From twpyhr@mindspring.com Fri Apr 13 20:22:49 2001
Newsgroups: alt.2600,alt.phreaking,alt.2600.phreakz
Subject: Re: Entry System in new appt. complex
From: "Jenn" <twpyhr@mindspring.com>
Date: Fri, 13 Apr 2001 22:22:49 -0500

NOT A FINAL COPY
___________________________________________
Poking Around A Tele-Entry System
By: Jay E eNn eNn
For:
The Web Page You Have Reached
Hundreds of telephone sounds and clip art, interesting phone numbers, the
phoney dance, the unofficial touch tone tunes faq and more!
http://www.twpyhr.com
___________________________________________

What equipment was used:_______________________


1. (Not sure if this is the exact model)
Wall Switch Reader - 4" read range - Black or Beige or
White. (221-505)

About 5"x5"x3". Black square mounted on wall.

2. Amtel Standard proximity tags for keyrings. (223)
http://www.amtel-security.com/products/accesscontroldevices/proximitytechnol
ogymotorola.htm
   ____
 '    o    '  About 1/8" thick. Grey with hole for keyring.
  \       /    Had a 6 digit number printed in pink on back.
    \__/

3. Amtel TeleEntry 2000
http://www.amtel-security.com/products/telephoneentrysys/a9-1products.htm
PDF File With More Indepth Info
http://www.amtel-security.com/cutsheetsnap/products/telephoneentry/te2000.ht
m

Keypad and headset looked like payphone keypad and headset. Had an black on
green backlit LCD display. Forget what it displayed before anyone picked up
the phone but would print numbers dialed as dialed. Had visor over display
to reduce glare and prying eyes, I suppose. If I remember correctly,
instructions were printed on the actual unit.


4. Closed circuit television surveilence which worked only
with cable (Americast (http://www.ameritech.com/content/0,3086,6,00.html)
(Unknown type model)

Camera pointed at TeleEntry 2000. If I remember correctly it used channel 3.

Location:____________________________________

200 Arlington Place Apartments, Arlington Heights, Illinois


Basic Description Of Use:_______________________

o Residents

To unlock the entry doors (not individual apartment doors) from the outside
of the building, residents would use the wall switch reader and proximity
tag. They would wave the tag in front of the wall switch reader and the door
would quietly buzz and unlock for about 8 seconds.

o Visitors

They would look at the TeleEntry 2000 fumble with it and THEN read the
instructions (heh). But seriously.. They would look up the three digit
"extension" (not really but best analogy I could come up with) on the
directory on mounted on the wall (not computerized) corresponding to the
resident they want to reach, use the TeleEntry 2000 to dial that code, the
resident would then press 7 or 9 to remotely unlock the door, the door would
quiety buzz for 8 seconds and automatically unlock.


Discoveries__________________________________

When a visitor would 'call' from the front door using the TeleEntry 2000,
(847) 506-1230 (This is from memory from 3 years ago so don't quote me)
would appear on the caller ID.  At the other end of this number was a modem.
When someone was connected to that number, when visitors picked up the
handset of the TeleEntry 2000 downstairs they could hear the modem and were
unable to use the TeleEntry 2000. When dialed into the modem (at 7-e-1 I
believe, but again.. memory.. 3 years ago), the output would look similar to
the following (memory.. 3 years ago.)

102398 11:51:23 123456 3

The first number was the date. Any single digits were preceeded with a zero
(IOW, March is month 3 and would be seen as 03)

The second number was the time in hh:mm:ss format.

The third number was the six digit number printed on the back of the
residents proximity tag.

The fourth number was the door number. For this building (may be different
with others)
1 was the front door
2 was the back door
3 was a side/back door


If a visitor 'called' a resident with the TeleEntry 2000  whose phone line
was busy, they would hear the busy signal as well as the name and number
delivery ad for Ameritech one would hear as they made a regular phone call
with a regular phone (http://twpyhr.multiservers.com/nandn1.wav)

If I remember correctly, when you picked up the handset on the TeleEntry
2000, you would hear a normal dialtone and not a pbx 'dial tone.'

There was a code the mailman used to dial into the TeleEntry 2000 to open
the door without being 'buzzed in' by a resident. Never got around to
shoulder surfing it.

Sometimes when you dialed the number that showed up on the caller ID for
calls from the TeleEntry 2000, instead of hearing the modem, you could
eavesdrop :)

I still have a proximity tag somewhere... If I find it, I'll dissect it and
take pictures.