Copy Link
Add to Bookmark
Report
NuKE Issue 07-014
================================================================================
NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE
uK E-
E- "Toll Fraud Device" Nu
Nu KE
KE Typed By -N
-N uK
uK Rock Steady E-
E- Nu
E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu
NuKE InfoJournal #7
August 1993
I typed up the following article entitled simply "Toll Fraud Device" from
the Summer 1993 (vol. 10, no. 2) issue of 2600 Magazine. The article is
uncredited in 2600, so we're not quite sure who to thank... Anyhow, since
we've done articles about red boxing in the past and have received tremendous
response, we thought our readers would like to see a great new optimized
design for a red box. Enjoy!
Rock Steady/NuKE
-------------------------------------------------------------------------------
% Toll Fraud Device %
We at 2600 are often asked, "What is a toll fraud device?" Well, we decided
to answer the question once and for all. This red box is a toll fraud device.
Why is it a toll fraud device? Because any red box that can be built this
cheaply and this easily and can fit in the palm of your hand was clearly
_not_ made for demonstration purposes.
Okay, so what is a red box? Well... a red box is hacker slang for any device
that simulates payphone coin signalling tones in North American payphones.
Red boxes emit the precise tones used by payphones to tell the local switch
that the appropriate coinage has been inserted. The tones are played through
the mouthpiece in lieu of dropping coins into the payphone. This particular
red box is particularly fraudulent in that it only simulates quarter tones.
After all, when one commits toll fraud one does not want to waste time
pumping virtual nickels and dimes into the payphone when quarters work quite
nicely thank you.
For those of you who are technically minded, the theory behind the circuit is
easy enough to grasp. The DTMF encoder (U1) used in conjuction with the
crystal (X1) produces the desired frequencies. The decode counter (U2)
controls the cadence or how many frequency pulses are used. The 555 timer (U3)
used in conjunction with R1, R2, and C1 produces the actual pulses and controls
how fast they are delivered. The circuit is a good hack because it utilizes
the carry flag on U2 to overcome any stray charge on C1 that may cause the
first pulse from U3 to be inaccurate. It accomplishes this by ignoring the
first five pulses produced by U3, processing the next five, ignoring the
third, processing the fourth, ignoring the fifth, etc... The circuit is also
a good hack because it utilizes that well known coincidence in the DTMF
encoderm, the fact that substituting a 6.5 Mhz crystal for a colorburst
crystal (3.579545 Mhz) just happens to raise the "*" key frequencies from
941 and 1209 Hz to approximately 1708 and 2195 Hz. Since the desired
frequencies for a quarter tone are 1700 and 2200 Hz, the output of the
cicuit is well within tolerance. The cadence is determined by the RC
combination in U3. Each pulse lasts approximately 30ms, followed by 30ms
of silence.
So fraudulent is this red box that we at 2600 have nicknamed it the Quarter.
While all members of 2600 [and NuKE -RS] are morally righteous, and do not
advocate the use of red boxes for fraudulent purposes, we must admit that if
we ever did decide to commit toll fraud, we would trust nothing less than
a Quarter to do the job.
Obviously, the Quarter will not work with Customer Owned Coin Operated
(COCOT) payphones. You may also have some difficulty with newer
electronic payphones, as the phones companies are finally getting hip to
these little devices and are isolating the talk path from the receiver until
the call is established. Still, your Quarter should provide you with hours
of fun-filled listening entertainment. In a world where a one minute payphone
call from Washington DC to New York costs $2.20 (at the maximum discount rate
no less!) it will hardly surprise us at our suburban offices if, while sipping
ou afternoon tea, we happen to read about a sudden proliferation of Quarters
across the U.S.
V+ V+
³ ³
³ ÃÄÄÄÄÄÄÄÄÄÄ¿
ÚÄÄÁÄÄÄ¿ ÚÄÄÄÁÄÄÄÄ¿ \
³ 1 ³ ³ 16 ³ /R3
³\ÚÄÄÄÄÄ´16 3ÃÄÄÄÄÄÄÄÄÄÄ´12 ³ \
SPKR³ ³ ³ U1 ³ ³ U2 ³ /
³/ÃÄÄÄÄÄ´6 11ÃÄÂÄÄÄÄÄÄÄÄ´14 15ÃÄÄÄÄÄ´
³ ³ 7 8 ³ ³ ³ 13 6 ³ ³
ÄÄÁÄÄ ÀÄÂÄÄÂÄÙ ³ ÀÄÄÂÄÄÄÂÄÙ ³
ÄÄÄ ³ ³ ³ ³
Ä X1À´ÃÙ ³ ³
³R1 R2 ³
ÚÄÄÄÄÄÄÅ/\/\/ÂÄÄÄÄÄÄ¿ ³
³ ³ ³ ³ ³
³ ÚÄÁÄÄÄÄÄÁÄ¿ ³ ³
V+ ³ ³ 3 6 ³ ³ ³
³ ³ ³ 2ÃÄÄÄÄ´ ³
ÀÄÄÄÄÄÄÅÄÄÄÄ´8 ³ ÄÁÄ ÃÄÄÄ \ÄÄÄÄÄ¿
³ ³ U3 ³ ÄÂÄ C1 ³ S1 ³
³ ³ ³ ³ ³ ÄÄÁÄÄ
ÀÄÄÄÄ´4 1ÃÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÙ ÄÄÄ
ÀÄÄÄÄÄÄÄÄÄÙ Ä
NOTE: All crossed lines on the diagram are points of connection.
PART LIST:
RESISTORS VALUES NOTES
R1 220 kOhms The exact values of R1 & R2 are not
R2 220 kOhms important so long as their sum is 440.
R3 1 kOhms
CAPACITOR VALUES NOTES
C1 0.1 uF
CRYSTAL VALUES NOTES
X1 6.5 MHz 6.5536 MHz is also within tolerance.
CHIPS(IC) NAME NOTES
U1 TCM5089 DTMF encoder
U2 74HC4017 Decade counter. Regular 4017 is okay.
U3 CMOS 555 Timer IC. Regular 555 is okay if a 1
kOhm resistor is inserted between pins
3 and 8.
SPEAKER IMPEDANCE NOTES
SPKR 600 ohms U1 expects an equivalent load.
SWITCH TYPE NOTES
S1 Momentary You may also want to add a power switch.
As printed the circuit expects three triple 'A' batteries for a total of 4.5
volts. A 9 volt battery may also be used, but R1 and R2 should then total
470 kOhms instead of 440. Obviously, you will need a perfboard and chassis if
you expect to build the circuit. Parts may be ordered from electronics firms.
Remember to order at least two of everything so that you will have spares in
case you mess up.
===============================================================================
