__ / / / /(_)_ __ ___ /\ \ \___ (_)___ ___ \ \ ___ __ \ \/ (_) | / / | | '_ \ / _ \/ \/ / _ \| / __|/ _ \ | (_) \/ / _ > < _| | / /__| | | | | __/ /\ / (_) | \__ \ __/ | |_ > < _ (_)_/\_(_) | \____/_|_| |_|\___\_\ \/ \___/|_|___/\___| | (_)_/\_(_) \_\ " K e e p U p T h e N o i s e " /_/ ++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++UK COCOT Tricks+++++++++++++ ++++++++++++++++++++++++++++++++++++++++++ +++++++++++++JF@linenoise.org+++++++++++++ ++++++++++++++++++++++++++++++++++++++++++ COCOTS in the UK have recently become a hot coversation topic on the Linenoise WWWBoard so I thought it was necessary to write a text on a few neat cocot tricks and explanations of cocots etc. The UK has been noted for having VERY LITTLE documentation and VERY LITTLE cocot tricks, all the common ones I know of are listed in this text but the problem is that in some places these codes would have been disabled over time. BT release new payfones quite regulary, and each model becoming more and more secure against your phreak armed with his codes. HOWEVER, cocots tend to be BT's less secure fones. I say BT because 90% of cocots in the UK originate from BT (just look for the logo). ################ PAYFONE 200 MkII ################ The famous Payfone 200 MkII, hailed because of the simplistic technique to gain control of it. One small code will enable the user to dial ANYWHERE in the world for free, which is of course are universal aim here :o). *#2580 is the magic code, all you need to do is pick up the fone, hit in the code and dial the full number including area/international dialing code. This method is totally undetecable and the chances of getting caught are extremely slim. If you are in a busy area using this fone then make it look as if you are putting in money etc. so that people do not get suspicious, but other than that, you could get away with using this technique for hours :o). I have found that the 200 MkII series isn't very common at all in the late 1990s and often, alot which are found have be patched. However, look in places which might not bother to stay up-to-date in communications, for example, HOSPITALS, COUNTRY PUBS etc. My local hospital has a 200 mkII along with other BT model cocots. This is the greatest documented and easiest cocot trick, and perhaps that is why it is uncommon nowadays, but if you find a 200 mkII which is vulnerable to this code, I would seriously recommend keeping it to yourself, as everyone knows that over-abuse kills :o). ########### PAYFONE 190 ########### This is yet another BT cocot which is very commonly found in pubs, hotels etc. To trick on this is basically the same as hacking a VMB, takes alot of time and patience but reaps nice rewards. Basically, the payfone 190 has a programming ability, where the owner of the cocot can program in details in the fone - barring numbers, date and time etc. etc. The owner programs in details by first entering his private pin which they set themselves as soon as they set the fone up, ready for action. The pin is always four digits and I have found it common for the pin to be 1111 or 9999, as both of these are simple to remember and the owner of the cocot do not really expect someone to try and crack their pin (how little do they know? heh). There are actually two ways to enter the pin login phase. Firstly if when you pick up the fone the little lcd display shows ---- you can automatically enter in a four digit pin then press #. The second way to posibly enter the login phase is as follows - pick up the handset and hit in ****, then hit in your pin, then press #. The second menthos of loggin in was mentioned their incase the ---- does not show up. Now that you know HOW to actually log in, its up to you to brute force it. Do not do too much brute force guessing at one time as people will get suspicious. Spread it over a few days etc. that way no one will suspect a thing and you can always keep note of which combinations you have attempted already. Once you have gained the correct pin you will see PROG on the lcd screen, this is where you have hit the jackpot. Most payfone 190's I have hit have been in Hotels and are therefore connected to their internal PBX, so to dialout from the programming mode you need to use the PBX dialout number followed by the full number (including area code) of the number you wish to dial. The PBX dialout number is usually 9, this will get you out of the internal switch and onto the external switch. ################### NON-BT COCOT TRICKS ################### I have used a very broad title for this section as it is indeed a very broad section. There are literally 100s of cocot models which can fall under this section and lots of nice tricks which you might find working. I am just going to run through some tricks that I have used successfully in the past and that will always work as long as you find the correct type of fone. -=Trick-1=- A lot of cocots, especially cocots in SCHOOL'S are vulnerable to the following trick. If the fone instructions say - "Please dial the number and then Insert money on answer" or it has a button saying "Press on Answer" then this trick can be used... You should see the line coming out of the bottom of the fone base, cut into this and BEIGE BOX off it (see my basic beige boxing text). When the fone has those instructions it basically means that you are paying for the right to speak on the line, as you can hear people talking but you cannot talk yourself unless you pay for the volume to become un-muted. By beiging off the line connected to the cocot you are bypassing this muting process and therefore are able to speak for free by hooking up your own fone :). I would recommend cutting the line (in order to beige it) in a very discreet position so that your technique is not found by anyone. The best place to cut it is directly under the fone base, where the wire first comes out, as no one is going to really look UNDER the fone for any reason, so this can be seen as a safe place to cut and hide. -=Trick-2=- Some cocots are position stupid enough so that the actually Linebox is in physical view of the cocot, this is cocot suicide and so easy to abuse. All you need to do is bring your own fone to the cocot, unplug their fone from the linebox and plug in your own, and then you have your fone which will work in exactly the same way as it would normally :). This method is so simple yet highly detectable, so I would recommend getting a few friends together to hover around the fone/linebox so that people cannot see what is going on, do not hang around looking suspicious, just act as if you are waiting for a friend using the fone normally, after all, thats HALF the truth. After you have done what you wanted to do, PLEASE remember to plug the cocot back into the line, or else the owner will know that someone has been playing with it for sure, they aren't 100% stupid. This stupid mistake is commonly found in Supermarkerts, Hotels and some pubs, but just keep an eye open wherever you go. Of all the methods I have so far illustrated, I think this one has the highest risk factor but don't let that stop you :). -=Trick-3=- I found this fone at my local Supermarket which had NO keypad but instead one button which was to dial a local taxi company. I picked up the reciever and found that it had a normal dial-tone. I then proceeded to hit the button which said "Dial-a-Taxi" and it dialed just like a normal fone, so this was basically a normal fone modded to only dial one number when you pressed the button. I then went home, record a test number onto a dictaphone with the DTMF Tones which I had on my computer and then went back to this fone. I then picked up the handset and blasted my tones, and it worked perfectly :) This is because, when dialing a number, the fone reacts to the TONES and not the push of a button so therefore this will always work. Just make sure that your tones are loud and quite good quality. I have since done this many times and no-one has suspected a thing since, perfect finding. Look around for these fones. They will probably be found in Supermarkets and Shopping centers and other places where people might want a taxi home eg. cinemas. ########## Experiment ########## I have illustrated quite a few neat tricks in this text which should result in a few months happy play for you all. Just keep looking out for fones which might be vulnerable to things I have mentioned in this text and above all EXPERIMENT and find new ways of breaking these cocots in a way which will benefit you :o) Good Luck JF JF@linenoise.org http://www.linenoise.org