Hacking the Three Holed Payphone (Summer, 2000) ----------------------------------------------- By Munzenfernsprechermann Once upon a time. there were no computers to decipher, no electronic voice mail systems, no cable TV, and no Internet. There was one giant phone company and they built, owned, and operated all the payphones. These payphones were standardized. They came in one color (black) and in one basic style. Think about it. For almost forty years, phone hackers in the U.S. and Canada were all tampering with the same piece of equipment. Over time, unauthorized people gleaned a substantial body of information on the mechanics and manipulation of these phones. Although most of this information is now arcane, it may be of interest to present day phone phreaks or veterans who want to reminisce. The basic characteristic of this unit was the three different sized holes on top for inserting nickels, dimes, or quarters. Each coin generated a specific sound when dropped into the slot. A single ding for a nickel, a double ding for a dime, and a hearty gong for a quarter. Through these audible chimes, the operator could "hear" how much money had been deposited. These phones were invariably rotary dial, although some were retrofitted to tone dialing in later years. There was usually a coin return plunger in the upper right and a return slot or hopper on the lower left. The body of the phone was divided into two separate locked compartments. The upper part was accessible to repair personnel and relatively insecure. The bottom section was heavy steel and held the coin box. It required a separate key. The handset was connected with an unarmored cord and hung in a cradle on the left, which activated the unit when it was lifted. The whole thing was mounted on a cast metal plate that held the phone securely and sealed off the back and sides. The basic game was to try and get a free or cut-rate phone call out of this ubiquitous black beast. Strategies consisted of various coin manipulations, messing with the wiring, or befuddling the operator (software?) to achieve this goal. A free long distance call was far more difficult and prestigious than a local one. Coin Hacks These phones required a coin to activate the dial tone. For the most part, you needed a dime or two nickels just to see if the phone was working. This characteristic led to beaucoup lost coins if a phone was out of order. Lost money was a common occurrence and undoubtedly began the adversarial relationship between the phoning public and the public phone. The least finessed method to get a dial tone was to use a slug to simulate the nickel or dime. Various foreign coins worked flawlessly, my personal favorite being the Trinidadian penny. Drop one in; ding ding, hummmmmm, you were good to go. Aside from genuine slugs made in high school metal shop, a favorite was the #10 large pattern brass washer. Available by the pound, they were the perfect width and diameter of a dime, but usually required a little tape over the hole or some spit to slow them down. They were not reliable enough for a long distance call (please deposit nine washers) but would usually generate a dial tone by the third try. A rather elegant coin trick involved a nickel and some excellent timing. You dropped a nickel in the slot and if you slammed the coin return plunger at just the right time, you got your double ding and a dial tone. Of course, it was only a 50 percent discount and it hurt like hell, but it was handy if you were short on change. There were people who claimed they could use a coin on a string and pull it out but this was a myth since diameter, magnetic characteristics, and rolling weight were key in getting a coin accepted. Hardware Hacks Although not quite the fortress of solitude, this basic phone was fairly well guarded. The handset was unscrewable, which was a boon to vandals but yielded little hacking opportunity. On certain models you could place a wire (paper clip, bobby pin, etc.) through the mouthpiece and then ground the other end to a conductive part (usually the coin return) of the phone. If done properly, it yielded a dial tone. I'd like to know how somebody stumbled across that one. Another similar stunt was to edge a piece of gum wrapper foil under the back right seam and slide it slowly up and down until you shorted out some essential wires, yielding a dial tone. I do recall getting a rather nasty shock while performing this maneuver on a rainy day. A great deal of effort went into securing the phone itself but the wiring was often exposed. I believe it was a three pair line, but I don't know how many wires were essential. One pair carried a fairly high voltage to operate a coin drop solenoid in the bottom of the phone. Your cash was held in limbo above the coin box. If your call was completed the money was dumped into the box or diverted to the coin return if the call was incomplete. I once witnessed a lineman shorting two posts at the junction box and yielding a load of change from a clogged chute. He told me he was often sent out to repair a phone that simply had a full coin box. He also said the company security guys sometimes planted UV dyed coins in the upper end of the phone to try and catch their repair personnel stealing. I was never able to repeat his performance and yet I once again got a memorable electric shock for my efforts. Some talented folks were able to momentarily short two of the wires to get a free local call. A bar in my neighborhood had a doorbell rigged to the line for that purpose. They maintained a Bell System employee who hung out there had installed it. It was rumored you could achieve the same effect by piercing the insulation with a pin. The phones were hardened against attack, but they were often easily pried from their moorings. If one was stolen, however, it took a serious effort to get it open, which discouraged your average impatient thief. People were known to clog the coin return and return later to unstuff it and reap their reward. This led to the retrofit of a coin return hopper that was not so readily plugged up. The blue and red boxes opened up a world of possibilities for payphone aficionados. There was a much simpler device that predates them and was pretty good at yielding a free connection for the caller. Sometimes referred to as the "brown box," it was a capacitor/ resistor combination placed across the receiving end phone line. By absorbing the voltage surge when the phone was answered, the payphone believed the connection was never completed and returned the money when you hung up. Not as facile as a tone box, it was still a cool trick if you were calling someone with one of these devices. A phone installer found one in my house and he just confiscated it, along with half a dozen extension phones that were stamped "Property of the Bell System." Never heard another thing about it. Software Hacks Technically, these old electromechanical devices ran without software, but there were some decidedly non-hardware methods to outsmarting the payphone system. The most obvious was simply calling the operator and telling them the phone ate your dime. Sometimes they would mail you a dime but more often than not they d put through a local call for free. For long distance calls, the operator would come on the line and ask you to deposit the cost of the first three minutes. By adding up the bongs and dings s/he would verify you entered the correct amount. If there was a dispute, they would simply return the change and have you reenter it. Some enterprising soul recorded these sounds and played them back but was foiled when the recorder deposited too much money. The operator activated the return solenoid, but when there was no handy recording of coins spilling into the return slot, the ploy was ruined. Long distance calls were easily made with bogus or real credit card numbers. The system was pathetically easy to crack, but then it had to be readily understood by thousands of long distance operators. Essentially, the calling card number was the billing phone number plus some extra meaningless digits and a letter. The letter corresponded with one of the specific digits in the billing number. So, say the third digit was the key one. The letter at the end had to match the assigned value of that digit. If you had a list of the ten letters for a given year and the location of the key digit, you could make your own fictitious accounts. There were no high speed computers to verify your number and it would work for quite a while until it hit the hot sheets. As mentioned, the codes changed annually, but if you had a friend who was an operator, or perhaps a night watchman in a big office building, you could come up with enough numbers to puzzle it out by early January. Phone security would invariably call the receiver of a bogus card call and ask if they knew who had called them from the originating city. Not a good system if you lived with your parents. Abbie Hoffman published a lot of this stuff in "Steal This Book," and after Esquire magazine wrote their seminal "Phone Freak" article, a lot of it came to an end. Eventually the single hole "Urban Fortress" phones phased out the three-hole phone and we all had to improve our skills to stay ahead of the curve. The rest, of course, is history.