From fake@address.com Tue Jun 23 11:15:03 1998
Newsgroups: alt.phreaking
Subject: Arc: Do Red Boxes still work Today? by Cyber Thief
From: fake@address.com (Cyber Thief)
Date: 23 Jun 1998 18:15:03 GMT

        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

               Do Red Boxes still work Today?

                          by

                     Cyber Thief 

                    © 11/97 and 1/98 

        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


NOTE: This file was originally written in November 1997. Due to new 
      information recently uncovered I thought it best to update it.

 
 I've seen a lot of questions lately about Red Boxes and I thought that it
would be a good idea to write a file that explains the latest 
countermeasures used by the telco to prevent coin toll fraud. This file will 
explain why your Red Box is USELESS on all those new pay phones. 

                  A Brief Tutorial

 I don't want to go into a lot of detail since there are hundreds of other 
text files on Red Boxing out there, but I thought it would be best  
to explain what Red Boxing is and how it really works.

 When you deposit coins into a pay phone, the phone emits a series of high 
pitched DTMF tones that tell a computer at the CO called ACTS exactly how
much money was deposited. ACTS stands for the Automated Coin Toll System, 
and handles all long distance and international pay phone transactions. 
ACTS is responsible for the annoying voice that says "Please deposit $". 
It then listens for the coin beeps from the phone before connecting your 
call. In case you're wondering, it is impossible to hear these beeps 
yourself because the earpiece at the pay phone is disabled during the coin 
tone readouts. Despite this fact, the frequencies that make up the ACTS 
coin tones are already well known...

* 1700Hz + 2200Hz played five times for 35 milliseconds with a 35 
  millisecond pause in between each beep, is the tone for a quarter.

* 1700Hz + 2200Hz played twice for 66 milliseconds with a 66 millisecond 
  pause between each beep is a dime tone.

* 1700Hz + 2200Hz held once for 66 milliseconds is a nickel tone. 

 A "Red Box" is simply a device that spoofs these tones. In other words, a
Red Box is a tone generator that emulates similar tones to fool the pay 
phone into giving free calls.

 There are several ways of making a Red Box including building one from 
various oscillators, modifying a tone dialer, and recording the tones on
tape recorders or digital recording devices. Each method works well and most
likely has it's own text file that goes into much more detail about 
construction.

HOWEVER, this file is about countermeasures. If you are looking for Red Box
plans I can assure you they are not here.



* Band Pass Filters

 A band pass filter is a device that cuts out a specified frequency range 
while passing others. The band pass filters used in modern pay phones are 
preset to cut frequencies of 1700 + 2200Hz only. These filters are usually 
found in the mouthpiece. This placement is done intentionally to prevent 
filtering of the real tones (which are produced inside the pay phone) but 
allow blocking of tones from the handset. Band pass filters render your 
Red Box useless because whatever tones you send to ACTS won't make it.

* BOCOTS

 These are a new breed of pay phones that have proved very effective in
preventing Red Box fraud. BOCOT stands for Bell Owned Coin Operated 
Telephone. These phones get most of their security from the features found 
in COCOTs. COCOT is an acronym for Customer Owned Coin Operated Telephone.  
A COCOT is a phone owned by a telephone company customer. Cocot 
pay phones are commonly found in restaurants and other business 
establishments. The business will pay a Cocot provider to set up a phone
and a special pay phone loop. All profits made from the Cocot are awarded
to the owner as opposed to the phone company. It is a good way to make an
extra few bucks if you own a store or small restaurant. Cocots are notorious
for their security. Thus the telephone companies adopted some of the 
features of the Cocot phones to use in their new Bocot phones. Cocots and 
Bocots are not susceptible to Red Box tones because they do not use tones to 
verify the coin deposits. Most Bocots use a ground check or other method to 
verify the prescense of money.

* Digital Pay Phones

 Many companies have already begun to upgrade their pay phones to use 
digital verification. This means that a digital signal is sent as opposed
to a tone. Unfortunately, digital pay phones are starting to become 
popular as they replace the older analog phones.

* Distortion Circuits

 A few pay phones have a distortion circuit in the mouthpiece that makes
voice communication difficult and the transmission of tones next to 
impossible. This is because a lot of crap is heard by ACTS while you play 
your Red Box tones causing it to disregard them or an operator to intercept.

* Muted Mouthpiece

 Some pay phones cut off the mouthpiece prior to coin deposits. This 
prevents tone transmissions during the ACTS billing procedure. Needless
to say, your Red Box won't work if the mouthpiece is muted.

A cure for the mute?

 Some recent developements indicate the mute HAS BEEN DEFEATED on most pay
phones. A new box called the "Battery Box" has proved quite effective when 
it comes to the problem of the mouthpiece mute. The Battery Box is simply a
9 volt battery connector wired to two alligator clips. The clips are secured
to the red and black wires inside the handset and the 9 volt battery is 
plugged in. This causes a voltage increase which enables the mouthpiece
to transmit sound briefly.

 The Battery Box works on the principle that a voltage restriction within 
the pay phone is responsible for the "mute" which is activated upon lifting 
the handset. The Battery Box pumps up the voltage providing enough juice to 
hold the mouthpiece open while the user plays the Red Box tones for ACTS.

 Unfortunately, this new invention is not without problems. The Battery
Box can be very difficult and time consuming to hook up without the proper
tools. It also causes minor damage to the phone which will most likely be
noticed by Bell security. In addition the box has little effect on pay
phones muted by devices planted inside the handset.

Notes

 I've heard that on some pay phones that are muted, you can avoid it by
dialing 10-321 or another "10 code" which will re-route your call to another
service provider. I'm not quite sure if it works, but it is worth a try.

 I don't believe anyone has been successful in trying to defeat band pass
filters, digital phones, or distortion circuits, but research is being done
to find a cure!

Does accuracy really matter?

 I addressed this subject in an earlier edition of this file. The old file 
included elaborate diagrams of waveforms and such. Recently I found that 
accuracy really isn't as important as one would think. 

 If you have been getting a lot of operators lately it is most likely NOT 
because of inaccurate tones. There are usually two reasons one would 
expierience these problems. 

 The first is noise. When a coin is deposited, the mouthpiece is cut off to 
prevent ambient sounds (not fraud) from interfering with the coin tone 
detection process. Bell operators know this, and if they hear noise while 
the Red Box tones are playing, fraud will most likely be suspected. 

 The best way to eliminate this problem is to make sure the speaker of your 
Red Box (I use a modified tone dialer) covers the entire mouthpiece. In 
addition you may wish to cup your hands around the piece as well. This won't 
always work, but it muffles most of the immediate background noise that 
could lead to suspician.

 The second reason one would encounter an operator is the lack of an initial
coin deposit. Remember that pay phones use anti-fraud tests to ensure that
some real money has been deposited. These tests usually include a ground
check on the coin deposited first. If one were to dial a number and start
playing Red Box tones, the fraud would be noticed right away when the ground
check indicates no coins are in the hopper.

 The easiest way to avoid this situation is to deposit at least one real
coin before using the Red Box beeps. This way the ground check indicates 
that some money is in the hopper. But, the operator won't know how much was
deposited until she hears the coin tones which will be simulated by your Red
Box (what she dosen't know can't hurt YOU)!

Oh yeah, one other thing, it is very important to play your tones SLOWLY.
Take a brief pause in between each beep. If the beeps are too fast, the 
operator will suspect Red Box fraud and you can guess what will happen next!

That is all for now. I hope this has been helpful.

Later,

C.T.

cyberthief@deathsdoor.com

http://members.wbs.net/homepages/c/y/b/cyberthief128.html

----------------------------------------------------------------------------

Other Files Written by Cyber Thief:

Title                                                Filename
-----                                                --------

Answering Machines and Code Boxing                   codebox.txt
Battery Box Plans                                    battery.txt
Blue Box Plans from Osuny Revisited                  bluebox.txt
Cable for Free                                       cable.txt
Criticism of the Red Box FAQ                         redfaq2c.txt
Destroy Public Restrooms                             destoile.txt 
Do Red Boxes still work Today?                       redwork.txt 
Eliminate Video Copy Protection                      eidak.txt
Free Stuff                                           free.txt
How to Defeat Caller ID, *57, and *69                defeat69.txt
How to Destroy the Rapids                            rapids.txt
How to make Free Local Calls on New Pay Phones       nopay.txt 
Orange Boxes, A Modern Day Legend?                   orange.txt
Procuring Porn if you're Under the Legal Age         getporn.txt
Safe Scanning                                        scanning.txt
Talkie Box Plans                                     talkie.txt 

Books: 

Phone Color Box Addendum