Tag: 2600

Set the Wayback Machine for 1993.  I am out of TechSchool™ and enjoying my job at TechCorp™ in this elite pet project lab of the TechCorp™ CEO and I am pretty happy. I am still a Hacker and buying every issue of 2600 The Hacker Quarterly I can find. One day I find Volume Ten, Number Two dated Summer, 1993. When I get to page 42, I see a bold header reading “Toll Fraud Device” and an article describing the construction of a Red Box, dubbed “The Quarter”

Now for the young & uninitiated, phone phreaking was a subset of hacking that was concerned with exploring the telephone network. This was before the ubiquitous cell phones of today, and if you needed to make a telephone call away from home, you would have to use a payphone. To use a payphone, you generally needed money specifically coins. When I was very young a call cost a dime, by 1993 It cost a quarter. Phone phreaks in their exploration of the telephone network had all sorts of tricks to make free phone calls.  These devices were called by a color and the word “box”.  The most famous of these was the Blue Box, used by John Draper aka Captain Crunch, who detailed the use of a blue box to Esquire Magazine in the 1970s. Steve Wozniak the inventor of the Apple Computer was inspired by this Esquire article and finding the frequencies needed, built his own Blue Box (adopting the handle “Berkeley Blue”) which Steve Jobs then convinced him to sell at a profit. The most famous of the frequencies being 2600 Hz, the tone with which one could seize a trunk line and make additional calls, and which the Hacker Quarterly takes its name. A frequency that John Draper famously found was produced by a toy whistle found in a cereal box and adopted his Handle. Other boxes included the original toll fraud device, the Black Box which would allow you to receive a phone call without the phone company registering that you actually took the receiver off the hook, meaning any long-distance call to that number was free.  I heard a tale of a Green box that would cause a payphone to return any money that was placed in it to make a call and was told a hacker turned his answering machine into one so you could leave a message from a payphone for free, but this could have just been a hacker legend that circulated in the community at the time.  The Red Box, the subject of this article was a device that produced the tones that a payphone made when a coin was deposited. 

At the time a payphone would emit a short dual-tone multifrequency “beep” consisting of 1700Hz & 2200Hz for every 5 cents deposited in the coin slot. So a nickel would produce a single beep, a dime two beeps, and a quarter five rapid beeps.  There existed at the time an IC known as a DTMF encoder which when paired with a “colorburst” crystal was capable of making the DTMF tones to dial a phone.  However, someone very clever found that replacing the colorburst crystal with one rated at 6.5 MHz it would raise the “*” key to frequencies very close and within the tolerance of the coin deposit tones.

So first I needed components. My choices were either Radio Shack who really didn’t like Hacker types, wanted your name and address for marketing purposes even if you were just buying batteries (I would give them the name “John Frederson” and my PO BOX), or this independent Electronics store with all kinds of new old stock that you never knew what you would find and knowledgeable electronics experts willing to help discuss whatever project you were working on.  The choice was obvious, I was in that shop a day soon after that issue of 2600 came out and one of the regulars was showing them the article and schematic for the red box! They were quite excited and asked the customer to allow them to photocopy the article.

I was busy at my job at TechCorp™ and did not get to this project for a while. Good thing too, because in the next issue of 2600 on page 37 was a corrected schematic for the Quarter as well as the inclusion of an OpAmp so I could use an easier to source low impedance speaker.  This was the device I was going to build.  So one weekend when I had some time, I got in my car and drove to the friendly independently owned electronics store.

I had the parts list written down on a piece of paper and I go up to the counter to get my components.  I am buying two of each in case I mess something up, and as I am going down the list, I get to the TC5809 DTMF encoder. The helpful person behind the counter asks, “do you need a couple of colorburst crystals for this?”

I meekly say, “No I need some 6.5 MHz crystals, actually,” at which point his eyes go wide, his eyebrows raise and he says LOUDLY so the entire store can hear him:

“OH! I KNOW WHAT YOU ARE DOING WITH THESE!”

I start to shrink into myself, embarrassed. I am caught.

He continues, again very loudly so the whole store hears, “WILL SIX-POINT-FIVE-FIVE-THREE-SIX MEGAHERTZ CRYSTALS WORK?” (He knows full well they will as the original article says so)

I quietly say, “yes.”

He gives me a knowing look and gets the crystals, I have all the parts I need as many of the components I had at home in my kit leftover from TechSchool™ he rings me up and sends me on his way saying “DON’T GET IN TOO MUCH TROUBLE NOW.”

