TUCoPS :: Phreaking Boxes - Red

TUCoPS :: Phreaking Boxes - Red :: freephon.txt
Red Box: Simple instructions to build a red box

February 1994

HOW TO MAKE FREE PAYPHONE CALLS BY USING TONES INSTEAD OF COINS!

FOR INFORMATIONAL AND EDUCATIONAL PURPOSES ONLY!

Each time a coin is inserted into a payphone, the payphone sends tones to the phone company's centraswitching computer indicating the value of that coin.

A "RED BOX" is a device which produces these same tones through a small speaker. In most cases, actating a RED BOX into a payphone's microphone will fool the central switching computer into believin hat coin(s) have in fact been deposited into the payphone, thereby allowing a phone call to go thrug.

For the purposes of this manual, a payphone is defined as a "Bell" or "Wireline" company owned payphe. These are usually distinguishable from "COCOTS" (Consumer owned Coin Operated Telephones) by th Bell" Logo on the front of the payphone. These payphones are operated by the same company which povdes regular telephone service to that particular area.

RED BOXES only work at "Bell" or "Wireline" company payphones. RED BOXES do not work at COCOTS. REBOXES only work for calls costing more than a local call. RED BOXES are not legal. Use of RED BOXSto place telephone calls without paying for them constitutes fraud.

When a payphone is used to make a call outside of its local calling area, the payphone connects withts central computer, not a live operator. The first thing that the central computer does is send acin return signal to the payphone. Any coins previously deposited into the payphone (if any) are ouinely returned through the coin return. Following the coin return signal, the central switching ompter, in a synthesized voice, asks for the correct amount to be deposited for that call. RED BOXS ony work at this point. If a live operator answers, it is very likely that the RED BOX will notbe efective and its use will probably raise suspicion.

RED BOXES work with most long distance carriers. If a RED BOX is ineffective with a particular longistance carrier, it may help to switch to a different long distance carrier. This is done by preceig the number to be called with the five digit access code for the long distance carrier of choice or example, the access code for AT&T is 10288. Remember to dial "1" between the access code and he hone number if required.

WHAT IS REQUIRED TO GET STARTED

The core of the RED BOX is Radio Shack's Memory Pocket Tone Dialer (Catalog #43-141) and it costs on $24.95. As it was intended, this Memory Pocket Tone Dialer remembers and dials phone numbers as tns. It is used on the road as a convenience to remember and dial up to thirty three numbers. Thiselminates mistakes due to memory lapses or misdialing.

Because the Memory Pocket Tone Dialer is designed specifically to be held up to payphone microphonesit will not look the least bit suspicious when in use. It is powered by three AAA batteries whichmst be purchased separately. At only thirty nine cents each, (Radio Shack Catalog #23-584) this wil dd just $1.17 to the Radio Shack bill.

Using this manual, my eight year old daughter constructed a RED BOX by following these simple steps.The reference photographs make it so easy that virtually anyone can finish a RED BOX faster than Doio's can deliver a pizza.Figure 1 shows all the parts and tools required. The dialer, three batteres two tools, one component and solder is all it takes. It's that easy.

This manual repeatedly refers to a "crystal oscillator" This crystal oscillator is the only hard toind part needed to make your own RED BOX. Everything else needed is so commonplace, it can be purcaed at any Radio Shack Store. The crystal oscillator is available by mail-order from an electronicpats distributor in California called T.N.C.I. The crystal oscillator is T.N.C.I. Part Number 19875 nd they'll even ship it out C.O.D. T.N.C.I.'s quantity one price is $33.25 for the crystal osillaor and their price goes down by 30% at quantity ten.

T.N.C.I. can be reached at (310) 798-4650 for telephone C.O.D. Orders and their mailing address is: N.C.I., 1525 Aviation Boulevard, Suite 215, Redondo Beach, California, 90278. Pricing for the crytl oscillator (T.N.C.I. Part Number 198675) is as follows: Quantity 1-9: $33.25; Quantity 10-49: $3.5; Quantity 50-99: $19.95; Quantity 100+: $18.25. T.N.C.I. charges $4.00 for shipping and handlig ad an extra $5.00 for C.O.D. shipments so its cheaper to just send them a check or money order. f yo live in California, don't forget to add 8.25% sales tax which (at quantity 1-9) adds another 2.74 er crystal oscillator. The total order price for one crystal oscillator (T.N.C.I. Part Number198675 is $37.25 outside California and $39.99 in California. Remember to include the part number ith you order and to add $5.00 for C.O.D. orders.

Finally, making a RED BOX requires just two tools: a soldering iron with a small amount of solder a a small Phillips screwdriver. If a soldering iron is not available, Radio Shack sells many differn types. They're all easy to use, but the least expensive (Catalog #64-2067) will work perfectly ad osts only $4.99. Soldering irons are used to heat a metal called solder to make electrical connetios. At Radio Shack, solder (Catalog #64-001) costs only $0.99.
Once heated, solder melts and turns into a liquid. When the heat is removed, the solder quickly solifies and bonds to whatever metal it is touching. By heating solder next to the leads of electrica omponents and then allowing the solder to cool, it is easy to make quick semipermanent electrical onections to them. The reason these connections are semipermanent and not permanent is reheating te slder will return it to a liquid state. Once the solder is a liquid, it is possible to remove th eletrical component from its soldered connection. This is called desoldering. This may sound triky, bt it's so easy that my eight year old daughter, who had never even seen a soldering iron befor, was ble to solder and desolder perfectly on her very first try. The function of the Phillips scrwdriveris simply to remove and replace the four small Phillips screws which hold together the diale's case.

MAKING A RED BOX IS SIMPLE!

Using this manual, my eight year old daughter constructed a RED BOX by following these simple steps.The reference photographs make it so easy that virtually anyone can finish a RED BOX faster than Doio's can deliver a pizza. Be aware that once the conversion to a RED BOX is complete, the Memory Pckt Tone Dialer will no longer function as it was originally intended.

1. Turn the dialer over so that the keypad is facing down and slide off the battery cover.

2. Using the screwdriver, remove the four screws holding the dialer case together (see figure 2). T only important thing of note here is that if the screwdriver is too small it may strip the head ofte screws and if it is too large it may mar the plastic case or simply not work at all with the smal crews in the case. Take extra care not to strip the heads of the screws or to mar the plastic ofthedialer's case.

3. The case of the dialer is comprised of two plastic halves now held together by only four small pltic catches (see figure 3). Carefully separate the two halves of the dialer case by first applyingasmall amount of inward pressure on the two lower catches which are closest to the battery compartmnt There is very little plastic here, so only a small amount of pressure is necessary. Once the btto half of the case has been separated slightly, run a fingernail up the small groove between the ase alves while applying a small amount of inward pressure on the upper two plastic catches. This ill cuse the plastic halves to separate completely (see figure 4). Please note that there are foursmall ires that run between the two case halves. Be careful not to pull the halves too far apart, s this ay damage the connections these wires make.

4. If it's not already hot, now would be a good time to plug in and preheat the soldering iron. Theetal part of the iron will reach temperatures in excess of 400 degrees, so be sure to prop it up t eep the tip from burning anything. Also, to allow the iron time to heat up, remember to wait at las five minutes after plugging it in before trying to solder.

5. All that's required to convert the dialer to a RED BOX is the removal of one of its components byesoldering it, and the installation of the T.N.C.I. crystal oscillator. This is done by soldering tecrystal oscillator in a slightly different place on the circuit board. The component to be remove i cylindrical in shape, has two small silver wires extending from one end and is usually silver incolr (see figure 4 close up). The first step in removing it is gently prying it off of the circuitboar. This will make it easier to remove any and all glue which may bind it to the circuit board an to te components adjacent it (see figure 5).

6. Once the component to be removed has been freed from the glue, it is time to desolder it. This idone by using the soldering iron to simultaneously heat the two solder pads where the wires of the oponent are connected to the circuit board (see figure 6). When both solder pads turn liquid, liftth component away from the circuit board. Make certain that the two small pads of solder remainingon he circuit board are not touching one another. If they are touching, separate them by running te ponted tip of the soldering iron along the circuit board between the two pads of solder until the are o longer connected to each other (see figure 7). Cleaning the tip of the soldering iron with damp ag so that it is free of solder makes this process easier.

7. Next, to make installation of the T.N.C.I. crystal oscillator easier, it is best to gently be upward from horizontal to vertical the two circular, beige, disk-like components nearest and to th ight of the component which was just removed (see figure 8).

8. Now it is time to install the T.N.C.I. crystal oscillator. Put the crystal oscillator flat on thcircuit board with its two wires threaded through the space under each disk-like component. Make sr that only one of the two wires from the crystal oscillator is under each disk-like component (seefiure 9).

9. On the other side of each disk-like component, where the ends of the two wires from the crystal oillator thread through, bend each end of the wire slightly to the left (towards the side where the oponent was removed earlier). This is so each end of each wire from the crystal oscillator only tochs the left of the two solder pads holding each disk-like component to the circuit board (see figue 9. Make sure that these two wires from the crystal oscillator touch nowhere else on the circuit oard Bending each lead slightly to the left, so it is positioned directly on top of the left solde pad f each disk-like component will make soldering easier.

10. Using the soldering iron, gently press down on the right lead from the crystal oscillator in su a way that the soldering iron heats both the lead from the crystal oscillator and the correspondin older pad beneath it. Once the solder on the board begins to liquefy, touch either end of the solersupplied with this manual to the end of the wire coming from the crystal oscillator being soldere (se figure 10). Only a very small amount of solder is required to make a good connection, especialy i a good amount of solder is already on the circuit board. The more solder used, the greater th chane of shorting out a component, so use it sparingly. Once the solder has melted, remove both te soldring iron and the unused solder from the board and allow the solder to cool. Within five secnds thenew solder joint will have cooled and the connection will be made. Make sure that the solde joint jst created has not flowed off of the solder pad and accidentally connected to another compoent on th circuit board. Also, make certain that right lead of the circular beige disk-like componnt is not ouching the wire coming from the crystal oscillator, which is running beneath the disk-lie component

11. Repeat Step 10 with the left lead from the T.N.C.I. crystal oscillator (see figure 11).

12. Gently bend both disk-like components back so they are almost flat against the circuit board on again (see figure 12). There is no reason to force these components all the way back to horizonta. Bend them back very gently without forcing them.

13. Carefully snap the two halves of the plastic case back together and replace the four small Phills screws. Insert the three AAA batteries (see figure 13) and slide the battery compartment cover bc on. To check it works, slide the power switch to the "ON" position, and slide the "STORE/DIAL" sith to the "DIAL" position. Now, simply press a few of the number keys, just like dialing a touch onetelephone, and listen for tones coming out of the speaker. If tones are present, CONGRATULATION! Te modification was successful. Once tones are present, proceed to step 14. If no tones are adible check that the batteries are installed properly, noting which direction that they must facingper th diagram inside of the battery compartment. Be certain that the batteries are new. If the bateries heck out fine and there are still no tones, it will be necessary to reopen the dialer to receck the ew solder connections. Also, make sure that none of the four small wires between the casehalves ar broken, and that no stray pieces of solder are causing other components to touch each othr. Do notproceed to the next step until all problems are fixed and tones are heard from the dialers speaker.

14. The next step is to program the RED BOX memory with the "sound" of quarter(s). This is done by iding the power switch to the "ON" position, and sliding the "STORE/DIAL" switch to the "STORE" poston. The dialer has three special one touch memory positions, labeled "P1", "P2", and "P3" (see fiur 14). These will be used for storing the simulated sounds of one quarter, two quarters, and threequaters, respectively. The simulation of one quarter is done by connecting five short bursts of th sta "*" button. To store this in the memory location "P1", start by touching the "MEMORY" button,then ress the star button five times, then the "MEMORY" button again, and finally press the "P1" buton. he dialer should respond with a confirming beep and memory location "P1" is now programmed wih the sund of one quarter.

15. Next, program the RED BOX's "P2" memory location with the sound of two quarters. Since the slidswitches are already in the correct position, there is no need to move them. Start by touching the"EMORY" button, then press the star "*" button five times, then the "PAUSE" button once, then pres he star "*" button five more times, then the "MEMORY" button again, and finally press the "P2" buton The dialer should once again respond with a confirming beep and memory location "P2" is now prgramed with the sound of two quarters.

16. Finally, program the RED BOX's "P3" memory location with the sound of three quarters. Start byouching the "MEMORY" button, then press the star "*" button five times, then the "PAUSE" button onc, then press the star "*" button five more times, then the "PAUSE" button once, then press the str *" button five more times, then the "MEMORY" button again, and finally press the "P3" button. Th diler should respond with a confirming beep and memory location "P3" is now programmed with the sond o three quarters.

17. Slide the "STORE/DIAL" switch to the "DIAL" position, and the RED BOX is now finished. Test itsrogramming and batteries by pressing the "P1" button. Five short, fast beeps should be heard. If nt go back to step 14 and carefully try again. The RED BOX can now be used as described below by hodig the RED BOX speaker firmly up against the microphone (see figure 15) of most "Bell" or "Wirelin" cmpany owned payphones.

One important note about using the dialer: If its batteries are removed for more than two minutes oare allowed to completely discharge, the dialer will lose its programming. In this event, replace h dialer's batteries and reprogram it by repeating steps 14 through 17. More complete instruction ad information about the dialer can be found in the owner's manual which accompanies it. Keep in indthat its touch tone buttons will no longer function correctly.

USING A RED BOX

When contemplating the use of a RED BOX, remember the following:

RED BOXES only work at "Bell" or "Wireline" company payphones for calls costing more than a local ca. When a payphone is used to make a call outside of its local calling area, the payphone connects ih the central switching computer, not a live operator. The central switching computer, in a synthsied voice, asks for the correct amount to be deposited for that call.

RED BOXES are only effective starting at this point. Be sure to wait for the synthesized voice, fousing a RED BOX too soon will result in an instant live operator intercept. If a live operator answr, it is very likely that the RED BOX will not be effective and its use will probably raise suspicin. As a general rule, use of a RED BOX should be limited to synthesized requests for money and shoud nt be used with live operators.

Depending on the amount requested by the synthesized voice, use the "P1" button to simulate droppingne quarter into the payphone, use the "P2" button to simulate two quarters, and the "P3" to simulat hree quarters. While the RED BOX is transmitting its tones, be very careful to continue to hold te ED BOX speaker firmly and directly over the payphone's microphone (see figure 15). Do not overpa fo any call by more than twenty cents. Should a live operator intercept the call, something is no woring perfectly. Hanging up and moving on to another payphone would not be a bad idea.

During a call it is common for a voice to interrupt and request more money to continue the call. Shod the request be made by a synthesized voice, as is often the case, the RED BOX will work just fine On the other hand, if a live operator is requesting the overtime money, disconnecting and moving o wuld be prudent. In the alternative inserting coins will of course always work.

After a call is complete and the payphone is hung up, it is common for the payphone to ring almost iediately and request more money for overtime. Should the request be made by a synthesized voice, a s often the case, the RED BOX will work fine. On the other hand, if a live operator requests the vetime money, disconnecting and moving on is suggested. Keep in mind that the operator still has arecrd of the phone number just called. If the operator suspects that a RED BOX was used to fraudulntlyplace the call, it would not be difficult for the operator to recall the previous number and as thatparty who they were just speaking to. Although proving this is indeed difficult, a situation ike ths is best avoided. Think about what may happen ahead of time and plan for it.

The use of a RED BOX is fraud and is illegal. This information is presented for educational and infmational purposes only and is not intended to be implemented! Regardless of the nature of this wriig, using these methods is not recommended.

FOR INFORMATIONAL AND EDUCATIONAL PURPOSES ONLY!

15. Next, program the RED BOX's "P