coin channel.
        The rather elaborate tests that are performed as the coin travels  down
the  coin  chute will stop most slugs and other undesirable coins, such as pen-
nies, which must then be retrieved using the coin release lever.
        If the slug miraculously survives the gamut, it will  then  strike  the
appropriate  totalizer  arm causing a ratchet wheel to rotate once for every 5-
cent increment (eg, a quarter will cause it to rotate 5 times).
        The totalizer then causes the coin signal oscillator to readout a dual-
frequency  signal  indicating  the  value deposited to ACTS (a computer) or the
TSPS operator. These are the same tones used by phreaks  in  the  infamous  red
boxes.
        For a quarter, 5 beep tones are outpulsed at 12-17  pulses  per  second
(PPS).   A  dime  causes  2 beep tones at 5 - 8.5 PPS while a nickel causes one
--More--(17%)
beep tone at 5 - 8.5 PPS.  A beep consists of 2 tones:  2200 + 1700 Hz.
        A relay in the fortress called the "B relay" (yes, there is also an  'A
relay')  places  a capacitor across the speech circuit during totalizer readout
to prevent the "customer" from hearing the red box tones.
        In older 3 slot phones:  one bell  (1050-1100 Hz)  for  a  nickel,  two
bells  for  a dime, and one gong (800 Hz) for a quarter are used instead of the
modern dual-frequency tones.

TSPS & ACTS

        While fortresses are connected to the CO of the area, all  transactions
are  handled  via the Traffic Service Position System (TSPS).  In areas that do
not have ACTS, all calls that require operator assistance, such as calling card
and collect, are automatically routed to a TSPS operator position.
        In an effort to automate fortress service, a computer system  known  as
Automated  Coin  Toll  Service (ACTS) has been implemented in many areas.  ACTS
listens to the red box signals from the fones and takes appropriate action.  It
is  ACTS which says, "Two dollars please (pause) Please deposit two dollars for
the next ten seconds" (and other variations). Also, if you talk for  more  than
three  minutes  and  then  hang-up,  ACTS will call back and demand your money.
ACTS is also responsible for Automated Calling Card Service.
        ACTS also provide trouble diagnosis for craftspeople (repairmen  speci-
--More--(29%)
alizing  in  fortresses).  For example, there is a coin test which is great for
tuning up red boxes.  In many areas this  test  can  be  activated  by  dialing
09591230  at a fortress.  Once activated it will request that you deposit vari-
ous coins. It will then identify the coin and outpulse the appropriate red  box
signal. The coins are usually returned when you hang up.
        To make sure that there is actually money in the fone, the CO initiates
a  "ground  test"  at  various  times to determine if a coin is actually in the
fone.  This is why you must deposit at least a nickel in order  to  use  a  red
box!

Green Boxes:

        Paying the initial rate in order to use a  red  box  (on  certain  for-
tresses)  left  a  sour taste in many red boxers' mouths thus the GREEN BOX was
invented. The green box generates useful tones such as COIN COLLECT,  COIN  RE-
TURN,  and  RINGBACK.  These are the tones that ACTS or the TSPS operator would
send to the CO when appropriate.  Unfortunately, the green box cannot  be  used
at a fortress station but it must be used by the CALLED party.

Here are the tones:
     COIN COLLECT       700 + 1100 Hz
     COIN RETURN       1100 + 1700 Hz
--More--(38%)
     RINGBACK           700 + 1700 Hz

        Before the called party sends any of these tones, an operator  released
signal  should be sent to alert the MF detectors at the CO.  This can be accom-
plished by sending 900 + 1500 Hz or a single 2600 Hz wink (90 ms) followed by a
60 ms gap and then the appropriate signal for at least 900 ms.
        Also, do not forget that the initial rate is collected  shortly  before
the 3 minute period is up.
        Incidentally, once the above MF  tones  for  collecting  and  returning
coins reach the CO, they are converted into an appropriate DC pulse (-130 volts
for return & +130 volts for collect). This pulse is then sent down the  tip  to
the fortress. This causes the coin relay to either return or collect the coins.
        The alleged "T-Network" takes advantage of this  information.   When  a
pulse  for  COIN  COLLECT (+130 VDC) is sent down the line, it must be grounded
somewhere.  This is usually either the yellow or  black  wire.   Thus,  if  the
wires  are  exposed,  these  wires  can  be cut to prevent the pulse from being
grounded. When the three minute initial period is almost up, make sure that the
black  &  yellow wires are severed; then hang up, wait about 15 seconds in case
of a second pulse, reconnect the wires, pick up the fone, hang up again, and if
all goes well it should be "JACKPOT" time.

Physical Attack:
--More--(50%)

             
        A typical fortress weighs roughly 50 lbs. with an empty coin box.  Most
of  this  is  accounted for in the armor plating.  Why all the security?  Well,
Bell contributes it to the following:
        "Social changes in the 1960's made the multislot coin station  a  prime
target  for:   vandalism, strong arm robbery, fraud, and theft of service. This
brought about the introduction of the more rugged single slot coin station  and
a new environment for coin service."
        As for picking the lock, I will quote Mr. Phelps:  "We often  fantasize
about `picking the lock' or finding a `master key.'  Well, you can forget about
it.  I don't like to discourage people, but it will save you from wasting a lot
of your time--time which can be put to better use (heh heh)."
        As for physical attack, the coin plate is secured on all four  side  by
hardened  steel  bolts  which  pass through two slots each.  These bolts are in
turn interlocked by the main lock.
        One phreak I know did manage to take one of the 'mothers'  home  (which
was  attached to a piece of plywood at a construction site; otherwise, the per-
manent ones are a b****! to detach from the wall!).   It  took  him  almost  ten
hours  to  open the coin box using a power drill, sledge hammers, and crow bars
(which was empty -- perhaps next time, he will deposit a coin first to hear  if
it slushes down nicely or hits the empty bottom with a clunk.)
        Taking the fone offers a higher margin of success.  Although  this  may
--More--(62%)
be  difficult  often  requiring brute force and there has been several cases of
back axles being lost trying to take down a fone!  A quick  and  dirty  way  to
open  the coin box is by using a shotgun.  In Detroit, after ecologists drained
out a municipal pond, they found 168 coin phones rifled.
        In colder areas, such as Canada, some shrewd people tape up  the  fones
using  duct tape, pour in water, and come back the next day when the water will
have froze thus expanding and cracking the fone open.
        In one case, "unauthorized  coin  collectors"  were  caught  when  they
brought $6,000 in change to a bank and the bank became suspicious...
        At any rate, the main lock is an eight level  tumbler  located  on  the
right  side  of the coin box.  This lock has 390,625 possible positions (5 ^ 8,
since there are 8 tumblers each with 5 possible positions) thus  it  is  highly
pick resistant!
        The lock is held in place by 4 screws. If there is sufficient clearance
to  the  right of the fone, it is conceivable to punch out the screws using the
drilling pattern below (provided by Alexander Mundy in TAP #32):

   ====================================
                       ||        ^
                       ||
           | 1- 3/16 " ||        |
           |<---   --->||      1-1/2"
--More--(73%)
       --------------------      |
       |   |           || |      |
       |  (+)         (+)-| -----------
    ---|               || |      ^
    |  |               || |      |
    |  |        (Z)    || |      |
    |  |               || |   2-3/16"
    ---|               || |      |
       |  (+)         (+) |      |
       |               || |      |
       -------------------- -----------
                       ||
                       ||
        (Z) keyhole   (+) Screws
                       ||
    ===================================


        After this is accomplished, the lock can be pushed backwards, disengag-
ing  the lock from the cover plate.  The four bolts of the cover plate can then
be retracted by turning the boltworks with a simple key in  the  shape  of  the
hole on the coin plate (see diagram below).  Of course, there are other methods
--More--(80%)
and drilling patterns.

:-------------------------------------:
                  | |
                  ( )
                  |_|
               [roughly]
    Diagram of cover plate keyhole 
:-------------------------------------:

        The top cover uses a similar (but not as strong)  locking  method  with
the  keyhole  depicted  above on the top left side and a regular lock (probably
tumbler also) on the top right-hand side.  It is interesting to experiment with
the  coin  chute  and  the fortress's own "red box" (which Bell didn't have the
'balls' to color red).

Miscellaneous:

        In a few areas (rural & Canada), post-pay service  exists.   With  this
type of service, the mouthpiece is cut off until the caller deposits money when
the called party answers.  This also allows for free calls to weather and other
DIAL-IT  services!   Recently, 2600 magazine announced the CLEAR BOX which con-
--More--(87%)
sists of a telephone pickup coil and a small amp.  It is based on the principal
that the receiver is also a weak transmitter and that by amplifying your signal
you can talk via the transmitter thus avoiding costly telephone charges!
        Most fortresses are found in the 9xxx area.  Under former  Bell  areas,
they  usually  start  at  98xx  (right below the 99xx official series) and move
downward.
        Since the line, not the fone, determines whether or not a deposit  must
be made, DTF & Charge-A-Call fones make great extensions!
        Finally, fortress fones allow for a new hobby--instruction  plate  col-
lecting.  All  that  is  required  is  a  flathead  screwdriver  and  a pair of
needlenose pliers.  Simply use the screwdriver to lift underneath the plate  so
that  you can grab it with the pliers and yank downwards.  I would suggest cov-
ering the tips of the pliers with electrical tape to prevent  scratching.   Ten
cent plates are definitely becoming a "rarity!"

Fortress Security:

        While a lonely fortress may seem the perfect target, beware!  The  Ges-
tapo has been known to stake out fortresses for as long as 6 years according to
the Grass Roots Quarterly.  To avoid any problems, do not use  the  same  fones
repeatedly for boxing, calling cards, & other experiments.  The telco knows how
much money should be in the coin box and when its not there they  tend  to  get
--More--(99%)
perturbed (read:  pissed off).




{G-Files} Command <?>: 

Please enter either [file-name], [l], [h], [q], or [?] 