So I get home and the next day I begin to construct the circuit on my handy dandy breadboard, which served me well at TechSchool™.  I finish the circuit, powering it off a 9-volt battery and the output of some cheap speaker I had. I pressed the button (momentary switch) and five rapid dual-tone beeps come out of the speaker. Success! Well, I think it is a success. I didn’t have any test equipment to see if the frequencies were correct or anything, so the only thing to do was find a payphone.

I drive to my neighborhood post office which had a phone booth just outside the doors to the PO Boxes. So I carry out this breadboard with ICs and wires and components stuck into it, a speaker hanging off of it putting the speaker up to the mouthpiece, I call my house and press the button. Five quick beeps. And nothing.  So I try again.  Still nothing.  A third time and an Operator comes ón the line.  (Back in these days, they  had actual humans that could route and connect calls and apparently catch phone phreaks.) She asks,  “what are you trying to do?”  I am so busted and I bet she is gonna have the cops show up, so I quietly hang up the phone walk briskly to my car, and drive home.  The first try was an utter and total failure.

I get home and go over the circuit carefully. I realize that one of the wires is going to the wrong pin, and probably making my prototype red box emit tones at the wrong frequency. Well, that explains it.   But I am not going to try at the same payphone again.  I give up for a while and put the breadboard with the Red Box circuit away in my toolbox.

A short while later, there is a BBS meet-up in my hometown an hour away, so I hop in the car and drive to the get-together, and bring my circuit to show off at the pizza parlor where we are having our little party.  I pass around the issue of 2600 and my breadboard and people have fun playing with it and reading about Red Boxes and I tell my story about it not working, and how a lot of the modern payphones now do not connect the voice channel until after the call is connected to prevent this type of fraud device, and it will probably just remain a curiosity for me.  However there is another hacker at the gathering and he says he knows of a phone that red boxes work ón, because he uses HIS Red Box ón it all the time.  It is the phone at the end of the hallway in his dorm at the local University.

His red box was of a different type. His was made by modifying a Radio Shack phone dialer. Again this was the days before cell phones were ubiquitous and Radio Shack had these devices with a keypad, a speaker, and enough memory to store like 25 phone numbers.  You could just hold this device up to a mouthpiece press a few buttons and it would automatically dial the phone for you.  So of course this device used a DTMF encoder and a colorburst crystal. But what my Comrade had done was install a toggle switch and 6.5 Mhz crystal so he could use it as a phone dialer in one switch position using the colorburst crystal and in the other using the 6.5 Mhz crystal turning it into a red box. He could simulate a nickel by pressing the “*” button.  To make things quicker for local calls he programmed it to dial five of those making it simulate depositing 5 nickels or 25 cents.  We arranged to use my breadboarded red box at his dorms at a later date.

Sometime later, we were hanging out on campus before a movie that was being shown at the university theater. Ran into my fellow hacker and we invited him to the movie, and he asked me if I had my red box, and I said it was in my car, and offered to take me into his dorm after the film to try it out.

So after the movie, we head over to the dorm full of college bros, and he guides me to the payphone which did in fact look quite old.  “This is promising.”  I think. When it is our turn to use the phone, I dial my girlfriend’s number. The automated voice comes on, “please deposit 25 cents.”  And the moment of truth comes, I hold the speaker and breadbox up to the mouthpiece, press the button once and 5 dual-tone beeps of 1708 and 2159 Hz spaced 30 milliseconds apart — a very close approximation of dropping a quarter into a payphone. The call connects. The distant phone rings.  My girlfriend picks up and says, “Hello?”

“Hi, it’s Johnny, guess what I just did?”

“What did you do?”

“I am calling you from a payphone using my red box.”

I hear a sigh come from the earpiece, “Johnny, you are going to get us in trouble. I am hanging up. Goodbye.”

Well, ok my girlfriend wasn’t Impressed (no wonder things didn’t work out in the end) but I got a high five from my friends.  Like 99.44% of my hacks, I just wanted to see if I could do it.    I began to assemble the red box on a perf board with wire wrapping tools, but I never finished.  I pulled it off, it worked, and payphones, where it would work, were becoming scarce. Once I had proof of concept the need to steal from the phone company or make free phone calls just weren’t important anymore.  

I built the red box out of curiosity and fun, not to defraud anyone. All I did was rob a phone monopoly of the cost of a 15-second local phone call which certainly only used pennies of resources. If I had been caught I potentially could have been sent to jail and heavily fined for withholding a corporation worth more money than you or I will see in a lifetime a quarter.   Hacking has always had a disproportionate response from the authorities because they cannot brook someone using technology in a way with creativity and imagination to merely explore its capabilities instead of leveraging it for fortune and capital. Capitalism only wants profit and the Hacker Ethic of free access and wide sharing threatens that because we dare show them a world not bound by their rules.