// Red Boxing Revealed for the New Age // // by Royal (anonymousroyal@gmail.com) // // http://www.oldskoolphreak.com > This textfile appears as an article in 2600: The Hacker Quarterly > Volume Twenty-Three, Number Four, Winter 2006-2007 edition Disclaimer: The information contained in this textfile is for informational purposes only. Red boxing is illegal, and a form of toll-fraud. I disclaim all responsibility and liability for any illegal activity based on the information contained in this textfile. Red boxing is a topic in the phreaking scene that you've probably read up on many times before in various textfiles and articles, both online and in magazines. Because of that, you're probably not expecting much by reading yet another textfile on this subject. On the contrary, this textfile will provide you with everything you need to know about red boxing today, beyond just answering the simple question, "Can I still red box?" I'm actually going to explain *how* you can still do it. In this textfile, I will explain why red boxing is still possible, and what has changed since a few years ago. I will also go over many ways of still accomplishing this easy task, including a few tricks and other advice you can use when the necessary coin prompt doesn't come on the line. So here it is folks: the red boxing textfile you've been waiting to read for today's payphone technology. Read on and enjoy! Note: A lot of the information you are about to read is based on Verizon payphones, so keep that in mind if any information seems inaccurate for payphones by other providers. Red boxing, as most of you should already know, is a simple method of placing free calls on payphones using the tones that a payphone generates when coins are inserted. If you were unaware of this, then you should do some reading on the subject before continuing further, otherwise you may not understand the information in this textfile. For those of you who have already read the many textfiles and articles out there, you may recall some of the more recent ones claiming that red boxing is either obsolete, or can still be accomplished but with certain limitations. Others may have seemed too vague, lacking a lot of important and valuable information. Regardless of what you may have read, the truth is that it is still possible today, so let's start by going over what makes red boxing possible. What Makes Red Boxing Possible: ============================== Think back to the "good ol' days" when red boxing was a fad in the phreaking scene. Everyone had their modified tone dialer, microcassette recorder, or other form of red box device at the ready, dialing away at the nearest payphone. But think about what they were waiting for on the line; you may be missing the key to what made it all possible. You can't start playing your tones at any given time; you first need to know the rate of the call. Soon after dialing the number, the automated prompt for the amount to deposit came on the line, which is also the system that verifies your coins by listening for the tones that the payphone, or your red box, plays down the line: the Automated Coin Toll System (ACTS). In other cases, a live operator would come on the line instead, but you'd still be asked for the amount to deposit. Even with the operator on the line, ACTS was there as well, so red boxing was still an option as long as the operator didn't suspect toll-fraud. Now that we've covered the main thing that makes red boxing possible, let's go over why some people question its plausibility. The Cause of the Confusion: ========================== Until a few years ago, getting ACTS on the line was simple. All you had to do was dial a long distance number and wait to be prompted for the amount to deposit by either by an automated ACTS prompt or a live operator. In both cases, it was very simple and anybody could do it as long as they had a red box to play the necessary tones. The reason that this was so easy is because during this time, all long distance calls by coin were handled by AT&T throughout the country, and therefore you would get *their* ACTS on the line whenever you dialed a long distance number. Unfortunately, things did change with time. According to their news release on June 5, 2002, (http://www.att.com/news/2002/06/05-10539), AT&T began phasing out their ACTS as the months went by, starting with the states that had the most coin long-distance calling. During this time, as long as the payphone you were using wasn't phased out yet, a recorded message would come on the line before your call was completed and tell you that the payphone you were using would soon no longer accept coins for AT&T long distance calls, suggesting the use of a prepaid calling card or other payment method as a substitute. Sure enough this eventually happened. Now without AT&T's ACTS in place anymore, long distance coin calls have to be handled differently. So if you dial a long distance number on a payphone that formally gave you the automated ACTS prompt or an AT&T operator requesting coins, you will instead get routed to an intercept (an error message), or be prompted for coins from the payphone itself. Once people started getting this instead of the AT&T prompt they were used to, many jumped to conclusions and claimed red boxing as obsolete. Other people claimed that red boxing is only possible through a live operator. However, like I said before, red boxing is still possible and using a live operator is not always necessary. How It's Still Possible: ======================= So how can you still red box? In order to answer that question, I first need to go over LATAs. In case you're not familiar with that term, LATA stands for Local Access and Transport Area. LATAs are geographic areas that dictate how far an Incumbent Local Exchange Carrier (ILEC), an independent carrier such as Verizon or SBC, can route calls. If a call stays inside of a LATA, it is an intra-LATA call. Also, if an intra-LATA call goes beyond a local calling area, it is called a regional toll call (also sometimes referred to as "local toll"). Calls that are placed between LATAs are inter-LATA, and handled by an Interexchange Carrier (IXC), otherwise known as a long distance carrier. Did you get all of that? Good, then let's continue. AT&T indeed got rid of their ACTS, making red boxing long distance calls a thing of the past. However, many ILECs still have their own in place, namely Verizon, SBC, and Qwest. Since the ILEC is the carrier running the ACTS you're trying to get on the line, all of your calls usually need to be intra-LATA. There are different ways you can get ACTS on the line, and in some cases, you are limited to where you can call in the LATA. Types of Payphones: ================== It's very important to get familiar with the different types of payphones in order to know which ones you're able to red box from. In fact, with the newer technology implemented in more payphones now, you may also need to know *how* to red box them. There are four types of payphones that I am going to go over: BOCOTs, COCOTs, Hybrids, and Half Breeds. Bell owned and operated payphones are usually the only ones that use network-control signaling to communicate with ACTS. Therefore, these are the ones you normally want to look for if you want to go red boxing. Your area's ILEC is always the provider, and its logo should always be shown somewhere on these payphones, making them easy to point out. The three types of Bell operated payphones that I'll go over are BOCOTs, Hybrids, and Half Breeds. One thing to note is that a BOCOT can refer to *any* of these three payphones, but herein I'll be using this term specifically for the ones that *do not* have firmware programmed in them. Now that I've made that clear, let's continue. BOCOT stands for Bell Owned Coin Operated Telephone. This payphone is very standard, and does not have any firmware programmed in it to interfere with what you dial. In a lot of areas, these were the original payphones introduced before newer technology came out. You should be able to tell if you're on one of these phones when you dial; there won't be any internal recordings or modem dialing after you dial a phone number. You should also be able to break the dial tone by tapping the switch hook. For all of these reasons, this is the payphone that should give you the least amount of trouble when using your red box. COCOT stands for Customer Owned Coin Operated Telephone. This type of payphone rarely uses network-control signaling or supports ACTS, at least in the U.S. There are many types of this payphone used by different providers. The logo, if shown, should represent a Competitive Local Exchange Carrier (CLEC), which is simply a carrier that competes with an ILEC. Firmware in the phone determines rates, verifies coin payment, and routes calls using an internal modem. In this common case, red boxing is not an option. In rare circumstances, a COCOT may use network-control signaling to communicate with ACTS, and possibly also lack firmware, making red boxing possible. Hybrids are Bell operated payphones like BOCOTs. These are usually the same phone and look identical. The difference is that these have firmware in them. When dialing phone numbers, or even the local operator with 0, the firmware usually kicks in and dials the number for you using an internal modem. The problem with this is that what *you* dial and what the modem dials can be two different things. For example, on Verizon Hybrids, dialing 0 for the local operator will cause the modem to dial Verizon Select Services' Carrier Access Code (CAC) plus a zero, in the format 101-XXXX-0. This brings you to a long distance CLEC operator, instead of the local operator you were supposed to reach. A CLEC operator surely isn't going to do coin verification, so there's no point in whipping out your red box. As for Half Breeds, they're even worse than Hybrids because they look and operate more like a COCOT, which means more firmware to ruin your day. As you can imagine, these phones are a nuisance in many ways. On with the red boxing!: ======================= Time to get into what you've all been waiting for: the red boxing! Here I'll be showing you every method I know to get ACTS on the line; something the more recent articles and textfiles lack. First of all, in order to be able to red box, you must be in the territory of an ILEC that supports ACTS. The only ILECs I know that do this are Verizon, SBC, and Qwest, although there could be others that I'm unaware of. If you're unsure whether or not your ILEC supports ACTS, you can simply try these methods to know for sure. There are also areas that use the ACTS from a different ILEC. For example, Connecticut is in SNET (Southern New England Telephone) territory, yet some of the payphones there give you a Verizon ACTS prompt when you dial a regional toll number. If you still find yourself unable to red box, you may need to be in a different area. As I explained earlier, all calls usually have to be intra-LATA since the ILECs are the only carriers supporting ACTS now. However, as you may already know, most direct dialed local calls are usually verified by a ground test, meaning that you must deposit the money *before* you finish dialing the number in order for the test to pass. That leaves only one other kind of call: regional toll. These calls always require you to press 1 before the number, since there is indeed a regional "toll" for the call. Direct dialing a regional toll number should bring you to an ACTS prompt most of the time, and it's the easiest way of getting one on the line so you can start using your red box. Unfortunately, the regional toll method leaves out calls in your local calling area, and there are going to be times when you need to place a local call. Have no fear though, there are still a few ways that you can red box locally. Another way to get an automated ACTS prompt is through directory assistance, so this method will obviously limit you to listed phone numbers. To do this, pick up the phone and dial 411. Here in Massachusetts where I live, directory assistance is free of charge, however, in most other areas there will be a small fee. If you do live in one of these areas, ACTS will prompt you for an amount to deposit. At this point, you can use your red box to "pay" the necessary amount. If you don't want to use your red box, you may also try tapping the switch hook very quickly, which is a trick that sometimes only works on regular BOCOTs, but this is not guaranteed. If you're on a Hybrid or Half Breed, the firmware in the phone may keep the line on-hook for a longer period of time, and instead disconnect the call, though this is not always the case. The reason that this trick sometimes works is because tapping the switch hook signals the operator to come on the line, but in this case the operator would specifically be the directory assistance operator. Pretty clever eh? Once you get directory assistance on the line, look up the number you're trying to call, this can be either a local or regional toll number. The operator will then put on the recording that announces the phone number. During or after this recording, you should be asked if you want to place a call to this number with an additional fee. Choose to do so by coin deposit, then wait for the ACTS prompt to come on the line. Voila! Now you're all set to start red boxing the call. Wouldn't it be great if you could simply dial a local number direct and still be able to red box the call? Well, guess what? You can! In some cases, dialing a cell phone number will bring you to an ACTS prompt, even if it's a local number. I know for sure that this works in Verizon territory, but you may want to try this elsewhere in case it still works. To do this, pick up the phone and dial 0 plus the area code and 7-digit cell phone number, in the format 0 + NPA-NXX-XXXX. You should get the ACTS prompt on the line afterwards. If you do not, you may want to try dialing in one of these two other formats: NPA-NXX-XXXX or 1-NPA-NXX-XXXX. If those also fail, there are three possible reasons. One reason could simply be that the ILEC doesn't support ACTS with these particular dialing methods. The second reason could center around the cell phone's carrier. In Verizon territory, if the cell phone you are calling isn't with Verizon Wireless, you will not be prompted by ACTS. The same could be true for other ILECs and their wireless carriers. The last reason could be because of the particular type of payphone you are using. Remember what I told you about Hybrids and Half Breeds? Well, if you're on one of those phones, the firmware is most likely interfering with what you're trying to dial. I'll be explaining how to deal with these types of payphones a little later on, so read on a little further and you may find the answer to your problem there. One interesting thing about this method of red boxing is that the call may sometimes be unlimited, meaning that you can stay connected to your party indefinitely. This may only be for local calls though, because when the call is local, ACTS usually prompts you for 50 cents, which is often the amount for a direct dialed local call when the money is verified by a ground test. Very recently during HOPE Number 6, I found out that you can reach ACTS by dialing a long distance number! You heard that right, you can red box long distance calls! In New York City, which is in Verizon territory, you'll get an automated Verizon ACTS prompt for $1.05 after dialing any inter-LATA number in the U.S. However, one thing about the Hybrids in New York that you need to keep in mind is that their firmware is programmed to hande all intra-LATA calls electronically in the phone itself, without ever allowing you to reach an ACTS prompt! Therefore, you'll need to bypass the firmware first, which I explain how to do later on in this textfile. Also, attempting to place international calls this way will only bring you to an intercept, so you'll have to make sure that you always dial domestically. A few friends and I developed a theory that Verizon may be experimenting with their ACTS and slowly implementing it for long distance use. This may have something to do with the recent Verizon/MCI merge, which gives Verizon an IXC to work with, possibly for coin long distance calls supported by ACTS as well. This could be big news if red boxing long distance makes a big return. All we can do is wait and see. That's all for ways of getting an automated ACTS prompt. Now for using live operators. Only your local operator can do coin verification. Getting one on the line is as easy as dialing 0. Once you have the operator on the line, you simply give her the local or regional toll number you want to call, and tell her you're paying with coins. The operator will then tell you to deposit the money. You can now go ahead and start playing your red box tones, being careful not to make any other noises that could make the operator suspect toll-fraud. If that happens, hang up and retry. Once all of your "coins" have been verified, the operator will complete your call. There may be times when the operator will give you a hard time, telling you to direct dial the call yourself. If this happens, you may want to try making up an excuse for needing the operator to place the call for you, such as the keypad being broken, or being handicapped and incapable of dialing yourself. This all sounds pretty easy right? Well, it can get even easier! In Qwest territory, you can use directory assistance to get an operator on the line as well, only in this case, there's less likely a chance of the operator refusing to complete your call. To do this, dial 411 and look up any listed number. After the number plays, choose to pay by coin and wait for the ACTS prompt to come on. This time, let the recording play and repeat itself until you get another operator on the line (quickly flash hooking may also be useful here). Once the new operator comes on, he or she will ask you for the amount to deposit. At this point, ask the operator what number you are calling, sounding very confused. When he or she tells you the number, explain to the operator that this is *not* the number you were trying to call. You should be asked for the number you're calling now, so go ahead and give it up. When you're asked for the amount to deposit, go ahead and start red boxing. Since the first phone number and rate were already known, and you were already going to place a call with coins, your call should be completed with no questions asked. I am unaware if this trick works outside of Qwest territory, so give it a try elsewhere if you want to find out. You know how dialing 0 plus the number you want to call gives you other billing options such as collect, third party, person-to-person, calling card, and credit card? Well, sometimes when you talk to someone live, it's a real operator that can do coin verification! To see if this will work for you, simply dial 0 and the number you are calling, in the format 0 + NPA-NXX-XXXX. If you are brought to an automated system telling you your billing options, choose to talk to a live operator. Next, tell the operator that you want to pay for the call with coins. If the operator asks you for the amount to deposit, you're all set to red box the call. If not, chances are you're out of luck. I'm not done yet: here's one last method of getting an operator on the line. This one involves using the 555 exchange. I know this works in Verizon territory, but am unsure if it works anywhere else. Pick up the phone and dial an unassigned number in exchange 555, in the format 1-NPA-555-XXXX. In a few moments, an operator may come on the line. If you don't get an operator, or if the operator tried placing the call before you could speak, hang up and redial. If the operator does come on, he or she may sound confused, or ask if you're calling a cell phone. You need to talk quickly before the operator tries to place this invalid call! Explain to him or her that the 555 number is incorrect, and you're calling a different number. Half of the time you will be told to hang up and redial. However, if you are asked for the number you want to call, go ahead and give it up. Now you'll be asked for the amount to deposit, and you can red box away. Dealing with Hybrids and Half Breeds: ==================================== Hybrids and Half Breeds can prevent you from being able to do a lot of things. Some of these things include calling the local operator when you dial 0, getting an ACTS prompt when dialing 0 plus a cell phone number, and even flash hooking properly. Unfortunately, I don't have the time to include all of the methods of bypassing firmware on these phones. What I will go over is a specific kind of firmware bypassing technique that takes advantage of Vertical Service Codes (VSCs). VSCs are customer-dialed codes preceded by a "star" (*), or 11 if you have a rotary phone, that access services provided by a local or long distance carrier. *69 Call Return, a service that lets you call back the last party who called you, is one of the better known VSCs. The three that you can use on Hybrids (not Half Breeds) are *67, *82, and *58. In case you aren't familiar with these codes, *67 is for blocking your caller-ID, *82 is for unblocking your caller-ID, and *58 is for preventing other stations on a Multibutton Key Set (MBKS) on ISDN from accessing your call. When using these, you have to dial them in the style for rotary phones, meaning that you precede them with 11 instead of *, because the firmware in the Hybrids prevent that touch tone from reaching the dial tone. So you'll actually be dialing 1167, 1182, or 1158. To use these VSCs, pick up the phone and dial one of them. If you dial 1167 or 1182, you'll hear a stutter dial tone. If you dial 1158, the dial tone will drop, some clicking will sound, and then your dial tone will eventually be returned. 1158 in particular is very strange, and I have yet to understand why it does this, especially considering it's for ISDN. Once you have your dialed one of the VSCs, the firmware in the Hybrid will no longer interfere. From here, you can go ahead and dial what you would have normally been prevented from accessing, such as the local operator by dialing 0. Unfortunately, these codes don't work everywhere, so if they all fail, try another location. 1158 in particular seems to work more often in major cities like Boston or New York City for some reason, so try it in those areas as well. As for Half Breeds, I've never learned much about these, so I don't know of any ways around their firmware. Sorry. Other tricks and advice: ======================= There's a very cool feature you can take advantage of on Verizon's ACTS that I should share. When you get to the automated ACTS prompt, you can continue to red box in more "money" past the maximum amount necessary for the call! This can be done indefinitely; just keep playing the tones to get more and more "money" credited to your call. The more "money" you add up, the longer your call will last before you get another ACTS prompt. As far as I know, this is only possible through Verizon. For fun, you could actually red box in $100 worth of tones to hear it say "Thank you, you have one hundred dollars credit towards overtime". Of course, Verizon would be pretty suspicious if they saw such a large amount of money spent on an ACTS call in their records. If you thought using your red box was only good for making free phone calls, think again! Believe it or not, operators will actually accept coin payment for doing Busy Line Verification or Busy Line Interrupt! To do this, get a local operator on the line by dialing 0 or using one of the methods I mentioned earlier. When the operator comes on, tell him or her that you want to verify or interrupt a busy line and use coin payment. When you are instructed to deposit coins, you can go ahead and red box in the amount required. If you haven't already been asked for your name and the phone number, the operator should ask you for this information after all of your "coins" are verified. Everything should be routine from this point. If you've been having trouble getting local operators to place coin calls for you, then requesting a busy line interrupt may work better than making up an excuse if the operator connects your call afterwards. As for issues you might be having with your red box, there's no need for me to go over the common details of why it might not be working. That information is already freely available online. Play your tones louder or softer. Try re-recording them to get rid of distortion. Move your red box closer or further away from the mouthpiece of the payphone. Try soldering on a better crystal in your tone dialer. It should all be common sense to you by now after all these years. However, there is something I want to go over about certain payphones. Some of them have their own ways of preventing red boxing. Let me explain. Some payphones mute the mouthpiece of the handset until the call is completed, and if this is the case, chances are you won't be able to use your red box when the ACTS prompt comes on. There are also some payphones that actually filter out the red box frequency from being played through the mouthpiece. You'll hear a click every time you play the tones. When you're having trouble red boxing a call, and common problems like the ones above aren't the issue, this just may be what's causing trouble. If you're still not sure, go to another payphone and try red boxing that one. If it works, it was probably the first payphone filtering out that frequency. There is nothing you can do about this other than using another payphone. Sure, you could attempt to take the phone apart or beige box onto the physical line somewhere, but who really wants to bother doing all of that just to make a payphone call? Getting inside the phone usually isn't an option anyway considering how well locked and secured they are. Sometimes you just have to accept when you're beat. So now you know for certain that red boxing isn't dead yet. I've answered the question "Can I still red box?" and gone beyond by giving you all the known methods of pulling it off. What more could you ask for? Hopefully now I've answered every question you could possibly have. Happy red boxing... and happy trails! Shouts: av1d, I-baLL, decoder, greyarea, Lucky225, Natas and http://www.oldskoolphreak.com, Stankdawg and http://www.binrev.com, WhiteSword, licutis, Not Theory, Cesssnaa, Lowtec, x64, kurced, Doug from Doug TV, Athnex, Majestic, BlakeOPS, Murd0c, accident, Tim, LamerJoe, Elf, Boston-2600 (http://www.boston2600.org)