NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE uK E- E- "Toll Fraud Device" Nu Nu KE KE Typed By -N -N uK uK Rock Steady E- E- Nu E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu NuKE InfoJournal #7 August 1993 I typed up the following article entitled simply "Toll Fraud Device" from the Summer 1993 (vol. 10, no. 2) issue of 2600 Magazine. The article is uncredited in 2600, so we're not quite sure who to thank... Anyhow, since we've done articles about red boxing in the past and have received tremendous response, we thought our readers would like to see a great new optimized design for a red box. Enjoy! Rock Steady/NuKE ------------------------------------------------------------------------------- % Toll Fraud Device % We at 2600 are often asked, "What is a toll fraud device?" Well, we decided to answer the question once and for all. This red box is a toll fraud device. Why is it a toll fraud device? Because any red box that can be built this cheaply and this easily and can fit in the palm of your hand was clearly _not_ made for demonstration purposes. Okay, so what is a red box? Well... a red box is hacker slang for any device that simulates payphone coin signalling tones in North American payphones. Red boxes emit the precise tones used by payphones to tell the local switch that the appropriate coinage has been inserted. The tones are played through the mouthpiece in lieu of dropping coins into the payphone. This particular red box is particularly fraudulent in that it only simulates quarter tones. After all, when one commits toll fraud one does not want to waste time pumping virtual nickels and dimes into the payphone when quarters work quite nicely thank you. For those of you who are technically minded, the theory behind the circuit is easy enough to grasp. The DTMF encoder (U1) used in conjuction with the crystal (X1) produces the desired frequencies. The decode counter (U2) controls the cadence or how many frequency pulses are used. The 555 timer (U3) used in conjunction with R1, R2, and C1 produces the actual pulses and controls how fast they are delivered. The circuit is a good hack because it utilizes the carry flag on U2 to overcome any stray charge on C1 that may cause the first pulse from U3 to be inaccurate. It accomplishes this by ignoring the first five pulses produced by U3, processing the next five, ignoring the third, processing the fourth, ignoring the fifth, etc... The circuit is also a good hack because it utilizes that well known coincidence in the DTMF encoderm, the fact that substituting a 6.5 Mhz crystal for a colorburst crystal (3.579545 Mhz) just happens to raise the "*" key frequencies from 941 and 1209 Hz to approximately 1708 and 2195 Hz. Since the desired frequencies for a quarter tone are 1700 and 2200 Hz, the output of the cicuit is well within tolerance. The cadence is determined by the RC combination in U3. Each pulse lasts approximately 30ms, followed by 30ms of silence. So fraudulent is this red box that we at 2600 have nicknamed it the Quarter. While all members of 2600 [and NuKE -RS] are morally righteous, and do not advocate the use of red boxes for fraudulent purposes, we must admit that if we ever did decide to commit toll fraud, we would trust nothing less than a Quarter to do the job. Obviously, the Quarter will not work with Customer Owned Coin Operated (COCOT) payphones. You may also have some difficulty with newer electronic payphones, as the phones companies are finally getting hip to these little devices and are isolating the talk path from the receiver until the call is established. Still, your Quarter should provide you with hours of fun-filled listening entertainment. In a world where a one minute payphone call from Washington DC to New York costs $2.20 (at the maximum discount rate no less!) it will hardly surprise us at our suburban offices if, while sipping ou afternoon tea, we happen to read about a sudden proliferation of Quarters across the U.S. V+ V+ ³ ³ ³ ÃÄÄÄÄÄÄÄÄÄÄ¿ ÚÄÄÁÄÄÄ¿ ÚÄÄÄÁÄÄÄÄ¿ \ ³ 1 ³ ³ 16 ³ /R3 ³\ÚÄÄÄÄÄ´16 3ÃÄÄÄÄÄÄÄÄÄÄ´12 ³ \ SPKR³ ³ ³ U1 ³ ³ U2 ³ / ³/ÃÄÄÄÄÄ´6 11ÃÄÂÄÄÄÄÄÄÄÄ´14 15ÃÄÄÄÄÄ´ ³ ³ 7 8 ³ ³ ³ 13 6 ³ ³ ÄÄÁÄÄ ÀÄÂÄÄÂÄÙ ³ ÀÄÄÂÄÄÄÂÄÙ ³ ÄÄÄ ³ ³ ³ ³ Ä X1À´ÃÙ ³ ³ ³R1 R2 ³ ÚÄÄÄÄÄÄÅ/\/\/ÂÄÄÄÄÄÄ¿ ³ ³ ³ ³ ³ ³ ³ ÚÄÁÄÄÄÄÄÁÄ¿ ³ ³ V+ ³ ³ 3 6 ³ ³ ³ ³ ³ ³ 2ÃÄÄÄÄ´ ³ ÀÄÄÄÄÄÄÅÄÄÄÄ´8 ³ ÄÁÄ ÃÄÄÄ \ÄÄÄÄÄ¿ ³ ³ U3 ³ ÄÂÄ C1 ³ S1 ³ ³ ³ ³ ³ ³ ÄÄÁÄÄ ÀÄÄÄÄ´4 1ÃÄÄÄÄÁÄÄÄÄÄÄÄÄÄÄÙ ÄÄÄ ÀÄÄÄÄÄÄÄÄÄÙ Ä NOTE: All crossed lines on the diagram are points of connection. PART LIST: RESISTORS VALUES NOTES R1 220 kOhms The exact values of R1 & R2 are not R2 220 kOhms important so long as their sum is 440. R3 1 kOhms CAPACITOR VALUES NOTES C1 0.1 uF CRYSTAL VALUES NOTES X1 6.5 MHz 6.5536 MHz is also within tolerance. CHIPS(IC) NAME NOTES U1 TCM5089 DTMF encoder U2 74HC4017 Decade counter. Regular 4017 is okay. U3 CMOS 555 Timer IC. Regular 555 is okay if a 1 kOhm resistor is inserted between pins 3 and 8. SPEAKER IMPEDANCE NOTES SPKR 600 ohms U1 expects an equivalent load. SWITCH TYPE NOTES S1 Momentary You may also want to add a power switch. As printed the circuit expects three triple 'A' batteries for a total of 4.5 volts. A 9 volt battery may also be used, but R1 and R2 should then total 470 kOhms instead of 440. Obviously, you will need a perfboard and chassis if you expect to build the circuit. Parts may be ordered from electronics firms. Remember to order at least two of everything so that you will have spares in case you mess up.