COCOTS and COMBO-box
by Count Zero of Renegade Legion
Here's my phile on how to build a redbox. The file is ALSO about COCOTS...but
is has DETAILED plans for the COMBO-box COMBO-box = red box + clear box here it
is...enjoy!
R e n e g a d e L e g i o n
* * T e c h n i c a l R e p o r t s * *
* R * * L *
* *
Eastern Western
....
Net Runner ........ Echoman
The Knight ......... Sirus
Kingpin ... ....
Highlander ... ....
Count Zero .....
Iceberg ....
The Gypsy ....
Cursor ... ...
Rogue ... ...
White Knight .. ...
Nemesis ...
Presents
Report Number: 4.0
COCOTS: Uses for privatly operated public telephones. How to make free calls
use their maintenance features, and plans for a tone dialer to fool
COCOT security systems.
Author : Count Zero
Editor : Net Runner
System : COCOT Payphones
Uses : Free calling to most of the world
Dialups : One per payphone
Port : 300 bps, 7 bits, Even Pairity, 1 Stop Bit
Emulation: TTY
Thanks To: Count Zero for this extensive document.
Greets To: Magic Man, Darby, JT, Muppet, Madmike, Falcon, George Bush,
FBI Agent, Net Runner, Canine, Plutus, Midnight Mage, Yellow Jacket
Old Pink, The Knight, Spiritwalker
Renegade Legion Sites
---------------------
- tmp down - Night City < RL World HQ >
- private - Night Elite < ERL Headquarters >
Contact The Knight or Net Runner for the number to Night Elite
So you're walking down the street and you see a payphone gotta make an
important call, so you dig into your pocket to get a dime picking up the
handset, you suddenly notice that the payphone wants a QUARTER for a local
call! What the hell, and WHERE did this synthesized voice come from?
Let's make this phile short and to the point a COCOT is an acronym for
Customer Owned Coin Operated Telefone in other words, a COCOT is a fone OWNED
or RENTED by a PAYING CUSTOMER (most likely, a hotel or donut shop) a COCOT is
NOT a normal payfone the Telco doesn't own it, and the actual fone line is
usually a normal customer loop (unlike payfones, where the fone line is a
"special" payfone loop, allowing the use of "coin tones" to indicate money
dropped in more on this later) SO!..A COCOT may LOOK and SMELL like a telco
payphone, but it is NOT.
* Why do COCOTs exist?
Simple $$$$$$$! A customer owned payfone is money in the bank! You pay MORE
for local calls and long distance is typically handled by sleazy carriers that
offer bad/EXPENSIVE service the owner/renter of the COCOT opens the coinbox and
keeps the money him/herself! Also, a particularly SLEAZY quality of a COCOT is
the fact that it DOES NOT RECIEVE INCOMING CALLS this, of course, is because of
$$ if people are calling IN to a COCOT, the COCOT is not making money and
businesses always want to make as much $$ as possible...even if it hurts the
consumer (think about it..it REALLY sucks calling someone at home from a COCOT,
then not be able to have him/her call you back to save $$ "Guess I'll have to
keep feeding the COCOT quarters!")
* Where is a good place to look for COCOTs?
Outside Dunkin Donut shops, restaurants, clubs, bars, and outside/inside
hotels "convenient" locations
* How do I figure out if I have found a COCOT?
Simple a COCOT will have NO TELCO LOGOS on it no New England Telephone
symbols it may look just like a Telco fone chrome, with blue stickers and all
that ALSO a COCOT typically charges MORE for a local call than a regular Telco
payfone (in Massachusetts, local calls are a dime, in places like NYC, they are
25 cents.) a COCOT will most often have a synthesized voice that asks you to
"please deposit 25 cents" or whatever ALSO some FaNcY COCOTS will not look like
payfones at all some in hotels have weird LCD displays and look totally
different but the ALWAYS charge you more than a normal payphone.
* OK, I found this weird payphone in Boston that wants a quarter, and this
synthesized voice is harassing me when does the phun begin?
Soon..first of all, you must understand that the COCOT is a mimic.
Essentially, it wants you to think that it is just a plain ol' payfone pick up
the handset..hear that dialtone? hah! that dialtone is fake, synthesized by
the innards of the COCOT you are at the mercy of the COCOT. Remember a COCOT
runs off of a normal customer loop so unlike a Telco payphone where you must
deposit money to generate coin tones that are read by the CO, the security of a
COCOT depends solely on the COCOT fone itself its as if you took your own fone
and put a sign on it saying "Please put 10 cents in this jar for every call you
make." COCOTS are not naiive they won't let you near the unrestricted dialtone
until you fork over the cash-ola heh heh. Or so they THINK!
See, the Achilles heel of the COCOT is the FACT that ALL PAYFONES MUST LET
YOU MAKE 1-800 CALLS FOR FREE! It's not just a fact, it's the LAW so, now pick
up the handset again and place a 1-800 call any 1-800 number will do. When
they answer at the other end, just sit there do nothing ignore them. wait for
them to hang up the fone here's an example.
<DIAL 1-800-LOAN-YES>
<Ring, Ring>.....<click> "Hello, you wanna buy some money? Hello? HELLO?!"
<CLICK>
<You will now hear some static and probably a strange "waffling" noise, like
chh,chh,chh,chh,chh>
<CLICK>......DIALTONE!
NOW!.what have we got here? a dialtone? yes, you guessed it, the dialtone
you now hear is the UNRESTRICED dialtone of the COCOT's customer loop.
* So what?..So I got an "unrestricted dialtone"...big deal?
Meathead! with an UNRESTRICTED dialtone, all you need to do is place a call
via DTMF tones (the tones a touch-tone keypad generates) now, try dialing a
number with the COCOTs keypad WHOA! waitasec, no sound! this is a typical
lame attempt at protection by the COCOT. Just whip out your Radio Shack pocket
tone dialer, and try calling a number ANY number place it just as if you were
calling from a home phone call a 1-900 sex line call Guam you are FREE and the
COCOTs customer loop is being billed!
***NOTE: some COCOTS are more sophisticated at protecting themselves..some
will RESET when they hear the dialtone to get around this, make a loud hissing
sound with your mouth into the mouthpiece after the 1-800 number hangs up also,
get your tone dialer ready near the mouthpiece when u hear the dialtone,
quickly dial the first digit of your number to call if you hiss loudly enough,
you MAY be able to mask the sound of the dialtone and prevent the COCOT from
resetting and once you dial the first digit of the number you are calling, the
dialtone will disappear (naturally) ok, you can stop hissing like an idiot now
finish dialing your PHREE fone call.
Also, some COCOTs actually disable the handset after a call hangs up (in
other words, you can't send DTMF tones thru the mouthpiece) oh well, better
luck next time.
HOWEVER MOST of the COCOTs I have run across ONLY disable the DTMF keypad.. so
all you need is a pocket dialer to circumvent this!
OTHER THINGS TO KNOW: Sure, you can't call a COCOT, but it DOES have a number
to find out the COCOT's number, call 1-800-933-3258..this automated ANI service
will tell you the number you're dialing from now, try calling the COCOT from
another fone you will hear one of 2 things:
1) synthesized voice "Thank you"...CLICK..<hang up>
2) weird carrier
A COCOT's number is ONLY used by the company that BUILT the COCOT by calling up
a COCOT, a tech. can monitor its functioning, etc in case (1), you must enter
a 3 or 4 digit password and then you'll get into a voice menu driven program
that'll let you do "maintenance" stuff with the COCOT in case (2), you are
hooked to the COCOT's 300 bps modem (YES, a MODEM in a PAYFONE).. likewise, if
you can figure out the communication settings, you'll be into the COCOT's
maintenance routines.
Personally, I haven't had much luck (or patience) with calling up and hacking
COCOT maintenance functions. I just like making free fone calls from 'em!
COCOT ETIQUETTE:
Now, remember, you are making free fone calls but SOMEONE has to pay for
'em...and that is the OWNER the COCOT's customer loop is billed the cost of the
calls, and if the OWNER sees a big difference in the profits made on the COCOT
(profit=coins from COCOT - bill from Telco for customer loop)..they'll know
SOMETHING is up so moral is DON'T ABUSE THEM! don't call a 1-900 number and
stay on the line for 12 hours! If a COCOT is abused SEVERLY, an owner will
eventually LOSE money on the damn thing!, and that means BYE BYE COCOT also,
remember that a RECORD of ALL LONG DISTANCE calls is made to the COCOT's
customer loop..and COCOT companies will sometimes investigate "billing
discrepencies" so don't call anyone you personally know unless you are sure
they are "cool".
<RING RING> "Hello?"
"Hello...this is Cointel, Inc....we'd like to ask you a few
questions about a call you received from Boston on 2/12/91.
Could you tell us the name and address of the person who
placed the call?"
COOL dude -> "What?...I don't remember...go to hell! <SLAM>"
MEATHEAD -> "Uh, sure, his name is John Smith...you want his address too?"
Get the picture? Good...
COCOTs are a great resource if we use them wisely like our environment, we
gotta be careful not to plunder them make a few long distance calls and then
leave that particular COCOT alone for awhile chances are, your bills will be
"absorbed" by the profit margin of the owner and probably ignored but the
smaller the owner's profit margin gets,the more likely suspicions will be
aroused 'nuff said!
I have found COCOTs EVERYWHERE some of my personal favorites are on Route 1
North of Boston check out the Dunkin Donut shops and the Burger King also, in
front of the Rat in Kenmore look around they are lurking everywhere.
(BUT..COCOT technology is relatively new..don't expect them EVERYWHERE..I know
many towns that have NONE..check out big cities....) Here are some numbers of
COCOTs:
Kenmore Square,Boston,MA The Rat
617/247-8195
617/247-7913
617/247-8208
617/247-9437
Random ones: 617/720-4430 617/233-9872
Here are some companies that deal with COCOTs...try out your social
engineering skill on them:
Cointel, Inc. Int'l Telecharge, Inc.
130 Broadway St. P.O. Box 50579
Somerville, MA Dallas, TX
02145 1800/999-5152
1800/322-7741
As for a Tone Dialer, don't leave home without one!...a true phreak always has
a DTMF tone dialer at hand..along with a red box!....My personal favorite is
the COMBO-BOX (red box plus DTMF) take a Radio Shack 33-memory Pocket Dialer..
open up the back...remove the little 3.579 MHz crystal (looks like a metal
cylinder..unsolder it)...solder on a couple of thin, insulated wires where the
crystal was attached...thread the wires thru one of the "vents" in the back of
the tone dialer....get ahold of a 6.5536 MHz crystal (available thru Fry's
Electronics, 89 cents a piece, phone number 415/770-3763)..go out and get some
quick drying epoxy and a Radio Shack mini Toggle Switch, DPDT, cat. no 275-626
Close the tone dialer, with the two wires sticking out one of the back vents..
screw it up tight...now, attact the crystals and wires to the switch like this
with solder:
I^^^^^I
I xx <3.579 crystal>small one
I I
toggle switch -> oooooo X xxxxs <two wires>
I I
I xx <6.5536 crystal>big one
I I
^^^^^^
Each "xx" prong in the diagram is actually TWO prongs....hook up the two leads
from the crystals to separate prongs (same with the wires).
Now, epoxy this gizmo to the side of the tone dialer use ALOT of epoxy, as you
must make the switch/crystals essentially EMBEDDED in epoxy resin. like this:
Front View -> ----------------------
I I T <-toggle switch
I oo oo oo I---
I I |
I I---
I 1 2 3 I B s <-two crystals(b=big,s=small)
I I | in epoxy "blob"
I 4 5 6 I _
I I
I 7 8 9 I ^two wires running to back of unit
I I
I * 0 # I
I I
----------------------
----------------------
Back View -> I I
T I o ---- o-----------------------vent (1 of 4)
--- I / | I
s B I | | I
2 wires -> \-----o ---- o I
running into I I
vent I I
I I
I I
I I
----------------------
Make sure the epoxy is really gobbed on there..you want to be certaint the
switch and crystals are firmly attached and secure in a matrix of epoxy (it
doesn't conduct electricity, so don't worry about shorting out the connections
to the toggle switch)...just don't gum up the action of the switch!
Basically, you've altered the device so you can select between 2 crystals to
generate the timing for the microprocessor in the tone dialer...
Now turn on the tone dialer NOW, you can easily switch between the 2 crystal
types the small crystal will generate ordinary DTMF tones but, by simply
flicking the switch, you generate HIGHER tones now, using the memory function
of the tone dialer, save 5 "*" in the P1 location, now dial the P1 location
using the BIG crystal, sure sounds like the tones for a QUARTER, doesn't it!
Carry this around with you always will come in handy with both Telco payphones
AND COCOTs! no Phreak should be without one!
Anyway, that about wraps it up for me references for this article include Noah
Clayton's EXCELLENT article on COCOTs in 2600 Magazine, Autumn 1990.. also,
The Plague's article on Tone Dialer conversion to Red Box, 2600 Magazine,
Summer 1990 (Which inspired me to create the COMBO-BOX (red box PLUS DTMF
dialer)...I strongly urge people to subscribe to 2600 Magazine...call their
office line for more details ->516/751-2600... Remember..you can READ all you
want, but if you don't get your ASS out there and try stuff out for yourself,
you are nothing but a POSER!
Enough said...oh, also, I heard that SOME COCOTs have handsets in them that
can be accessed..in other words, you call the COCOT and if you hit "0" or
something else, the earpiece of the handset is activated and you can listen in
on what's goin on around the COCOT...I dunno...never worked for me, but try
these 2 "suspected" numbers...212/268-7538, -6129..try hitting "0" and listen
for any sounds...I could be wrong, I could be right..I could be black, I could
be white....
That's all folks remember, the purpose of this phile is to ENLIGHTEN, and I
in no way condone or encourage illegal activities...so don't blame me for ANY
MESS you get into this phile offered strictly as INFORMATIONAL ONLY! I am in
no way responsible for your ass! Also, I am not into wanton destruction,
vandalism, or fraud..seek the truth, and leave nothing but footsteps.
Remember...SHARE THE WEALTH...INFORMATION IS POWER...SHARE IT!
And drink massive amounts of Jolt cola...trust me, it's good for you.
Keep the faith, and never stop searching for new frontiers....
..................................
..oooOO Count Zero OOooo..
..................................
-----------------------------------------------------------------------------
EDITOR'S NOTE: (Renegade Legion)
We do NOT condone fraud, destruction of computer data or tangeble items.
We do not condone information hoarding, and accumulations stacks of informatio
n on individuals which corporations have no business accumulating. Companies
are free to give your information to other companies. And we feel vindicated
in examining the information about ourselves firsthand!
Down with buerocracy!
Hail Eris!
All Hail Discordia!
-Net Runner, Precentor of Renegade Legion
Back to the master Table of Contents.