💾 Archived View for gemini.spam.works › mirrors › textfiles › phreak › PAYPHONES › coinop.rdt captured on 2022-07-17 at 11:04:12.
⬅️ Previous capture (2022-06-12)
-=-=-=-=-=-=-
Straight from the Bellyard: Coin Services Update
By: Brian Oblivion
-=Restricted -=Data -=Transmissions
"Truth is cheap... but information costs."
Public Telephones, we all know them, and how vulnerable they are
to fradulent abuse. Well, so does Bellcore and New England
Telephone and they have come up with a few methods of how to combat
fraudulent users.
Coin deposited by a typical patron of the public telephone are
communicated to the Stored Program Control System (SPCS) or Operator
Services System (OSS) by bursts of certian dual-tone signals. These
signals consist of the two frequencies 1.7 KHz and 2.2 KHz simul-
taneously, which are detected in end-office and tandem-office environ-
ments to provide accurate coin deposit detection.
There are two types of interference that are encountered by outside
origin. These are talkdown and talkoff. Talkdown is the failure to
recognize a valid dual-tone signal because of interference from
superimposed speech or other noise that may be from either the
originating coin line or the terminating end. Takeoff is the false
acceptance of speech, music, or background noises as valid coin
deposits. This obviously includes redbox tones, whistles, tape
reproductions, etc.
In order to combat this erroneous acceptance of false credit the
following methods have been defined and are to be employed.
Frequency Limits:
The detector must accept dual-tone signals if the frequencies
of both tones are within +/- 5% of their respective nominal
values of 1.7 KHz and 2.2 KHz. The detector must also reject
dual-tone signals if the frequency of either or both tones is
offset more than +/- 3.5% from its nominal value.
Frequency offsets of +/- 1.5 percent are the extremes expected from
properly designed and maintained coin telephones. The +/- 3.5 percent
constraint is imposed to minimize the width of the stop-band notch
filters in anti-fraud notch filters.
Signal Power and Twist:
The detector must accept dual-tone signals if the individual
power levels of both tones are within 0 to -25 dBm0 and within
5 dB of each other. (Twist is the dB difference between
power levels of the two tones of a dual-tone signal)
The detector must reject dual-tone signals if the individual
poser level of either or both tones is below -30 dBm0.
The range 0 to -25 dBm0 is the maximum expected from properly designed
and maintained coin telephones and loops. The -30 dBm0 limit is
imposed to minimize the depth of the stop-band needed in anti-fraud
notch filters.
Pulse Timing
Nickels, dimes, and quaters are represented by one, two, and five
dual-tone TONE-ON pulses. The dollar signal is represented by a
single long pulse. Each pulse is followed by a TONE-OFF interval.
The following chart shows the timing specifics for all coin generated
tones.
+----------------------------------------------------------------------------+
| |Within-Coin |End-of-coin Tone OFF (ms)|
|---------------------+-------------+-------------+-------+------+-----------|
| | TONE-ON (ms)| TONE-OFF(ms)| Must | Must |Allowed to |
| | Must Accept | Must Accept | Accept|Reject|Acc. or Rej|
|---------------------+-------------+-------------+-------+------+-----------|
| Nickel | 1 Pulse | 35 - 160 | ---- | >175 | <160 | 160 - 170 |
|---------+-----------+-------------+-------------+-------+------+-----------|
| Dime | 1st Pulse | 35 - 160 | 25 - 110 | | | |
|---------+-----------+-------------+-------------+-------+------+-----------|
| Dime | 2nd Pulse | 35 - 160 | ---- | > 75 | < 60 | 60 - 75 |
|---------+-----------+-------------+-------------+-------+------+-----------|
| Quater | 1st Pulse | 20 - 100 | 20 - 110 | | | |
|---------+-----------+-------------+-------------+-------+------+-----------|
| Quater | 2nd Pulse | 20 - 60 | 20 - 60 | | | |
|---------+-----------+-------------+-------------+-------+------+-----------|
| Quater | 3rd Pulse | 20 - 60 | 20 - 60 | | | |
|---------+-----------+-------------+-------------+-------+------+-----------|
| Quater | 4th Pulse | 20 - 60 | 20 - 60 | | | |
|---------+-----------+-------------+-------------+-------+------+-----------|
| Quater | 5th Pulse | 20 - 100 | ---- | > 75 | < 60 | 60 - 75 |
|---------+-----------+-------------+-------------+-------+------+-----------|
| Dollar | 1 Pulse | 600 - 700 | ---- | > 75 | < 60 | 60 - 75 |
|---------+-----------+-------------+-------------+-------+------+-----------|
| Note: The detector is allowed to accept or reject tone-on and within-coin |
| tone-off durations outsie their repective must-accept ranges. |
+----------------------------------------------------------------------------+
Methods of controlling talkdown and talkoff.
