From jenn@phreaker.net Sun May 13 12:58:04 2001
Newsgroups: alt.phreaking
Subject: Red Box Manual v. 1.0 by Cyber Thief
From: "Jenn" <jenn@phreaker.net>
Date: Sun, 13 May 2001 14:58:04 -0500
Red Box Manual v. 1.0
by
Cyber Thief
Like many of you I'm tired of seeing the same Red Box questions posted
over and over. So, I'm writing this in hopes of reducing the number of
questions on the subject. The next time a newbie posts a question about
Red Boxing just cut and paste this manual as your reply. Hopefully this will
help filter out some of the crap and promote REAL discussions.
Contents
What is a Red Box?
Ok, so what is ACTS?
How does a Red Box work?
Where can I get a Red Box?
How do I build a Red Box?
What is a Combo Box and how do I build it?
Can I construct a Red Box from the 43-145 dialer?
How do I use a Red Box?
What is the legality of Red Boxing?
What will happen if I get caught using a Red Box?
Do Red Box tones still work?
Do other box tones still work?
Why do I get operators when I play the tones?
Where can I get a .wav file of Red Box tones?
What are some good Red Box tone generators?
Can I record the Red Box tones on tape?
What is the exact frequency of the pay phone tones?
Where can I obtain 6.50Mhz crystals?
aM i A k-RaD eLiTe HaXoR iF i HaVe A rEd BoX?
How do I defeat Cocot Pay Phones?
What is a Red Box?
==================
A Red Box is an ETFD (electronic toll fraud device) that simulates the
tone burst emulated by a pay phone upon the deposit of coins. These devices
are commonly used to fool the system called ACTS into believing coins have
been deposited into a public pay phone.
Ok, so what is ACTS?
====================
ACTS is an acronym which stands for Automated Coin Toll System. ACTS is
responsible for handling all long distance and international pay phone
transactions. It is also responsible for the annoying voice that says
"Please deposit $$$.."
How does a Red Box work?
========================
When a coin is deposited into the slot, the phone emulates a tone telling
ACTS the value of the coin deposited. For every five cent increment one beep
tone is produced. ACTS simply adds up the beeps and determines if you have
deposited enough money to complete the call. A Red Box simulates these tones
in order to fool ACTS into believing coins have been deposited.
Where can I get a Red Box?
==========================
There are many companies that sell Red Boxes and similar devices but they
are almost always overpriced. The best solution is to build a Red Box
yourself.
How do I build a Red Box?
=========================
There are several ways of doing this. Modifying a Radio Shack Tone Dialer
is the easiest by far.
Materials
---------
(1) 33 Memory Pocket Tone Dialer Cat # 43-146
(1) 6.49, 6.50, or 6.5536Mhz Crystal
(1) Tiny Phillips Head Screwdriver
(1) Flat Head Screwdriver
(1) Soldering Iron
Procedure
---------
(Taken from the book "Phone Color Box Addendum" by Cyber Thief)
1. Put the tone dialer face down on a hard flat surface.
2. Remove the two Phillips Head screws at the top.
3. Remove the battery compartment cover and the four Phillips Head screws
underneath it.
4. Slide the flat head screwdriver into the seam on the side of the dialer
and carefully separate the two halves. Be sure not to break the speaker
wires that hold the two halves of the dialer together.
5. Locate the crystal. In the older models it was a round silver cylinder.
In the newer models it is harder to locate. Look on the left hand side
of the dialer. You should see a square tan colored component labeled
"Z3.58M". This is the crystal we will be removing, which I might add is
exactly 3.579545Mhz.
6. Pull the crystal up and away from the circuit board. Break the glue that
is holding it down. Desolder this crystal and throw it away since it has
no real use in life.
7. Bend the leads of the new crystal so they fit exactly with the leads on
the board. Solder the crystal in place, and be sure both leads are
touching the leads on the circuit board.
8.. You may want to place a piece of electric tape under the crystal to
prevent it from touching other components on the board.
9. Put the dialer back together carefully and replace the batteries.
Programming your Red Box
1. Turn the dialer on and flip the store/dial switch into STORE mode.
2. Now press MEMORY , * * * * * , MEMORY , P1. This is your quarter tone.
3. You can now program in additional quarters. You could also use the pause
feature to create a temporary silence between each set of tones. On my
Red Box P1 is one quarter, P2 is two quarters, and P3 is four quarters.
4. You could also program in the nickel and dime tones. For the nickel hit
MEMORY , * , MEMORY , P#. For the dime hit MEMORY , * * , MEMORY , P#.
Notes: The value of the crystal varies between 6.49 and 6.5536Mhz.
6.5536Mhz is more commonly used because it is widely available.
Although the tones produced by it are not very accurate. You will
encounter more operators if you use it.
6.49Mhz would be the IDEAL crystal to use, although they are
extremely rare. If you know someone who can make custom crystals,
go for it.
6.50Mhz is also difficult to find but it is much more accurate then
the 6.5536Mhz crystal. You can obtain a 6.50Mhz crystal from Mouser
and DigiKey. Their addresses are listed at the end.
What is a Combo Box and how do I build it?
==========================================
The Combo Box combines the functions of the Red Box and the tone dialer
(White Box). It allows you to utilize standard DTMF Touch Tones as well as
the ACTS coin tones.
Combo Boxes are easy and fun to make.
Materials
---------
(1) 33 Memory Pocket Tone Dialer Cat # 43-146
(1) 6.49, 6.50, or 6.5536Mhz Crystal
(1) Tiny Phillips Head Screwdriver
(1) Flat Head Screwdriver
(1) Soldering Iron
(2) Pieces of wire
(1) Mini slide switch Cat # 275-407
(1) Pair of scissors
(1) Pocket knife
(1) Roll of electric tape
Procedure
--------
1. Put the tone dialer face down on a hard flat surface.
2. Remove the two Phillips Head screws at the top.
3. Remove the battery compartment cover and the four Phillips Head screws
underneath it.
4. Slide the flat head screwdriver into the seam on the side of the dialer
and carefully separate the two halves. Be sure not to break the speaker
wires that hold the two halves of the dialer together.
5. Locate the crystal. In the older models it was a round silver cylinder.
In the newer models it is harder to locate. Look on the left hand side
of the dialer. You should see a square tan colored component labeled
"Z3.58M". This is the crystal we will be removing, which I might add is
exactly 3.579545Mhz.
6. Pull the crystal up and away from the circuit board. Break the glue that
is holding it down. Desolder this crystal and DO NOT throw it away since
it has a use in this project.
7. Now cut two pieces of wire about four inches long, and use a pocket knife
to strip both ends.
8. Solder both of these wires to the leads on the circuit board where the
original crystal used to be. Route the other ends out through the vent
holes on the back of the dialer.
9. Now reassemble the dialer.
10. Look at the bottom of your switch. See the six prongs? Good. On one end
solder the 6.50Mhz crystal and on the other solder the tone dialer
crystal. Now solder the two wires from the dialer to the two remaining
prongs. When finished the switch should look something like this....
/
/ Wires
/
| / |
|-------|--------0 0 0--------|------|
White Box | Z3.58M| | | |6.50 | Red Box Crystal
Crystal |-------|--------0 0 0--------|------|
|______/_______|
/
/ Wires
/
11. Now finish the job by taping the switch down. On my Red Box the switch
is secured to the battery compartment cover. Although the wires are long
enough so the cover can still be removed to access the batteries.
If everything was done correctly you should be able to generate both ACTS
and DTMF tones.
Can I construct a Red Box from the 43-145 dialer?
=================================================
Some people have asked about the possibility of modifying the 43-145 dialer
sold at Radio Shack. I believe this can be done, although it is somewhat
pointless. Unless you're Superman you won't be able to push the * button
fast enough to simulate the quarter and dime tones. You will be restricted
to using nickel tones only which is tedious to say the least.
How do I use a Red Box?
=======================
There are three types of calls that can be made with a Red Box.
Local Calls
1. Dial 10-10-321 followed by 1-NPA-#. After the ACTS announcement, deposit
one real coin and then use the appropriate Red Box tones to complete the
call.
2. Dial "0" and ask the operator if she'll dial for you. If she asks why,
tell her one of the keypad buttons is broken. Put in one real coin
followed by the Red Box tones.
3. Dial 411 and have them look up the person you want to call. After you
are told the number, the operator will say she can put you through
for an additional 50 cents. Agree to this and use your Red Box tones.
Long Distance Calls
1. Dial 1-NPA-#. After ACTS tells you the rate, use your coin and Red Box.
International Calls
1. Dial the number and use the Red Box when the operator prompts you to put
in money. Remember to use at least one real coin though.
By the way, hold the speaker of your Red Box flush with the mouthpiece when
using it.
What is the legality of Red Boxing?
===================================
Since you're screwing the phone company out of their money, the activity of
Red Boxing is illegal. Some paranoids will tell you it is also illegal to
own a Red Box. This is bull shit. If Red Boxes were against the law,
companies such as Consumertronics wouldn't be able to sell them.
Don't worry about getting caught either. As long as you keep your mouth
shut, no one will ever know you have a Red Box!
What will happen if I get caught using a Red Box?
=================================================
Who cares?! You won't get caught.
Do Red Box tones still work?
============================
Red Box tones still work in MOST places. Some newer pay phones are no
longer using the ACTS system and can not be boxed because they do not use
the coin signaling tones that the Red Box relies on. Examples include
Bocots, Cocots, and Digital pay phones. The best way to identify such a
phone
would be to have a friend call from it and deposit coins. If you can hear
the coin tones there is a good chance the Red Box will work. If you hear
short pauses of silence, or the coins falling into the hopper, the phone is
NOT using ACTS.
Some ACTS pay phones will employ clever countermeasures to stop the use of
Red Boxes. These countermeasures include putting a "mute" on the mouthpiece
during the ACTS announcement, band pass filters to remove suspicious tones,
or degrading the quality of the mouthpiece connection to ensure crappy
tone transmission. Obviously the Red Box will not work under such
conditions.
Do other box tones still work?
==============================
This has nothing to do with Red Boxing but it is yet another question often
asked.
Blue Box tones will NOT work in the United States. Blue Boxing died years
ago when the telco upgraded the system to use Out Band Signaling. In
Out Band Signaling, audible tones are not used to place long distance calls.
However, I have heard rumors of Blue Boxing in some third world countries
which use more primitive equipment.
Green Box tones don't work either. They died for the same reason Blue Boxes
did.
The A, B, C, and D tones of the Silver Box are also obsolete. In the
phreaking days of yore, they could be used to access the ADS of directory
assistance. This is no longer possible.
Why do I get operators when I play the tones?
=============================================
There are a few reasons for this...
The first is noise. When a coin is deposited, the mouthpiece is cut off to
prevent ambient sounds (not fraud) from interfering with the coin tone
detection process. Bell operators know this, and if they hear noise while
the Red Box tones are playing, fraud will most likely be suspected.
The best way to eliminate this problem is to make sure the speaker of your
Red Box (I use a modified tone dialer) covers the entire mouthpiece. In
addition you may wish to cup your hands around the piece as well. This won't
always work, but it muffles most of the immediate background noise that
could lead to suspicion.
The second reason one would encounter an operator is the lack of an initial
coin deposit. Remember that pay phones use anti-fraud tests to ensure that
some real money has been deposited. These tests usually include a ground
check on the coin deposited first. If one were to dial a number and start
playing Red Box tones, the fraud would be noticed right away when the ground
check indicates no coins are in the hopper.
The easiest way to avoid this situation is to deposit at least one real
coin before using the Red Box beeps. This way the ground check indicates
that some money is in the hopper. But, the operator won't know how much was
deposited until she hears the coin tones which will be simulated by your Red
Box (what she doesn't know can't hurt YOU)!
Oh yeah, one other thing, it is very important to play your tones SLOWLY.
Take a brief pause in between each beep. If the beeps are too fast, the
operator will suspect Red Box fraud and you can guess what will happen next!
Where can I get a .wav file of Red Box tones?
=============================================
http://nettrash.com/users/cyberthief/
http://techroom.base.org/
These are the only two sites that come to mind at the moment. I'm sure
there are others. Just do a search on Hotbot for "quarter.wav".
What are some good Red Box tone generators?
===========================================
* Cyber Phreak (Includes Red, Blue, and White Box tones)
* Omnibox (Includes Red, Blue, Green, White, and Silver Box tones)
* P-80 Box (Includes Red, Blue, Green, White, and Silver Box tones
as well as many other familiar phone sounds!)
* R-Box (Includes Red, Blue, Green, White, and Silver Box tones)
* Red Coin (Red Box Tone Generator)
* Tone Master (Includes Red, Blue, Green, White, and Silver Box tones)
Can I record the Red Box tones on tape?
=======================================
For the sixty-ninth time NO! You can record the tones on tape but they
won't work at the pay phone because the analog recording track used in the
tape recorder distorts them. I have heard of some people having success
using micro recorders that run at 2.75ips (inches per second) or faster,
but these are just too damn expensive! Get a dialer.
What is the exact frequency of the pay phone tones?
===================================================
1700HZ + 2200HZ played five times for 33ms (milli seconds) with a 33ms
pause between each beep represents a quarter.
1700HZ + 2200HZ played twice for 66ms with a 66ms pause between each beep
represents a dime.
1700HZ + 2200HZ played once for 66ms represents a nickel.
Where can I obtain 6.50Mhz crystals?
====================================
Digi-Key
701 Brooks Avenue South
PO Box 677
Thief River Falls, MN 56701-0677
Internet: http://www.digikey.com
Telephone: 1-800-DIGIKEY
Cat # X415-ND
Mouser Electronics
Internet: http://www.mouser.com
Telephone: 1-800-346-6873
Cat # 332-5065
aM i A k-RaD eLiTe HaXoR iF i HaVe A rEd BoX?
=============================================
No! Actually most phreaks consider Red Boxing quite lame because there is
no real skill involved. Hell, you don't have to know a thing about the phone
system in order to use a Red Box. Get it through your head, Red Boxing is
coin fraud, not phreaking!!
How do I defeat Cocot Pay Phones?
=================================
Again, this has nothing to do with Red Boxing but it is posted an awful
lot.
Plus it tells you what the DTMF tones on the Combo Box are useful for.
(This next section was taken from Phone Color Box Addendum by Cyber Thief)
Cocots and Other Privately Owned Pay Phones:
Not all pay phones are owned by your local telco. Many businesses will
install their own phones called Cocots (Customer Owned Coin Operated
Telephones), on the premises. The main reason for doing this is MONEY.
Let's face it, Cocots exist because of greed. If the phone company
can make a profit by selling calls then why shouldn't Mcdonalds, Dunkin
Doughnuts, Dominoes Pizza etc. be able to do the same? As one might expect,
companies who install Cocots make BIG profits so it's not unusual to
encounter more Cocots then telco phones these days.
Cocots are notorious for their extensive security efforts. The coin
verification system alone makes it impossible to place calls unless you
actually insert coins. When the handset is lifted on a Cocot, the dial tone
heard is fake. When a coin is inserted, the fake dial tone disappears only
to be replaced by the real dial tone at which point calling is possible.
Most Cocots have a fifteen minute time limit, and some do not even accept
incoming calls which leaves you no choice but to deposit more coins when
time runs out. You can dial long distance numbers on Cocots, but the
rates are about five times higher then At+t which is pretty bad. All in all,
Cocots are nothing but a rip off, a gimmick geared towards taking your
money.
Ripping off Cocots:
Because Cocots suck, many phreaks found themselves purchasing or
building White Boxes. The White Box takes advantage of one of the most
obvious flaws of the Cocot. The law says that 1-800 numbers must always be
accessible for free from any phone. So, the first step to defeating a
Cocot's security is to dial a toll free 800 number. When your call is
answered, you have two options, you can either cuss the person out, or
sit quietly and say nothing. Either way they should hang up. Now wait a few
seconds and listen carefully. If all goes well you should hear a dial tone..
Yes, this dial tone is real! So, you push a button on the keypad only to
find there is no tone. Why is that? It is just another security feature of
the Cocot. The keypad is intentionally disabled to prevent people like you
from taking advantage of the situation. Although this is no problem if you
have a White Box. Hold the speaker of the box flush with the mouthpiece and
dial away! You now have total unrestricted access to the line, cool eh?
Protection in Cocots:
Cocots are protected in two main ways. In some Cocots, the mouthpiece is
cut off after the called party hangs up. This prevents the use of a White
Box all together.
However, some Cocots automatically reset themselves after the
disconnection occurs. I've heard there is a way around this. On some phones,
you can whistle or blow into the mouthpiece until you hear the dial tone
click on. It is best to have your White Box ready so you can quickly hit
the first digit of the number upon hearing the dial tone. Once the first
digit has been entered, you should hear silence. At this point you may
finish dialing.
Another trick that supposedly works is to find two Cocots next to each
other. For a better understanding we'll call them Phone A and Phone B.
First, find out the number of Phone B either by dialing an ANAC number
you know, or looking on the card and finding the number listed for it
(if it allows incoming calls). Next, put some money in Phone A and call
up Phone B. When Phone B rings, answer it and hang up Phone A quickly.
Supposedly you will get an unrestricted dial tone on Phone B. Your money
will also be returned on Phone A because the call was too short or some
crap. Unfortunately I haven't tried this one yet so I don't know for sure
if it really works.
Here is yet another way to get free calls from SOME Cocots.
Sometimes you can dial 1-800-CALLATT and simply ask the operator to
dial a number for you. This works because a lot of Cocots are set up on
normal lines as opposed to real pay phones which are set up on a special
loop. However, if the Cocot owner is smart he/she will pay the phone company
to set them up on a pay phone loop. This eliminates most types of fraud
including the above mentioned scenario.
Last Words
==========
If you are a newbie I hope this file has been informative in answering your
questions regarding Red Boxes. If there is something you are still having
problems with, post it to the group. But please don't post questions that
have already been answered in this manual. It will just piss people off and
most likely lead to flames.
If anyone would like to add to this file go ahead. If you would like to use
this in a publication/web site be my guest. I may update it, I may not.
Just be sure that you give credit where credit is due (to me)!
--*- Boundary gz+G(vEh)?:u+S/O6Pin X--
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH
