The Trunk Toaster's Phreaky Philez FILE: I-01 SUBJECT: Phone System Tutorial I AUTHOR: Jolly Roger (1986) ____________________________________________________________________________ To start off, we will discuss the dialing procedures for domestic as well as international dialing. We will also take a look at the telephone numbering plan. North American Numbering Plan ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In North America, the telephone numbering plan is as follows: A) a 3 digit Numbering Plan Area (NPA) code , ie, area code B) a 7 digit telephone # consisting of a 3 digit Central Office (CO) code plus a 4 digit station # These 10 digits are called the network address or destination code. It is in the format of: Area Code Telephone # --------- ----------- N*X NXX-XXXX Where: N = a digit from 2 to 9 * = the digit 0 or 1 X = a digit from 0 to 9 Area Codes ~~~~~~~~~~ Check your telephone book or the seperate listing of area codes found on many bbs's. Here are the special area codes (SAC's): 510 - TWX (USA) 610 - TWX (Canada) 700 - New Service 710 - TWX (USA) 800 - WATS 810 - TWX (USA) 900 - DIAL-IT Services 910 - TWX (USA) The other area codes never cross state lines, therefore each state must have at least one exclusive NPA code. When a community is split by a state line, the CO #'s are often interchangeable (ie, you can dial the same number from two different area codes). TWX (Telex II) consists of 5 teletype-writer area codes. They are owned by Western Union. These SAC's may only be reached via other TWX machines. These run at 110 baud (last I checked! They are most likely faster now!). Besides the TWX #'s, these machines are routed to normal telephone #'s. TWX machines always respond with an answerback. For example, WU's FYI TWX # is (910) 279-5956. The answerback for this service is "WU FYI MAWA". If you don't want to but a TWX machine, you can still send TWX messages using Easylink [800/325-4112]. However you are gonna have to hack your way onto this one! 700: 700 is currently used by AT&T as a call forwarding service. It is targeted towards salesmen on the run. To understand how this works, I'll explain it with an example. Let's say Joe Q. Salespig works for AT&T security and he is on the run chasing a phreak around the country who royally screwed up an important COSMOS system. Let's say that Joe's 700 # is (700) 382-5968. Everytime Joe goes to a new hotel (or most likely SLEAZY MOTEL), he dials a special 700 #, enters a code, and the number where he is staying. Now, if his boss received some important info, all he would do is dial (700) 382-5968 and it would ring wherever Joe last progammed it to. Neat, huh? 800: This SAC is one of my favourites since it allows for toll free calls. INWARD WATS (INWATS), or Inward Wide Area Telecommunications Service is the 800 #'s that we are all familiar with. 800 #'s are set up in service areas or bands. There are 6 of these. Band 6 is the largest and you can call a band 6 # from anywhere in the US except the state where the call is terminated (that is why most companies have one 800 number for the countery and then another one for their state.) Band 5 includes the 48 contiguous states. All the way down to band 1 which includes only the states contiguous to that one. Therefore, less people can reach a band 1 INWATS # than a band 6 #. Intrastate INWATS #'s (ie, you can call it from only 1 state) always have a 2 as the last digit in the exchange (ie, 800-NX2- XXXX). The NXX on 800 #'s represent the area where the business is located. For example, a # beginning with 800-431 would terminate at a NY CO. 800 #'s always end up in a hunt series in a CO. This means that it tries the first # allocated to the company for their 800 lines; if this is busy, it will try the next #, etc. You must have a minimum of 2 lines for each 800 #. For example, Travelnet uses a hunt series. If you dial (800) 521-8400, it will first try the # associated with 8400; if it is busy it will go to the next available port, etc. INWATS customers are billed by the number of hours of calls made to their #. OUTWATS (OUTWARD WATS): OUTWATS are for making outgoing calls only. Largecompanies use OUTWATS since they receive bulk-rate discounts. Since OUTWATS numbers cannot have incoming calls, they are in the format of: (800) *XXX-XXXX Where * is the digit 0 or 1 (or it may even be designated by a letter) which cannot be dialed unless you box the call. The *XX identifies the type of service and the areas that the company can call. Remember: INWATS + OUTWATS = WATS EXTENDER 900: This DIAL-IT SAC is a nationwide dial-it service. It is use for taking television polls and other stuff. The first minute currently costs an outrageous 50-85 cents and each additional minute costs 35-85 cents. Hell takes in a lot of revenue this way! Dial (900) 555-1212 to find out what is currently on this service. CO CODES ~~~~~~~~ These identify the switching office where the call is to be routed. The following CO codes are reserved nationwide: 555 - directory assistance 844 - time. These are now in! 936 - weather the 976 exchange 950 - future services 958 - plant test 959 - plant test 970 - plant test (temporary) 976 - DIAL-IT services Also, the 3 digit ANI & ringback #'s are regarded as plant test and are thus reserved. These numbers vary from area to area. You cannot dial a 0 or 1 as the first digit of the exchange code (unless using a blue box!). This is due to the fact that these exchanges (000-199) contains all sorts of interesting shit such as conference #'s, operators, test #'s, etc. 950: Here are the services that are currently used by the 950 exchange: 1000 - SPC 1022 - MCI Execunet 1033 - US Telephone 1044 - Allnet 1066 - Lexitel 1088 - SBS Skyline These SCC's (Specialized Common Carriers) are free from fortress phones! Also, the 950 exchange will probably be phased out with the introduction of Equal Access Plant Tests: These include ANI, Ringback, and other various tests. 976: Dial 976-1000 to see what is currently on the service. Also, many bbs's have listings of these numbers. N11 codes: ---------- Bell is trying to phase out some of these, but they still exist in most areas. 011 - international dialing prefix 211 - coin refund operator 411 - directory assistance 611 - repair service 811 - business office 911 - EMERGENCY International Dialing ~~~~~~~~~~~~~~~~~~~~~ With International Dialing, the world has been divided into 9 numbering zones. To make an international call, you must first dial: International Prefix + Country code + National # In North America, the international dialing prefix is 011 for station-to-station calls. If you can dial International #'s directly in your area then you have International Direct Distance Dialing (IDDD). The country code, which varies from 1 to 3 digits, always has the world numbering zone as the first digit. For example, the country code for the United Kingdom is 44, thus it is in world numbering zone 4. Some boards may contain a complete listing of other country codes, but here I give you a few: 1 - North America (US, Canada, etc.) 20 - Egypt 258 - Mozambique 34 - Spain 49 - Germany 52 - Mexico (southern portion) 7 - USSR 81 - Japan 98 - Iran (call & hassle those bastards!) If you call from an area other than North America, the format is generally the same. For example, let's say that you wanted to call the White House from Switzerland to tell the prez that his numbered bank account is overdrawn (it happens, you know! ha ha). First you would dial 00 (the SWISS international dialing refix), then 1 (the US country code), followed by 202-456-1414 (the national # for the White House. Just ask for Georgy and give him the bad news!) Also, country code 87 is reserved for Maritime mobile service, ie, calling ships: 871 - Marisat (Atlantic) 871 - Marisat (Pacific) 872 - Marisat (Indian) International Switching: ------------------------ In North America there are currently 7 no. 4 ESS's that perform the duty of ISC (Inter-nation Switching Centers). All international calls dialed from numbering zone 1 will be routed through one of these "gateway cities". They are: 182 - White Plains, NY 183 - New York, NY 184 - Pittsburgh, PA 185 - Orlando, Fl 186 - Oakland, CA 187 - Denver, CO 188 - New York, NY The 18X series are operator routing codes for overseas access (to be furthur discussed with blue boxes). All international calls use a signaling service called CCITT.It is an international standard for signaling. EOF ---- GET FILE #2 ---- Part II will deal with the various types of operators, office heirarchy, & switching equipment. Operators ~~~~~~~~~ There are many types of operators in the network and the more common ones will be discussed. TSPS Operator: The TSPS [(Traffic Service Position System) ass opposed to This Shitty Phone Service] Operator is probably the bitch (or bastard, for the female libertationists out there) that most of us are used to having to deal with. Here are his/her responsibilities: 1) Obtaning billing information for calling card or third number calls 2) Identifying called customer on person-to-person calls. 3) Obtaining acceptance of charges on collect calls. 4) Identifying calling numbers. This only happens when the calling # is not automatically recorded by CAMA (Centralized Automatic Message Accounting) & forwarded from the local office. This could be caused by equipment failures (ANIF- Automatic Number Identification Failure) or if the office is not equipped for CAMA (ONI- Operator Number Identification). Ask to speak to their supervisor... or better yet the Group Chief (who is the highest ranking official in any office) who is the equivalent of the Madame ina whorehouse. By the way, some CO's that willallow you to dial a 0 or 1 as the 4th digit, will also allow you to call special operators & other fun Tel. Co. #'s without a blue box. This is ver rare, though! For example,212-121-1111 will get you a NY Inward Operator. Office Hierarchy ~~~~~~~~~~~~~~~~ Every switching office in North America (the NPA system), is assigned an office name and class. There are five classes of offices numbered 1 through 5. Your CO is most likely a class 5 or end office. All long-distance (Toll) calls are switched by a toll office which can be a class 4, 3, 2, or 1 office. There is also a class 4X office callen an intermediate point. The 4X office is a digital one that can have an unattended exchange attached to it (known as a Remote Switching Unit (RSU)). The following chart will list the Office #, name, & how many of those office exist (to the best of my knowledge) in North America: Class Name Abb # Existing ----- ----------------------- --- ----------------- > 1 Regional Center RC 12 > 2 Sectional Center SC 67 > 3 Primary Center PC 230 > 4 Toll Center TC 1,300 > 4P Toll Point TP n/a > 4X Intermediate Point IP n/a > 5 End Office EO 19,000 > 6 RSU RSU n/a When connecting a call from one party to another, the switching equipment usually tries to find the shortest route between the class 5 end office of the caller & the class 5 end officeof the called party. If no inter-office trunks exist between the two parties, it will then move upward to the next highest office for servicing calls (Class 4). If the Class 4 office cannot handle the call by sending it to another Class 4 or 5 office, it will then be sent to the next highest office in the hierarchy (3). The switching equipment first uses the high-usage interoffice trunk groups, if they are busy then it goes to the fina; trunk groups on the next highest level. If the call cannot be connected, you will probably get a re-order [120 IPM (interruptions per minute) busy signal] signal. At this time, the guys at Network Operations are probably shitting in their pants and trying to avoid the dreaded Network Dreadlock (as seen on TV!). It is also interesting to note that 9 connections in tandem is called ring-around-the-rosy and it has never occured in telephone history. This would cause an endless loop connection [a neat way to really screw up the network]. The 10 regional centers in the US & the 2 in Canada are all interconnected. they form the foundation of the entire telephone network. Since there are only 12 of them, they are listed below: Class 1 Regional Office Location NPA -------------------------------- --- Dallas 4 ESS 214 Wayne, PA 215 Denver 4T 303 Regina No. 2SP1-4W (Canada) 306 St. Louis 4T 314 Rockdale, GA 404 Pittsburgh 4E 412 Montreal No. 1 4AETS (Canada) 504 EOF --- GET FILE #3 --- PREFACE: THIS ARTICLE WILL FOCUS PRIMARILY ON THE STANDARD WESTERN ELECTRIC SINGLE- SLOT COIN TELEPHONE (AKA FORTRESS FONE) WHICH CAN BE DIVIDED INTO 3 TYPES: - DIAL-TONE FIRST (DTF) - COIN-FIRST (CF): (IE, IT WANTS YOUR $ BEFORE YOU RECEIVE A DIAL TONE) - DIAL POST-PAY SERVICE (PP): YOU PAYAFTER THE PARTY ANSWERS DEPOSITING COINS (SLUGS): ------------------------- ONCE YOU HAVE DEPOSITED YOUR SLUG INTO A FORTRESS, IT IS SUBJECTED TO A GAMUT OF TESTS. THE FIRST OBSTACAL FOR A SLUG IS THE MAGNETIC TRAP. THIS WILL STOP ANY LIGHT-WEIGHT MAGNETIC SLUGS AND COINS. IF IT PASSES THIS, THE SLUG IS THEN CLASSIFIED AS A NICKEL, DIME, OR QUARTER. EACH SLUG IS THEN CHECKED FOR APPROPRIATE SIZE AND WEIGHT. IF THESE TESTS ARE PASSED, IT WILL THEN TRAVEL THROUGH A NICKEL, DIME, OR QUARTER MAGNET AS APPROPRIATE. THESE MAGNETS SET UP AN EDDY CURRENT EFFECT WHICH CAUSES COINS OF THE APPROPRIATE CHARACTERISTICS TO SLOW DOWN SO THEY WILL FOLLOW THE CORRECT TRAJECTORY. IF ALL GOES WELL, THE COIN WILL FOLLOW THE CORRECT PATH (SUCH AS BOUNCING OFF OF THE NICKEL ANVIL) WHERE IT WILL HOPEFULLY FALL INTO THE NARROW ACCEPTED COIN CHANNEL. THE RATHER ELABORATE TESTS THAT ARE PERFORMED AS THE COIN TRAVELS DOWN THE COIN CHUTE WILL STOP MOST SLUGS AND OTHER UNDESIRABLE COINS, SUCH AS PENNIES, WHICH MUST THEN BE RETRIEVED USING THE COIN RELEASE LEVER. IF THE SLUG MIRACULOUSLY SURVIVES THE GAMUT, IT WILL THEN STRIKE THE APPROPRIATE TOTALIZER ARM CAUSING A RATCHET WHEEL TO ROTATE ONCE FOR EVERY 5-CENT INCREMENT (EG, A QUARTER WILL CAUSE IT TO ROTATE 5 TIMES). THE TOTALIZER THEN CAUSES THE COIN SIGNAL OSCILLATOR TO READOUT A DUAL- FREQUENCY SIGNAL INDICATING THE VALUE DEPOSITED TO ACTS (A COMPUTER) OR THE TSPS OPERATOR. THESE ARE THE SAME TONES USED BY PHREAKS IN THE INFAMOUS RED BOXES. FOR A QUARTER, 5 BEEP TONES ARE OUTPULSED AT 12-17 PULSES PER SECOND (PPS). A DIME CAUSES 2 BEEP TONES AT 5 - 8.5 PPS WHILE A NICKEL CAUSES ONE BEEP TONE AT 5 - 8.5 PPS. A BEEP CONSISTS OF 2 TONES: 2200 + 1700 HZ. A RELAY IN THE FORTRESS CALLED THE "B RELAY" (YES, THERE IS ALSO AN 'A RELAY') PLACES A CAPACITOR ACROSS THE SPEECH CIRCUIT DURING TOTALIZER READOUT TO PREVENT THE "CUSTOMER" FROM HEARING THE RED BOX TONES. IN OLDER 3 SLOT PHONES: ONE BELL (1050-1100 HZ) FOR A NICKEL, TWO BELLS FOR A DIME, AND ONE GONG (800 HZ) FOR A QUARTER ARE USED INSTEAD OF THE MODERN DUAL-FREQUENCY TONES. ============= =TSPS & ACTS= ============= WHILE FORTRESSES ARE CONNECTED TO THE CO OF THE AREA, ALL TRANSACTIONS ARE HANDLED VIA THE TRAFFIC SERVICE POSITION SYSTEM (TSPS). IN AREAS THAT DO NOT HAVE ACTS, ALL CALLS THAT REQUIRE OPERATOR ASSISTANCE, SUCH AS CALLING CARD AND COLLECT, ARE AUTOMATICALLY ROUTED TO A TSPS OPERATOR POSITION. IN AN EFFORT TO AUTOMATE FORTRESS SERVICE, A COMPUTER SYSTEM KNOWN AS AUTOMATED COIN TOLL SERVICE (ACTS) HAS BEEN IMPLEMENTED IN MANY AREAS. ACTS LISTENS TO THE RED BOX SIGNALS FROM THE FONES AND TAKES APPROPRIATE ACTION. IT IS ACTS WHICH SAYS, "TWO DOLLARS PLEASE (PAUSE) PLEASE DEPOSIT TWO DOLLARS FOR THE NEXT TEN SECONDS" (AND OTHER VARIATIONS). ALSO, IF YOU TALK FOR MORE THAN THREE MINUTES AND THEN HANG-UP, ACTS WILL CALL BACK AND DEMAND YOUR MONEY. ACTS IS ALSO RESPONSIBLE FOR AUTOMATED CALLING CARD SERVICE. ACTS ALSO PROVIDE TROUBLE DIAGNOSIS FOR CRAFTSPEOPLE (REPAIRMEN SPECIALIZING IN FORTRESSES). FOR EXAMPLE, THERE IS A COIN TEST WHICH IS GREAT FOR TUNING UP RED BOXES. IN MANY AREAS THIS TEST CAN BE ACTIVATED BY DIALING 09591230 AT A FORTRESS (THANKS TO KARL MARX FOR THIS INFORMATION). ONCE ACTIVATED IT WILL REQUEST THAT YOU DEPOSIT VARIOUS COINS. IT WILL THEN IDENTIFY THE COIN AND OUTPULSE THE APPROPRIATE RED BOX SIGNAL. THE COINS ARE USUALLY RETURNED WHEN YOU HANG UP. TO MAKE SURE THAT THERE IS ACTUALLY MONEY IN THE FONE, THE CO INITIATES A "GROUND TEST" AT VARIOUS TIMES TO DETERMINE IF A COIN IS ACTUALLY IN THE FONE. THIS IS WHY YOU MUST DEPOSIT AT LEAST A NICKEL IN ORDER TO USE A RED BOX! GREEN BOXES: ------------ PAYING THE INITIAL RATE IN ORDER TO USE A RED BOX (ON CERTAIN FORTRESSES) LEFT A SOUR TASTE IN MANY RED BOXER'S MOUTHS THUS THE GREEN BOX WAS INVENTED. THE GREEN BOX GENERATES USEFUL TONES SUCH AS COIN COLLECT, COIN RETURN, AND RINGBACK. THESE ARE THE TONES THAT ACTS OR THE TSPS OPERATOR WOULD SEND TO THE CO WHEN APPROPRIATE. UNFORTUNATELY, THE GREEN BOX CANNOT BE USED AT A FORTRESS STATION BUT IT MUST BE USED BY THE CALLED PARTY. HERE ARE THE TONES: COIN COLLECT 700 + 1100 HZ COIN RETURN 1100 + 1700 HZ RINGBACK 700 + 1700 HZ BEFORE THE CALLED PARTY SENDS ANY OF THESE TONES, AN OPERATOR RELEASED SIGNAL SHOULD BE SENT TO ALERT THE MF DETECTORS AT THE CO. THIS CAN BE ACCOMPLISHED BY SENDING 900 + 1500 HZ OR A SINGLE 2600 HZ WINK (90 MS) FOLLOWED BY A 60 MS GAP AND THEN THE APPROPRIATE SIGNAL FOR AT LEAST 900 MS. ALSO, DO NOT FORGET THAT THE INITIAL RATE IS COLLECTED SHORTLY BEFORE THE 3 MINUTE PERIOD IS UP. INCIDENTALLY, ONCE THE ABOVE MF TONES FOR COLLECTING AND RETURNING COINS REACH THE CO, THEY ARE CONVERTED INTO AN APPROPRIATE DC PULSE (-130 VOLTS FOR RETURN & +130 VOLTS FOR COLLECT). THIS PULSE IS THEN SENT DOWN THE TIP TO THE FORTRESS. THIS CAUSES THE COIN RELAY TO EITHER RETURN OR COLLECT THE COINS. THE ALLEGED "T-NETWORK" TAKES ADVANTAGE OF THIS INFORMATION. WHEN A PULSE FOR COIN COLLECT (+130 VDC) IS SENT DOWN THE LINE, IT MUST BE GROUNDED SOMEWHERE. THIS IS USUALLY EITHER THE YELLOW OR BLACK WIRE. THUS, IF THE WIRES ARE EXPOSED, THESE WIRES CAN BE CUT TO PREVENT THE PULSE FROM BEING GROUNDED. WHEN THE THREE MINUTE INITIAL PERIOD IS ALMOST UP, MAKE SURE THAT THE BLACK & YELLOW WIRES ARE SEVERED; THEN HANG UP, WAIT ABOUT 15 SECONDS IN CASE OF A SECOND PULSE, RECONNECT THE WIRES, PICK UP THE FONE, HANG UP AGAIN, AND IF ALL GOES WELL IT SHOULD BE "JACKPOT" TIME. PHYSICAL ATTACK: ---------------- A TYPICAL FORTRESS WEIGHS ROUGHLY 50 LBS. WITH AN EMPTY COIN BOX. MOST OF THIS IS ACCOUNTED FOR IN THE ARMOR PLATING. WHY ALL THE SECURITY? WELL, BELL CONTRIBUTES IT TO THE FOLLOWING: "SOCIAL CHANGES DURING THE 1960'S MADE THE MULTISLOT COIN STATION A PRIME TARGET FOR: VANDALISM, STRONG ARM ROBBERY, FRAUD, AND THEFT OF SERVICE. THIS BROUGHT ABOUT THE INTRODUCTION OF THE MORE RUGGED SINGLE SLOT COIN STATION AND A NEW ENVIRONMENT FOR COIN SERVICE." AS FOR PICKING THE LOCK, I WILL QUOTE MR. PHELPS: "WE OFTEN FANTASIZE ABOUT 'PICKING THE LOCK' OR 'GETTING A MASTER KEY.' WELL, YOU CAN FORGET ABOUT IT. I DON'T LIKE TO DISCOURAGE PEOPLE, BUT IT WILL SAVE YOU FROM WASTING ALOT OF OUR TIME--TIME WHICH CAN BE PUT TO BETTER USE (HEH, HEH)." AS FOR PHYSICAL ATTACK, THE COIN PLATE IS SECURED ON ALL FOUR SIDE BY HARDENED STEEL BOLTS WHICH PASS THROUGH TWO SLOTS EACH. THESE BOLTS ARE IN TURN INTERLOCKED BY THE MAIN LOCK. ONE PHREAK I KNOW DID MANAGE TO TAKE ONE OF THE 'MOTHERS' HOME (WHICH WAS ATTACHED TO A PIECE OF PLYWOOD AT A CONSTRUCTION SITE; OTHERWISE, THE PERMANENT ONES ARE A BITCH TO DETACH FROM THE WALL!). IT TOOK HIM ALMOST TEN HOURS TO OPEN THE COIN BOX USING A POWER DRILL, SLEDGE HAMMERS, AND CROW BARS (WHICH WAS EMPTY -- PERHAPS NEXT TIME, HE WILL DEPOSIT A COIN FIRST TO HEAR IF IT SLUSHES DOWN NICELY OR HITS THE EMPTY BOTTOM WITH A CLUNK.) TAKING THE FONE OFFERS A HIGHER MARGIN OF SUCCESS. ALTHOUGH THIS MAY BE DIFFICULT OFTEN REQUIRING BRUTE FORCE AND THERE HAS BEEN SEVERAL CASES OF BACK AXLES BEING LOST TRYING TO TAKE DOWN A FONE! A QUICK AND DIRTY WAY TO OPEN THE COIN BOX IS BY USING A SHOTGUN. IN DETROIT, AFTER ECOLOGISTS CLEANED OUT A MUNICIPAL POND, THEY FOUND 168 COIN PHONE RIFLED. IN COLDER AREAS, SUCH AS CANADA, SOME SHREWD PEOPLE TAPE UP THE FONES USING DUCT TAPE, POUR IN WATER, AND COME BACK THE NEXT DAY WHEN THE WATER WILL HAVE FROZE THUS EXPANDING AND CRACKING THE FONE OPEN. IN ONE CASE, "UNAUTHORIZED COIN COLLECTORS" WHERE CAUGHT WHEN THEY BROUGHT $6,000 IN CHANGE TO A BANK AND THE BANK BECAME SUSPICIOUS... AT ANY RATE, THE MAIN LOCK IS AN EIGHT LEVEL TUMBLER LOCATED ON THE RIGHT SIDE OF THE COIN BOX. THIS LOCK HAS 390,625 POSSIBLE POSITIONS (5 ^ 8, SINCE THERE ARE 8 TUMBLERS EACH WITH 5 POSSIBLE POSITIONS) THUS IT IS HIGHLY PICK RESISTANT! THE LOCK IS HELD IN PLACE BY 4 SCREWS. IF THERE IS SUFFICIENT CLEARANCE TO THE RIGHT OF THE FONE, IT IS CONCEIVABLE TO PUNCH OUT THE SCREWS USING THE DRILLING PATTERN BELOW (PROVIDED BY ALEXANDER MUNDY IN TAP #32): ==================================== !! ^ !! ! ! 1- 3/16 " !! ! !<--- --->!! 1-1/2" -------------------- ! ! ! !! ! ! ! (+) (+)-! ----------- ---! !! ! ^ ! ! !! ! ! ! ! (Z) !! ! ! ! ! !! ! 2-3/16" ---! !! ! ! ! (+) (+) ! ! ! !! ! ! -------------------- ----------- !! !! (Z) KEYHOLE (+) SCREWS !! =================================== AFTER THIS IS ACCOMPLISHED, THE LOCK CAN BE PUSHED BACKWARDS DISENGAGING THE LOCK FROM THE COVER PLATE. THE FOUR BOLTS OF THE COVER PLATE CAN THEN BE RETRACTED BY TURNING THE BOLTWORKS WITH A SIMPLE KEY IN THE SHAPE OF THE HOLE ON THE COIN PLATE (SEE DIAGRAM BELOW). OF COURSE, THERE ARE OTHER METHODS AND DRILLING PATTERNS. :-------------------------------------: _ ! ! ( ) !_! [ROUGHLY] DIAGRAM OF COVER PLATE KEYHOLE :-------------------------------------: THE TOP COVER USES A SIMILAR (BUT NOT AS STRONG) LOCKING METHOD WITH THE KEYHOLE DEPICTED ABOVE ON THE TOP LEFT HIDE AND A REGULAR LOCK (PROBABLY TUMBLER ALSO) ON THE TOP RIGHT-HAND SIDE. IT IS INTERESTING TO EXPERIMENT WITH THE COIN SHUTE AND THE FORTRESSES OWN "RED BOX" (WHICH BELL DIDN'T HAVE THE 'BALLS' TO COLOR RED). MISCELLANEOUS: -------------- IN A FEW AREAS (RURAL & CANADA), POST-PAY SERVICE EXISTS. WITH THIS TYPE OF SERVICE, THE MOUTHPIECE IS CUT OFF UNTIL THE CALLER DEPOSITS MONEY WHEN THE CALLED PARTY ANSWERS. THIS ALSO ALLOWS FOR FREE CALLS TO WEATHER AND OTHER DIAL-IT SERVICES! RECENTLY, 2600 MAGAZINE ANNOUNCED THE CLEAR BOX WHICH CONSISTS OF A TELEPHONE PICKUP COIL AND A SMALL AMP. IT IS BASED ON THE› RINCIPAL THAT THE RECEIVER IS ALSO A WEAK TRANSMITTER AND THAT BY AMPLIFYING YOUR SIGNAL YOU CAN TALK VIA THE TRANSMITTER THUS AVOIDING COSTLY TELEPHONE CHARGES! MOST FORTRESSES ARE FOUND IN THE 9XXX AREA. UNDER FORMER BELL AREAS, THEY USUALLY START AT 98XX (RIGHT BELOW THE 99XX OFFICIAL SERIES) AND MOVE DOWNWARD. SINCE THE LINE, NOT THE FONE, DETERMINES WHETHER OR NOT A DEPOSIT MUST BE MADE, DTF & CHARGE-A-CALL FONES MAKE GREAT EXTENSIONS! FINALLY, FORTRESS FONES ALLOW FOR A NEW HOBBY--INSTRUCTION PLATE COLLECTING. ALL THAT IS REQUIRED IS A FLAT-HEAD SCREWDRIVER AND A PAIR OF NEEDLE-NOSE PLIERS. SIMPLY USE THE SCREWDRIVER TO LIFT UNDERNEATH THE PLATE SO THAT YOU CAN GRAB IT WITH THE PLIERS AND YANK DOWNWARDS. I WOULD SUGGEST COVERING THE TIPS OF THE PLIERS WITH ELECTRICAL TAPE TO PREVENT SCRATCHING. TEN CENT PLATES ARE DEFINITELY BECOMING A "RARITY!" FORTRESS SECURITY: ------------------ WHILE A LONELY FORTRESS MAY SEEM THE PERFECT TARGET, BEWARE! THE GESTAPO HAS BEEN KNOWN TO STAKE OUT FORTRESSES FOR AS LONG AS 6 YEARS ACCORDING TO THE GRASS ROOTS QUARTERLY. TO AVOID ANY PROBLEMS, DO NOT USE THE SAME FONES REPEATEDLY FOR BOXING, CALLING CARDS, & OTHER EXPERIMENTS. THE TELCO KNOWS HOW MUCH MONEY SHOULD BE IN THE COIN BOX AND WHEN ITS NOT THERE THEY TEND TO GET PERTURBED (READ: PISSED OFF). EOF --- EOF I-01