Talkdown, is more of a transmission error problem that is generated
by interference from superimposed speech or ambient noise. This
noise comes from the originating coin line or from the terminating
end. Talkdown results in the failure of the detector to recognize
a valid dual-tone signal.
One of the main sources of talkdown is the improper muting of the voice
path during tone generation. This antenuated speech or ambient noise
power is superimposed on the coin signals which corrupts the signal.
Muting is accomplished by shorting out the speech path with a cap-
acitor. Minimum muting attenuation is 15 dB at 300 Hz, 25 dB at
1000 Hz, and 35 dB at 3000 Hz. The attenuated speech or ambient
noise power is superimposed on the coin signals which could cause
talkdown.
Some talkdowm is also generated from the called party, operator
speech, or automated announcements. These signals can only reach
the detector by reflection through the transhybrid path at a 3-to-4
wire junction, which is usually located in the originating end
office.
Talkoff
Talkoff is the false acceptance of speech, music or background
noises as valid coin deposit signals by a detector. This is
what registers a valid deposit when no actual money is deposited.
In order to combat, a few countermeasures are to be employed.
o The call must be terminated or routed to an operator if the
total amount due for an initial deposit or a subsequent deposit
has been received within an overall session timeout period.
o The overall session timeout must be an adjustable parameter with
a default value of 45 to 50 seconds.
Intentional talkoff can be induced by playing loud music into the
coin telephone by doing this one hopes to get the detectors to produce
too many talkoff clusters. A talkoff cluster is a group of talkoffs
occurring within any 5-minute interval. Single quater or dollar
talkoffs are also included in this definition of a cluster. In order
to combat this the following measures are being taken.
o Total talkoffs must not exceed 12 dollars in 70 hours of continous
speech or music at a volume leve of 0 vu referred to 0 TLP or,
instead, at an active speech level of +1 dBm0.
o The detector must not produce more than 12 talkoff clusters that
exceed 20, or 40, or 95 cents in 70 hours of continuous speech or
music at a volume level of 0vu referred to 0 TLP or, instead, at
an active speech level of +1 dBm0.
o Total talkoffs must not exceed 2 dollars in 200 hours of continuous
speech or music at -17 vu referred to 0 TLP or, instead, at an active
speech level of -16 dBm0.
Coin-Operated Telephone Fraud
Fraud is possible by acoustically coupling accurate coin deposit
signals into the mouthpiece of the originating coin telephone, or
from the called party end. Fraudulent signals comming from the
coin telephone end can only be stopped within the coin telephone
with a notch filter to filter out any external fraudulent signals.
In order to combat Fraudulent usage the following will be enacted.
o End- or tandem-office switching systems will be equipped with
detectors that monitor signals from the originating coin line.
The following methods combat far-end fraud:
o Sensing the direction of received coin signals and only reg-
istering those comming from the coin line.
o Increasing the transhybrid path loss (using echo cancelers to
knock down the fraudulent signals signal strength to that under
the detector's recognition threshold.)
o Inserting a 2200-Hz notch filter in the voice transmission path
from the far end only when the detector is expecting coin deposits.
The filters 3 dB bandwidth must be less than 600 Hz centered on
2200 Hz. and the out-of-band attenuation below 1500 Hz and above
3000 Hz must be less than 1 dB.
The BOC's are now taking action against 'Redboxing' as well as
agains some of their own equipment defects. It was only a matter
of time, of course. I have no idea how long this conversion will
take nor if it has yet started. There has been some indication
as some start of a anti-fraud campaign in my local area. I have
gotten word from some people that coin operated telephones have
not been accepting tones. I am unaware if these machines were
BOC operated or if they were COCOTS. I believe them to be BOC
coin operated telephones. Use it while it lasts. ;)
Brian Oblivion
@ Black Crawling Systems
@ atdt.org
The following has been a presentation of...
Restricted Data Transmissions
-=R -=D -=T
"Truth is cheap... but information costs"