TUCoPS :: Phreaking Boxes - Red :: redfaq2c.txt

Criticism of the Red Box FAQ

               Criticism of the "Red Box FAQ" 

                  AUTHOR: Unknown
                  CRITIC: Cyber Thief

      NOTE: Comments followed by > are those of the original author.


> Red boxes are devices that emulate the tones made by quarters when dropped
> in pay phones. These tones are used to tell the Central Office (local
> telephone switch station) that you paid money when you in fact did not
> really pay.
>
> ~~~HOW TO~~~~~
>
> The most popular red box is the modified Radio Shack tone dialer. This
> consists of replacing an oscillator in the dialer. The original
> oscillator's frequency is 3.579545 MHz, and the oscillator you need to
> install will be 6.50 MHz. If you're really skilled and want to make a
> more accurate box, get a non-VCO (voltage controlled oscillator) and tune
> it with an oscilloscope to 6.49 MHz (the "real" quarter tone frequency).
>
> The second type of red box is a recording of the tone, whether done on a
> tape or an electronic device. The best results I've attained have come
> from the little Radio Shack, in the form of a palm-sized digital recorder
> on a keychain. After some practice with timing the "record" button I was
> able to cut out all the background noise and get a very clean quarter tone.
> This is by far the easiest, cheapest methods I've seen for making
> reliable red boxes. Another advantage is if you get caught with the
> red box, all you have to do is push the "record" button to erase the tone.
>
> ~~~~TELCO COUNTERMEASURES~~~~
>
> The telephone company has implemented several measures to stop the use of
> red boxes.
>  
> The first measure used is fairly simple:  When the user starts
> dialing a number on the telephone's keypad, the handset is cut off,
> disallowing the use of a red box all together.

 Close but not quite right. The mouthpiece is disabled upon lifting the 
handset. Although this can be defeated by dialing a 10xxx number.

> The second measure involves the use of a band pass filter. Band pass
> filters cut specified frequencies and leave behind the rest. The filters
> used in pay phones are connected between the handset and the phone, allowing
> quarter tones (from real quarters) to go through, but not tones. There is
> a *rumor* that there is a way to defeat this however.  
>
> Back when blue boxes first started to not work because of a similar unit 
> installed at the Central Offices, phreaks used what's known as a "pink 
> noise source".  

 Nope. The Central Offices added 2600Hz detectors not band pass filters.

> From my understanding, this fed a lot of crap through the filter which 
> made it temporarily not function as it should, thus allowing blue box tones 
> to pass.  

 Not correct. The pink noise disguised the tone so it would not be easily
recognized by telco detection equipment.

> A similar setup *may* work with red boxes. The circuit for a pink
> noise generator can be found in many electronics books.

 Most likely it wouldn't work. How would you incorporate pink noise with a
tone dialer?

> ========================
> 
> Part 2.....
> 
> This article will go more in depth about the technical aspects of redbxes.
> First off we will cover redbox tones, various other aspects, etc.
>
> The redbox tone ("quarter tone") is MF(Multi Frequency).  

No, they are DTMF. (Dual tone Multi Frequency) Blue Box tones are MF. 

> The frequencies are 1100 and 1700 @6.49MHz.  

 Incorrect. 1700+2200Hz is the true "coin frequency". The 6.49Mhz is the 
type of crystal needed to produce these tones.

> Some people may ask, "Why can't I put in tones before I dial?" The answer is 
> this:  If you don't dial, the payphone is idle.  At this point it still 
> expects you to drop in a quarter. Remember that payphones have antifraud 
> devices that weigh and measure the quarter before you are allowed to place 
> your call.  But, if you dial the number first you must be switched to a 
> Central Office.  From the Central Office comes the recording telling you 
> how much to put in.  By bypassing the internal electronics this way you are 
> feeding the tones directly to the central office, and thus your call should 
> go through.
>
> If you don't have accurate tones you may get an operator.  since there is
> a noticeable difference in the tone sound between a 6.5MHz crystal and a
> 6.5536 crystal, I would recommend getting a 6.5MHz crystal.  
>
> BUILDING THE REDBOX
>
> When you go to Radi Shaft to buy a tone dialer, make *sure* you ask
> whether the dialers they have are the old kind or the new kind.  the new
> kind WILL NOT work.  This is the reason:  On the old dialers when you open
> up the case, to the left to the black blob(chip in the middle of the
> circuitboard) and down is a small silver cylinder.  This is the crystal
> that you need to replace with a 6.5MHz crystal.  If you buy a new one you
> wil see that the crystal isn't there; the people at Rat Shack got smart
> and replaced it with a ship to avoid fraud.

 What is "Radi Shaft"?

You don't need the old dialer to make a Red Box. The new models (43-146) can 
be converted quite easily. Radio Shack didn't replace anything with a chip!
Just open up the dialer and look for a small tan colored component labeled
Z3.58M. It is also located to the left and down of the black blob.


> What you in essence need to do is desolder the terminals of the old
> crystal and pull it out.  Then, cut the leads on the new crystal short and
> bend them to fit the two spots where the old crystal was.  Solder the new
> leads on and close the box back up.
>
> PROGRAMMING - This is very simple.  
> For a nickel, click the "Store"button, hit (*) and (P1).  
> You'll have a nickel tone in button Priority 1.

 Click the "Store" button? I thought it was a switch. And, what about the 
memory button?

> For a dime tone, put the dialer on "Store" again, hit (*) then (P2).  You
> now have a dime in Priority 2.

 Uhm, no. That will give you a nickel as well. You need to hit the * twice. 
Example: MEMORY * * MEMORY P2.

> For a quarter tone, put the dialer on "Store", and hit 
> (*)(*)(*)(*)(*) then (P3).  You have a quarter in P3.
 
 Once again you left out the memory button.



Don't write FAQs unless you know what the hell you're talking about.
I'm glad I didn't learn to redbox from this file!

-Cyber Thief

DISCLAIMER:

 This file is presented for educational and informational purposes only. 
The author does not take responsibility for your actions if this material 
is used in any other fashion.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH