TUCoPS :: Phreaking Public Phones :: mill_i~4.txt

Nortel Millennium - The payphone for the next 1000 years, by miind

    =-------------------------------------------------------------------=
    | NorTel Millenium: The payphone for the next 1000 years - by miind |
    =-------------------------------------------------------------------=

Those NorTel Milleniums that are being bought in hordes by the RBOCs and put 
up everywhere are really a work of art. At first look, they might appear to 
be a bad idea in high vandalism areas, but they are actually very tough.
 
The bodies are built with 1/4" reinforced steel, and they employ a 2-way dual
locking system. First of all, the coin box and the logic box are locked 
seperately. Secondly, they use a 4-pin Medeco(tm) lock with a notched T-Bit
bolt.
 
The 4-Pin Medeco lock for the coin box is on the lower right side of the 
phone. This must be unlocked, before the T-Bit located on the front of the 
coin box can be turned to open the box.
 
The 4-Pin Medeco lock for the logic box is on the upper left side of the 
phone. As with the coin box lock, this must be unlocked before the T-Bit 
which is also located on the upper left side of the phone can be turned. Once 
this is done, the logic box opens from top to bottom. That is, the part of 
the phone that includes the card reader, handset, keypad, display, and RBOC 
logo, flips down. The hinge is located just under the card reader.
 
Oh, a little note about the Medeco locks. Only 4 pins, you say?!? Well you 
can almost forget about trying to pick them. Medeco locks are special, in 
that not only must the pins be raised a certain amount, but they must also be
rotated a certain amount. This rotation can be clockwise or anti-clockwise.
And also, both Medeco locks are keyed differently for security purposes.
 
How these phones operate is quite unusual. The days of ACTS and its variants
are gone. These new breed of phones operate on the COCOT principal. I 
sometimes call them BOCOTs. The phone itself is responsible for billing. Not
only for local calls, but for long distance and overseas calling as well.
 
When you pick up the handset on a Millenium and hear a "dial tone", it is not
really a dial tone you are hearing. It is mearly a fake dial tone that the
phone produces. After dialing your number, the phone then decides on what 
sort of call it is. Is it local, long distance, or overseas. If it is a local 
call, then a synthesized voice asks for the $0.25 and the display also 
prompts for the money. Once the money is in, the phone picks up the real line
that it is connected to, and then re-dials the number that you entered into 
its memory. The call then goes on as normal.
 
If it is a long distance call, the phone checks it's rate table for the 
current rate based on time of day, day of week, and mileage to destination 
CO. It then asks for the appropriate amount of money and continues as with a
local call. The same goes for an overseas call.
 
Now, stuff gets a little trickier if you plan to use a card to bill the call.
Milleniums are equipped with both a magnetic strip reader AND a smart card
reader. However, not all RBOCs have issued smart cards. Bell Canada 
(Ontario/Quebec) has for sure, but as for the others, I'm not sure. I do know 
that BC Tel doesn't have a smart card planned until mid '98, at the least.

Anyways, after you dial your number, you are asked to put in your money or
enter your card into the slot. If you opt to enter your card into the slot,
the phone reads in your card data. It then takes the real line that it 
is connected to off-hook and proceeds to call it's predetermined credit card
authorization center. After authorizing your card, it hangs up, then  
re-seizes the line and proceeds to dial the number that you have entered into
its memory.
 
A word about authorization. In Canada, where Stentor owns DataPac AND the 
RBOCs, it is possible to use real-time credit card authorization even for a
$0.25 call. That means that your card better be valid, or it will fail 
authorization. However, in the USA, where de-regulation has been widespread,
an authorization costs about $0.50 for the use of a public switched network
such as telenet. It doesn't make sense to spend this much money to 
authorize a call that is only going to cost the customer an average of 
$2.30 for the first minute, and about $0.60 for each additional minute.
 
At least that is the way the RBOCs in the USA think. Because of this, credit 
card authorization is not in real time. Therefore, if you have a magnetic 
strip writer, you could write a valid Visa number to an old strip, and use it 
in a phone to call anywhere in the world for free, and without the annoying 
prompt for more money every minute. I have tried this in Seattle (USWest) on 
one of their Milleniums and it worked fine. However, in Canada, it won't 
work. The card number that you write to the card MUST be a REAL ISSUED 
number. Of course, these aren't TOO hard to come by, now are they?
 
There are lots of more things to be learned about these new Milleniums for
me and the rest of us, so get hacking! These are THE phones that will take us 
into the next millenium. There are things to be done with the keypad, but I 
don't know enough to write about that at the present time.

A note about boxing Milleniums:

Well, they come in a box. The box says "Millenium, The Power Within". The box 
also has a few other markings like the serial number and warranty date and 
the like, but other than that, it's just a plain old cardboard box.

As far as "boxing" a Millenium, Red Boxes are out because ACTS isn't used.
Magenta Box is out, because the microphone isn't being muted to deter Red
Boxing. White Box is out because when you initially dial the number on the
keypad, it is NOT the DTMF tones that are being stored, but rather the actual
keystrokes. Playing DTMF tones via a White Box into the mic to dial a number
won't work because the phone isn't listening to the tones, just waiting for
electrical pulses from the keypad. A buttset (Beige Box, if you REALLY want
to call it a "box") will work if you can find the pair either in a SAC, or
from the drop above or below the phone, but hey, that works on ALL payphones.
I can't really think of any other conventional "colour boxes" that would be
any use on a Millenium though.

1998

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH