Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Phreaking Technical System Info :: cocots40.txt

Renegade Legion Technical Report 4.0: COCOTs!!! and Red Boxes

		      R	e n e g	a d e	L e g i	o n
   * *		    T e	c h n i	c a l	R e p o	r t s		       * *
  * R *								      *	L *
    *									*
	Eastern						      Western
Net Runner			........			       Echoman
The Knight			 .........				 Sirus
Kingpin				 ...	....
Highlander			 ... ....
Count Zero			 .....
Iceberg				....
The Gypsy			 ....
Cursor				 ... ...
Rogue				 ...   ...
White Knight			 ..	 ...
Nemesis					   ...
Report Number: 4.0
COCOTS:	Uses for privatly operated public telephones. How to make free calls
	use their maintenance features,	and plans for a	tone dialer to fool
	COCOT security systems.
Compiled : 03/25/91
Author	 : Count Zero
Editor	 : Net Runner
System	 : COCOT Payphones
Uses	 : Free	calling	to most	of the world
Dialups	 : One per payphone
Port	 : 300 bps, 7 bits, Even Pairity, 1 Stop Bit
Emulation: TTY
Thanks To: Count Zero for this extensive document.
Greets To: Magic Man, Darby, JT, Muppet, Madmike, Falcon, George Bush,			 FBI Agent, Net	Runner,	Canine,	Plutus,	Midnight Mage, Yellow Jacket
	   Old Pink, The Knight, Spiritwalker
Renegade Legion	Sites
- tmp down -	   Night City	< RL World HQ >
- private  -	   Night Elite	< ERL Headquarters >
 Contact The Knight or Net Runner for the number to Night Elite
-RL-----------------------------------------------------------------Page 1
   So you're walking down the street and you see a payphone gotta make an
important call,	so you dig into	your pocket to get a dime picking up the
handset, you suddenly notice that the payphone wants a QUARTER for a local
call! What the hell, and WHERE did this	synthesized voice come from?
  Let's	make this phile	short and to the point a COCOT is an acronym for
Customer Owned Coin Operated Telefone in other words, a	COCOT is a fone
OWNED or RENTED	by a PAYING CUSTOMER (most likely, a hotel or donut shop) a
COCOT is NOT a normal payfone the Telco	doesn't	own it,	and the	actual fone
line is	usually	a normal customer loop (unlike payfones, where the fone	line
is a "special" payfone loop, allowing the use of "coin tones" to indicate
money dropped in more on this later) SO!..A COCOT may LOOK and SMELL like
a telco	payphone, but it is NOT.
* Why do COCOTs	exist?
  Simple $$$$$$$! A customer owned payfone is money in the bank! You pay
MORE for local calls and long distance is typically handled by sleazy
carriers that offer bad/EXPENSIVE service the owner/renter of the COCOT	opens
the coinbox and	keeps the money	him/herself! Also, a particularly SLEAZY
quality	of a COCOT is the fact that it DOES NOT	RECIEVE	INCOMING CALLS this,
of course, is because of $$ if people are calling IN to	a COCOT, the COCOT
is not making money and	businesses always want to make as much $$ as
possible...even	if it hurts the	consumer (think	about REALLY sucks
calling	someone	at home	from a COCOT, then not be able to have him/her call
you back to save $$ "Guess I'll	have to	keep feeding the COCOT quarters!")
* Where	is a good place	to look	for COCOTs?
  Outside Dunkin Donut shops, restaurants, clubs, bars,	and outside/inside
hotels "convenient" locations
*  How do I figure out if I have found a COCOT?
  Simple a COCOT will have NO TELCO LOGOS on it	no New England Telephone
symbols	it may look just like a	Telco fone chrome, with	blue stickers and
all that ALSO a	COCOT typically	charges	MORE for a local call than a regular
Telco payfone (in Massachusetts, local calls are a dime, in places like	NYC,
they are 25 cents.) a COCOT will most often have a synthesized voice that
asks you to "please deposit 25 cents" or whatever ALSO some FaNcY COCOTS
will not look like payfones at all some	in hotels have weird LCD displays
and look totally different but the ALWAYS charge you more than a normal
*  OK, I found this weird payphone in Boston that wants	a quarter, and this
 synthesized voice is harassing	me when	does the phun begin?

