OTHER BOXES

The Blue Box is the most intricate and powerful piece of phreaking equipment, but it is only one of several telephone fraud devices invented in the last few decades. Three other boxes described here, all traditionally named after colors, can be used to exploit the phone system. Two of them work with MF tones, and the third takes advantage of the voltage fluctuations that occur when a phone rings. (There are over a dozen other boxes, but most of them are combinations or variations of these. See the sources page for links to textfiles describing the various boxes.)

The Red Box simulates the sound of money being deposited into a payphone. Like long-distance switching tones, coin-deposit signals are dual-frequency, in-band tones. When someone drops a nickel into a payphone, it triggers a relay which emits a beep. This is a combination of 2200 and 1700 Hz, pulsed for about 35ms. A dime triggers two pulses of the same frequencies for 80ms, each with 80ms of silence between pulses. The quarter produces one pulse of 70ms, followed by four 35ms beeps. (5) A phone phreak's Red Box generates these tones, although the timing is not as precise. The phone company's equipment usually cannot tell the difference. Red Box tones alone are not necessarily enough to fool the equipment, however. Occasionally, an operator will send a ground test to the payphone to determine if there is actually money in the coin slot. When a coin is deposited, it completes a circuit until the call is terminated. Therefore, an operator can detect fraud if the ground test fails (i.e., if the circuit is open due to an absence of coins.) For this reason, phreaks have to deposit at least a nickel in order to use a Red Box.(6)

To avoid paying the initial five cents, phreaks came up with the Green Box. The person receiving the call uses this device to simulate three MF signals that are normally generated by the Automated Coin Toll Service (ACTS): Coin collect, coin return, and ringback. Coin collect is a combination of 700 + 1100 Hz; coin return is 1100 + 1700 Hz; ringback is 700 + 1700Hz. At the end of a Red Box phone call (which has to be less than three minutes or ACTS demands more money), the called party signals the central office using a wink (short blast of 2600Hz). This tells the equipment to get ready to receive MF signals. Then the called party sends the appropriate tone -- the coin return signal -- which refunds the caller's nickel. The Green Box can also signal the phone to collect a coin (i.e., release the deposited coin from the temporary catch and let it fall into the collection box), as well as send a Ringback signal to ring the payphone.

Click here to go to the Tone Sampler page (javascript). Click here for non-javascript.

The Black Box, when installed on the called party's home telephone, prevents callers from being charged for the call. The Black Box is perhaps the simplest "box" to build; it is merely a resistor/capacitor circuit placed across the ring wire in the phone. When a telephone is on-hook (hung up), there is a resting potential of about 48 volts DC across the tip and ring. It drops to about 12 volts when the handset is picked up, and current is then able to flow with less resistance. It also triggers the CO to activate a dial tone. When the telephone rings, the CO sends about 90 volts of pulsing DC to the phone. In older phones, this would cause a metal armature to be attracted alternately between two bells (Basic Telecom, part V) but electronic bells are used in new phones. Billing starts for the caller when the called party's DC level drops to the 12 volt range, because that tells the CO that the party has answered. When a 10K resistor is connected to the called party's phone, the voltage is prevented from dropping below about 36 volts. Therefore, billing never starts for the caller, because to the CO it looks like the phone is still ringing (even though the called party has actually answered the phone). Black Box calls have to be kept short, however, because eventually the CO notices that the phone has been "ringing" for a long time. If the phone company gets suspicious, they can detect a Black Box, due to the presence of AC voice signal at the wrong DC level. (Basic Telecom, part V)