File: BASIC TELCOM VI

 Read 22 times



                     ******BIOC Agent 003's course in*******

                     *                                     *

                     *     ==========================      *

                     *     =BASIC TELECOMMUNICATIONS=      *

                     *     ==========================      *

                     *               Part VI               *

                     ***************************************



REVISED:  27-OCT-84



Preface:



This article will focus primarily on the standard Western Electric single- slot

coin telephone (aka fortress fone) which can be divided into 3 types:



- Dial-Tone First (DTF)

- Coin-First (CF):  (ie, it wants your $ before you receive a dial tone)

- Dial Post-Pay Service (PP):  you pay after the party answers





Depositing Coins (Slugs):

-------------------------



Once you have deposited your slug into a fortress, it is subjected to a gamut

of tests.



The first obstacal for a slug is the magnetic trap.  This will stop any

light-weight magnetic slugs and coins.  If it passes this, the slug is then

classified as a nickel, dime, or quarter.  Each slug is then checked for

appropriate size and weight.  If these tests are passed, it will then travel

through a nickel, dime, or quarter magnet as appropriate.  These magnets set up

an eddy current effect which causes coins of the appropriate characteristics to

slow down so they will follow the correct trajectory.  If all goes well, the

coin will follow the correct path (such as bouncing off of the nickel anvil)

where it will hopefully fall into the narrow accepted coin channel.



The rather elaborate tests that are performed as the coin travels down the coin

chute will stop most slugs and other undesirable coins, such as pennies, which

must then be retrieved using the coin release lever.



If the slug miraculously survives the gamut, it will then strike the

appropriate totalizer arm causing a ratchet wheel to rotate once for every

5-cent increment (eg, a quarter will cause it to rotate 5 times).



The totalizer then causes the coin signal oscillator to readout a dual-

frequency signal indicating the value deposited to ACTS (a computer) or the

TSPS operator.  These are the same tones used by phreaks in the infamous red

boxes.



For a quarter, 5 beep tones are outpulsed at 12-17 pulses per second (PPS).  A

dime causes 2 beep tones at 5 - 8.5 PPS while a nickel causes one beep tone at

5 - 8.5 PPS.  A beep consists of 2 tones:  2200 + 1700 Hz.



A relay in the fortress called the "B relay" (yes, there is also an 'A relay')

places a capacitor across the speech circuit during totalizer read- out to

prevent the "customer" from hearing the red box tones.



In older 3 slot phones:  one bell (1050-1100 Hz) for a nickel, two bells for a

dime, and one gong (800 Hz) for a quarter are used instead of the modern

dual-frequency tones.



=============

=TSPS & ACTS=

=============



While fortresses are connected to the CO of the area, all transactions are

handled via the Traffic Service Position System (TSPS).  In areas that do not

have ACTS, all calls that require operator assistance, such as calling card and

collect, are automatically routed to a TSPS operator position.



In an effort to automate fortress service, a computer system known as Automated

Coin Toll Service (ACTS) has been implemented in many areas.  ACTS listens to

the red box signals from the fones and takes appropriate action.  It is ACTS

which says, "Two dollars please (pause) Please deposit two dollars for the next

ten seconds" (and other variations).  Also, if you talk for more than three

minutes and then hang-up, ACTS will call back and demand your money.  ACTS is

also responsible for Automated Calling Card Service.



ACTS also provide trouble diagnosis for craftspeople (repairmen specializing in

fortresses).  For example, there is a coin test which is great for tuning up

red boxes.  In many areas this test can be activated by dialing 09591230 at a

fortress (thanks to Karl Marx for this information).  Once activated it will

request that you deposit various coins.  It will then identify the coin and

outpulse the appropriate red box signal.  The coins are usually returned when

you hang up.



To make sure that there is actually money in the fone, the CO initiates a

"ground test" at various times to determine if a coin is actually in the fone.

This is why you must deposit at least a nickel in order to use a red box!



Green Boxes:

------------



Paying the initial rate in order to use a red box (on certain fortresses) left

a sour taste in many red boxer's mouths thus the GREEN BOX was invented.  The

green box generates useful tones such as COIN COLLECT, COIN RETURN, and

RINGBACK.  These are the tones that ACTS or the TSPS operator would send to the

CO when appropriate.  Unfortunately, the green box cannot be used at a fortress

station but it must be used by the CALLED party.



Here are the tones:



     COIN COLLECT       700 + 1100 Hz

     COIN RETURN       1100 + 1700 Hz

     RINGBACK           700 + 1700 Hz



Before the called party sends any of these tones, an operator released signal

should be sent to alert the MF detectors at the CO.  This can be accomplished

by sending 900 + 1500 Hz or a single 2600 Hz wink (90 ms) followed by a 60 ms

gap and then the appropriate signal for at least 900 ms.



Also, do not forget that the initial rate is collected shortly before the 3

minute period is up.



Incidentally, once the above MF tones for collecting and returning coins reach

the CO, they are converted into an appropriate DC pulse (-130 volts for return

& +130 volts for collect).  This pulse is then sent down the tip to the

fortress.  This causes the coin relay to either return or collect the coins.



The alleged "T-Network" takes advantage of this information.  When a pulse for

COIN COLLECT (+130 VDC) is sent down the line, it must be grounded somewhere.

This is usually either the yellow or black wire.  Thus, if the wires are

exposed, these wires can be cut to prevent the pulse from being grounded.  When

the three minute initial period is almost up, make sure that the black & yellow

wires are severed; then hang up, wait about 15 seconds in case of a second

pulse, reconnect the wires, pick up the fone, hang up again, and if all goes

well it should be "JACKPOT" time.



Physical Attack:

----------------



A typical fortress weighs roughly 50 lbs.  with an empty coin box.  Most of

this is accounted for in the armor plating.  Why all the security?  Well, Bell

contributes it to the following:



"Social changes during the 1960's made the multislot coin station a prime

target for:  vandalism, strong arm robbery, fraud, and theft of service.  This

brought about the introduction of the more rugged single slot coin station and

a new environment for coin service."



As for picking the lock, I will quote Mr.  Phelps:  "We often fantasize about

'picking the lock' or 'getting a master key.' Well, you can forget about it.  I

don't like to discourage people, but it will save you from wasting alot of your

time--time which can be put to better use (heh, heh)."



As for physical attack, the coin plate is secured on all four side by hardened

steel bolts which pass through two slots each.  These bolts are in turn

interlocked by the main lock.



One phreak I know did manage to take one of the 'mothers' home (which was

attached to a piece of plywood at a construction site; otherwise, the permanent

ones are a bitch to detach from the wall!).  It took him almost ten hours to

open the coin box using a power drill, sledge hammers, and crow bars (which was

empty -- perhaps next time, he will deposit a coin first to hear if it slushes

down nicely or hits the empty bottom with a clunk.)



Taking the fone offers a higher margin of success.  Although this may be

difficult often requiring brute force and there has been several cases of back

axles being lost trying to take down a fone!  A quick and dirty way to open the

coin box is by using a shotgun.  In Detroit, after ecologists cleaned out a

municipal pond, they found 168 coin phone rifled.



In colder areas, such as Canada, some shrewd people tape up the fones using

duct tape, pour in water, and come back the next day when the water will have

froze thus expanding and cracking the fone open.



In one case, "unauthorized coin collectors" where caught when they brought

$6,000 in change to a bank and the bank became suspicious...



At any rate, the main lock is an eight level tumbler located on the right side

of the coin box.  This lock has 390,625 possible positions (5 ^ 8, since there

are 8 tumblers each with 5 possible positions) thus it is highly pick

resistant!  The lock is held in place by 4 screws.  If there is sufficient

clearance to the right of the fone, it is conceivable to punch out the screws

using the drilling pattern below (provided by Alexander Mundy in TAP #32):



   ====================================

                       !!        ^

                       !!        !

           ! 1- 3/16 " !!        !

           !<---   --->!!      1-1/2"

       --------------------      !

       !   !           !! !      !

       !  (+)         (+)-! -----------

    ---!               !! !      ^

    !  !               !! !      !

    !  !        (Z)    !! !      !

    !  !               !! !   2-3/16"

    ---!               !! !      !

       !  (+)         (+) !      !

       !               !! !      !

       -------------------- -----------

                       !!

                       !!

        (Z) Keyhole   (+) Screws

                       !!

    ===================================





After this is accomplished, the lock can be pushed backwards disengaging the

lock from the cover plate.  The four bolts of the cover plate can then be

retracted by turning the boltworks with a simple key in the shape of the hole

on the coin plate (see diagram below).  Of course, there are other methods and

drilling patterns.



:-------------------------------------:

                   _

                  ! !

                  ( )

                  !_!

               [roughly]

    Diagram of cover plate keyhole

:-------------------------------------:



The top cover uses a similar (but not as strong) locking method with the

keyhole depicted above on the top left side and a regular lock (probably

tumbler also) on the top right-hand side.  It is interesting to experiment with

the coin shute and the fortresses own "red box" (which Bell didn't have the

'balls' to color red).



Miscellaneous:

--------------



In a few areas (rural & Canada), post- pay service exists.  With this type of

service, the mouthpiece is cut off until the caller deposits money when the

called party answers.  This also allows for free calls to weather and other

DIAL-IT services!  Recently, 2600 magazine announced the CLEAR BOX which

consists of a telephone pickup coil and a small amp.  It is based on the

principal that the receiver is also a weak transmitter and that by amplifying

your signal you can talk via the transmitter thus avoiding costly telephone

charges!



Most fortresses are found in the 9xxx area.  Under former Bell areas, they

usually start at 98xx (right below the 99xx official series) and move downward.



Since the line, not the fone, determines whether or not a deposit must be made,

DTF & Charge-A-Call fones make great extensions!



Finally, fortress fones allow for a new hobby--instruction plate collecting.

All that is required is a flat-head screwdriver and a pair of needle-nose

pliers.  Simply use the screwdriver to lift underneath the plate so that you

can grab it with the pliers and yank downwards.  I would suggest covering the

tips of the pliers with electrical tape to prevent scratching.  Ten cent plates

are definitely becoming a "rarity!"



Fortress Security:

------------------



While a lonely fortress may seem the perfect target, beware!  The Gestapo has

been known to stake out fortresses for as long as 6 years according to the

Grass Roots Quarterly.  To avoid any problems, do not use the same fones

repeatedly for boxing, calling cards, & other experiments.  The telco knows how

much money should be in the coin box and when its not there they tend to get

perturbed (read:  pissed off).



-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-



Disclaimer:

-----------



The preceding is intended for "information purposes only" and I do not advocate

that you participate in any subversive activities...





Coming sooner or later:

-----------------------



Part VII will deal with blue boxing.





References/Suggested Reading:

-----------------------------



Various hard-to-find Bell System publications.



"Alternate Method of Opening the Fortress Phone Coin Box," Alexander Mundy, TAP

#32.



"Build a T-Network for Fun & Profit," TAP #15.



"Coiners & Other Thieves," The Phone Book, J.  Edgar Hyde, pp 88-91.



"Fortress Fun-ding," TAP #66.



"The Green & Brown Box," Ted Veil & Nick Haflinger, TAP #68.



"Introducing the Clear Box!," 2600, July 1984.



"More Fortress Fun," TAP #49



"Notes on the Network," AT&T, 1980, [The definitive technical reference

guide!].



-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-



2600:

Box 752

Middle Island, NY 11953



Subscriptions:  $10/year (published monthly)

Last Issue (as of 10/27/84):  October 1984



-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-



TAP:

Room 603

147 W 42 Street

New York, NY 10036



Subscriptions:  $10/10 issues or so (published sporadically since 1971)

Last Issue (as of 10/27/84):  January/February 1984 [#90]



-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

*****BIOC           (p) 1984 BIOC

*=$=*Agent          International, Ltd.

*****003



October 6, 1984



           <<=-FARGO 4A-=>>



 [Sherwood Forest ][ - (914) 359-1517]

           [20 Megs On-Line]



PS Sysops of BBS's are welcome to use this material providing that nothing is

altered.



PPS Any and all threats, comments, corrections, suggestions, & subpoenas are

welcome.



-----End of File

Call The Works BBS - 1600+ Textfiles! - [914]/238-8195 - 300/1200 - Always Open