-RL-----------------------------------------------------------------Page 2
  Soon..first of all, you must understand that the COCOT is a mimic.
Essentially, it	wants you to think that	it is just a plain ol' payfone pick
up the handset..hear that dialtone? hah! that dialtone is fake,	synthesized
by the innards of the COCOT you	are at the mercy of the	COCOT. Remember
a COCOT	runs off of a normal customer loop so unlike a Telco payphone where
you must deposit money to generate coin	tones that are read by the CO, the
security of a COCOT depends solely on the COCOT	fone itself its	as if you
took your own fone and put a sign on it	saying "Please put 10 cents in this
jar for	every call you make." COCOTS are not naiive they won't let you near
the unrestricted dialtone until	you fork over the cash-ola heh heh. Or so
they THINK!
  See, the Achilles heel of the	COCOT is the FACT that ALL PAYFONES MUST LET
YOU MAKE 1-800 CALLS FOR FREE! It's not	just a fact, it's the LAW so, now
pick up	the handset again and place a 1-800 call any 1-800 number will do.
When they answer at the	other end, just	sit there do nothing ignore them.
wait for them to hang up the fone here's an example.
<Ring, Ring>.....<click> "Hello, you wanna buy some money? Hello? HELLO?!"
<You will now hear some	static and probably a strange "waffling" noise,	like
 NOW!.what have	we got here? a dialtone? yes, you guessed it, the dialtone
you now	hear is	the UNRESTRICED	dialtone of the	COCOT's	customer loop.
* So what?..So I got an	"unrestricted dialtone"...big deal?
  Meathead! with an UNRESTRICTED dialtone, all you need	to do is place a call
via DTMF tones (the tones a touch-tone keypad generates) now, try dialing a
number with the	COCOTs keypad WHOA! waitasec, no sound!	this is	a typical
lame attempt at	protection by the COCOT. Just whip out your Radio Shack
pocket tone dialer, and	try calling a number ANY number	place it just as
if you were calling from a home	phone call a 1-900 sex line call Guam you
are FREE and the COCOTs	customer loop is being billed!
***NOTE: some COCOTS are more sophisticated at protecting themselves..some
will RESET when	they hear the dialtone to get around this, make	a loud
hissing	sound with your	mouth into the mouthpiece after	the 1-800 number hangs
up also, get your tone dialer ready near the mouthpiece	when u hear the
dialtone, quickly dial the first digit of your number to call if you hiss
loudly enough, you MAY be able to mask the sound of the	dialtone and prevent
the COCOT from resetting and once you dial the first digit of the number
you are	calling, the dialtone will disappear (naturally) ok, you can stop
hissing	like an	idiot now finish dialing your PHREE fone call.
  Also,	some COCOTs actually disable the handset after a call hangs up
(in other words, you can't send	DTMF tones thru	the mouthpiece)	oh well,
better luck next time.
-RL-----------------------------------------------------------------Page 3
HOWEVER	MOST of	the COCOTs I have run across ONLY disable the DTMF keypad..
so all you need	is a pocket dialer to circumvent this!
OTHER THINGS TO	KNOW: Sure, you	can't call a COCOT, but	it DOES	have a number
to find	out the	COCOT's	number,	call 1-800-933-3258..this automated ANI
service	will tell you the number you're	dialing	from now, try calling the
COCOT from another fone	you will hear one of 2 things:
		 1) synthesized	voice "Thank you"...CLICK..<hang up>
		 2) weird carrier
A COCOT's number is ONLY used by the company that BUILT	the COCOT by calling
up a COCOT, a tech. can	monitor	its functioning, etc in	case (1), you must
enter a	3 or 4 digit password and then you'll get into a voice menu driven
program	that'll	let you	do "maintenance" stuff with the	COCOT in case (2),
you are	hooked to the COCOT's 300 bps modem (YES, a MODEM in a PAYFONE)..
likewise, if you can figure out	the communication settings, you'll be into the
COCOT's	maintenance routines.
Personally, I haven't had much luck (or	patience) with calling up and hacking
COCOT maintenance functions. I just like making	free fone calls	from 'em!
 Now, remember,	you are	making free fone calls but SOMEONE has to pay for
'em...and that is the OWNER the	COCOT's	customer loop is billed	the cost of
the calls, and if the OWNER sees a big difference in the profits made on the
COCOT (profit=coins from COCOT - bill from Telco for customer loop)..they'll
know SOMETHING is up so	moral is DON'T ABUSE THEM! don't call a	1-900
number and stay	on the line for	12 hours! If a COCOT is	abused SEVERLY,	an
owner will eventually LOSE money on the	damn thing!, and that means BYE	BYE
COCOT also, remember that a RECORD of ALL LONG DISTANCE	calls is made to the
COCOT's	customer loop..and COCOT companies will	sometimes investigate "billing
discrepencies" so don't	call anyone you	personally know	unless you are
sure they are "cool".
<RING RING> "Hello?"
       "Hello...this is	Cointel, Inc....we'd like to ask you a few
	questions about	a call you received from Boston	on 2/12/91.
	Could you tell us the name and address of the person who
	placed the call?"
    COOL dude -> "What?...I don't remember...go	to hell! <SLAM>"
    MEATHEAD ->	"Uh, sure, his name is John	want his address too?"
Get the	picture? Good...
COCOTs are a great resource if we use them wisely like our environment,	we
gotta be careful not to	plunder	them make a few	long distance calls and
then leave that	particular COCOT alone for awhile chances are, your bills
will be	"absorbed" by the profit margin	of the owner and probably ignored
but the	smaller	the owner's profit margin gets,the more	likely suspicions will
be aroused 'nuff said!
-RL-----------------------------------------------------------------Page 4
I have found COCOTs EVERYWHERE some of my personal favorites are on Route 1
North of Boston	check out the Dunkin Donut shops and the Burger	King also,
in front of the	Rat in Kenmore look around they	are lurking everywhere.
(BUT..COCOT technology is relatively new..don't	expect them EVERYWHERE..I know
many towns that	have NONE..check out big cities....)  Here are some numbers of
		 Kenmore Square,Boston,MA The Rat
  Random ones: 617/720-4430   617/233-9872
Here are some companies	that deal with COCOTs...try out	your social
engineering skill on them:
	      Cointel, Inc.		  Int'l	Telecharge, Inc.
	    130	Broadway St.		   P.O.	Box 50579
	    Somerville,	MA		   Dallas, TX
		       02145		1800/999-5152
As for a Tone Dialer, don't leave home without one!...a	true phreak always has
a DTMF tone dialer at hand..along with a red box!....My	personal favorite is
the COMBO-BOX (red box plus DTMF) take a Radio Shack 33-memory Pocket Dialer..
open up	the back...remove the little 3.579 MHz crystal (looks like a metal
cylinder..unsolder it)...solder	on a couple of thin, insulated wires where the
crystal	was attached...thread the wires	thru one of the	"vents"	in the back of
the tone dialer....get ahold of	a 6.5536 MHz crystal (available	thru Fry's
Electronics, 89	cents a	piece, phone number 415/770-3763)..go out and get some
quick drying epoxy and a Radio Shack mini Toggle Switch, DPDT, cat. no 275-626
Close the tone dialer, with the	two wires sticking out one of the back vents..
screw it up, attact	the crystals and wires to the switch like this
with solder:
			      I	     xx	 <3.579	crystal>small one
			      I	    I
 toggle	switch	  ->   oooooo X	     xxxxs <two	wires>
			      I	    I
			      I	     xx	 <6.5536 crystal>big one
			      I	    I
Each "xx" prong	in the diagram is actually TWO prongs....hook up the two leads
from the crystals to separate prongs (same with	the wires).
Now, epoxy this	gizmo to the side of the tone dialer use ALOT of epoxy,	as you
must make the switch/crystals essentially EMBEDDED in epoxy resin. like	this:
-RL-----------------------------------------------------------------Page 5
Front View ->	    ----------------------
		    I			 I T <-toggle switch
		    I  oo    oo	    oo	 I---
		    I			 I  |
		    I			 I---
		    I	1    2	   3	 I B s <-two crystals(b=big,s=small)
		    I			 I  |	  in epoxy "blob"
		    I	4    5	   6	 I _
		    I			 I
		    I	7    8	   9	 I  ^two wires running to back of unit
		    I			 I
		    I	*    0	   #	 I
		    I			 I
Back View ->	    I			 I
		 T  I  o      ----   o-----------------------vent (1 of	4)
		--- I	 /	    \	 I
	       |    I	|	  -----------------speaker
		--- I	|	     |	 I
		s B I	|	     |	 I
 2 wires    ->	 \-----o      ----   o	 I
 running into	    I			 I
 vent		    I			 I
		    I			 I
		    I			 I
		    I			 I
Make sure the epoxy is really gobbed on want	to be certaint the
switch and crystals are	firmly attached	and secure in a	matrix of epoxy	(it
doesn't	conduct	electricity, so	don't worry about shorting out the connections
to the toggle switch)...just don't gum up the action of	the switch!
Basically, you've altered the device so	you can	select between 2 crystals to
generate the timing for	the microprocessor in the tone dialer...
Now turn on the	tone dialer NOW, you can easily	switch between the 2 crystal
types the small	crystal	will generate ordinary DTMF tones but, by simply
flicking the switch, you generate HIGHER tones now, using the memory function
of the tone dialer, save 5 "*" in the P1 location, now dial the	P1 location
using the BIG crystal, sure sounds like	the tones for a	QUARTER, doesn't it!
Carry this around with you always will come in handy with both Telco payphones
AND COCOTs! no Phreak should be	without	one!
Anyway,	that about wraps it up for me references for this article include
Noah Clayton's EXCELLENT article on COCOTs in 2600 Magazine, Autumn 1990..
also, The Plague's article on Tone Dialer conversion to	Red Box, 2600
Magazine, Summer 1990 (Which inspired me to create the COMBO-BOX (red box PLUS
DTMF dialer)...I strongly urge people to subscribe to 2600
their office line for more details ->516/751-2600... can READ all you want, but if you	don't get your ASS out
there and try stuff out	for yourself, you are nothing but a POSER!
-RL-----------------------------------------------------------------Page 6
Enough said...oh, also,	I heard	that SOME COCOTs have handsets in them
that can be other words, you call the COCOT and if	you hit
"0" or something else, the earpiece of the handset is activated	and you	can
listen in on what's goin on around the COCOT...I dunno...never worked for me,
but try	these 2	"suspected" numbers...212/268-7538, -6129..try hitting "0" and
listen for any sounds...I could	be wrong, I could be right..I could be black,
I could	be white....
That's all folks remember, the purpose of this phile is	to ENLIGHTEN, and I
in no way condone or encourage illegal don't blame me for
ANY MESS you get into this phile offered strictly as INFORMATIONAL ONLY!  I
am in no way responsible for your ass!
Also, I	am not into wanton destruction,	vandalism, or the truth,
and leave nothing but footsteps.
And drink massive amounts of Jolt me, it's	good for you.
Keep the faith,	and never stop searching for new frontiers....
		       ..oooOO Count Zero OOooo..
We do NOT condone fraud, destruction of	computer data or tangeble items.
We do not condone information hoarding,	and accumulations stacks of informatio
n on individuals which corporations have no business accumulating. Companies
are free to give your information to other companies. And we feel vindicated
in examining the information about ourselves firsthand!
Down with buerocracy!
Hail Eris!
All Hail Discordia!
-Net Runner, Precentor of Renegade Legion
-RL-----------------------------------------------------------------Page 7

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH