DnA 9-6: The Art of Redboxing
by Flinx - an53521@anon.penet.fi, Phluid/IRC
August 14th, 1994
Disclaimer
This file is for informational purposes only. I do not encourage the activities described in this file, as they are illegal in most countries.
Redboxing is by far the most popular way to phreak. It's practically risk-free, and easy as hell. It should be a long time before the telco catches on, too.
Theory
There are two types of payphones - Fortress phones (owned by large telephone companies), and COCOTs (Consumer Owned Coin Operated Telephones). Fortress phones need to signal the telco when someone puts money in. The way they do this is through tones. Your redbox emulates these tones, tricking the telco into thinking you put in actual coins.
Construction
There are two popular ways to make a redbox - with a Radio Shack pocket dialer, and a Hallmark card. The pocket dialer redbox is more expensive, but alot more reliable and easy to make. The Hallmark redbox is cheap, but it takes a little more time to make.
The pocket dialer redbox will cost around 30 bucks, and only takes about 10 minutes to build. What you'll need:
- A Radio Shack memory pocket dialer ($25, catalog #43-146)
- A 6.5536 or 6.5000 mhz crystal ($2 at an electronics store, $7 through Digikey [1-800-DIGIKEY])
- Two five inch wires
- Some electrical tape
- Three AAA batteries
Open up your pocket dialer. You'll see a cylindrical silver component. Carefully take it off, preferably by soldering. Solder the two wires on to those two contacts, making sure that they don't touch. Push the wires out one of the vents in the back, and screw your box back together. Solder the crystal onto those wires; polarity doesn't matter. Wrap electrical tape around the contacts so they can't touch. Secure the crystal to the side of the dialer.
Now you need to program in the tones. The real tones generated by the payphone are 1700hz + 2200hz for 66ms, followed by a pause of 33ms. The redbox
comes pretty close to this. Each tone counts as 5 cents - one tone for a nickel, two for a dime, and five for a quarter. Read the section in your instruction booklet entitled "Storing a Memory Number", then program in 1 "*" as the first priority number, 2 for the second, and 5 for the third. The first makes the tone for a nickel, the second a dime, and the third a quarter.
The Hallmark redbox is already covered pretty well in another text, so I won't include it here. If you can't find any info on it, e-mail me and I'll send it to you.
Use
Find a fortress phone. They way you can tell the difference between a fortress phone and a COCOT is that a fortress phone always has a big, well-known telco name/logo on it, such as Pacific Bell, AT&T, MCI, etc. A COCOT will have some obscure name such as "Pacific Coin" or "Catalina Communications" on it. Some COCOTs WILL work, but it's really rare. You just have to experiment.
Some fortress phones cut off the mouthpiece while dialing, so it won't work on those. Make sure the payphone doesn't look too high-tech; the newer Pac Bell phones with digital displays and card slots don't use the normal redbox tones, so forget about them. I've always had good luck with GTE, AT&T, and the older Pacific Bell phones.
For long distance, non-international calls, just dial the number, and wait for it to say "Please deposit $x.xx". Place the speaker from the redbox on the mouthpiece, and make the tones for the money you would have deposited. Your call should go through. You can only talk for a while before the phone wants to eat more money, so just "deposit" your tones when the recorded voice fasks for another few cents. If the phone rings after you're done talking, it's most likely the operator asking for more money. Just use your box like you did before, and hang up. If you don't, the time you didn't pay for will be charged to the person you called.
For local calls (ones in the same zone as the payphone), it's a little more difficult. When you dial the number, it tells you to hang up and deposit your money, instead of depositing it then. Since the mouthpiece is always cut off before dialing, you can't use your redbox yet. Call the operator, and tell him/her that your keypad is all gummed up, and you can't dial. They'll ask for the number, and tell you how much to deposit. The first thing to do, whenever you're talking to a live operator, is to put in a REAL nickel. This kinda defeats the purpose, but it's an absolute must. When you put in a real coin, it completes a circuit in the phone. If the operator is suspicious, they can check to see if this circuit is completed. If they hear a bunch of quarter tones, and the phone says that no coins have been deposited, they'll be on to you. Anyway, put in a real nickel, and then make the rest of the tones with your box. You should be put through.
International calls are just as difficult as local calls. Dial your friend in Zimbabwe (international dialing instructions are listed in the front of your phone book). The "overseas operator" is going to tell you how much the call will cost, and then ask you how you're going to pay for it. They assume that you'll be using a calling card or billing to another number, so when you tell them that you have $6.25 in change, they're already suspicious. Remember to put in a real coin first, then use your box. Also, make the tones at different intervals, just like you're fumbling around with change and depositing it.
If you're paranoid that the telco is going to catch on, just tell the person you're calling that if the operator calls them, they should just say that they have no idea who just called and to leave them alone.
Good luck in you're redboxing adventures... e-mail me with any comments, corrections, flames, whatever - an53521@anon.penet.fi.
-flinx
