TUCoPS :: Phreaking Technical System Info

TUCoPS :: Phreaking Technical System Info :: 9x_lmpt.txt
Latitude Meeting Place Teleconferencing

STATION ID - 7047/3.12

9x Datakit Network
FOR OFFICIAL USE ONLY

This is a 9x system, restricted to authorized persons and for
official 9x business only. Anyone using this system, network or data
is subject to being monitored at any time for system administration and
for identifying unauthorized users or system misuse. Anyone using this
system expressly consents to such monitoring and is advised that any
evidence of criminal activity revealed through such monitoring may be
provided to law enforcement for prosecution.

.-. .-=-. .-. .-=-. .-. .-=-. .-. .-=-. .-. .-=-. .-.
( * -={{{*}}}=- * -={{{*}}}=- * -={{{*}}}=- * -={{{*}}}=- * -={{{*}}}=- * )
'-' '-=-' '-' '-=-' '-' '-=-' '-' '-=-' '-' '-=-' '-'
LaTiTUde MeEtiNG PlaCE TeLEcOnfERncINg
.-. .-=-. .-. .-=-. .-. .-=-. .-. .-=-. .-. .-=-. .-.
( * -={{{*}}}=- * -={{{*}}}=- * -={{{*}}}=- * -={{{*}}}=- * -={{{*}}}=- * )
'-' '-=-' '-' '-=-' '-' '-=-' '-' '-=-' '-' '-=-' '-'
Aug'98

by Hybrid

Disclaimer: Although I hate this part, this file is for informational
purposes only. I will not be held responcable for your actions....
Here is an exert taken from an employee newsletter, advising employees of a
certain company about thier newly brought MeetingPlace system:

'For your privacy and company security please do not use easy passwords like
12345. SINCE THE MEETINGPLACE SYSTEM ALLOWS YOU TO DIAL OUT, IN ORDER TO
AVOID TOLL FRAUD IT IS CRITICAL THAT YOU CHANGE THE PASSWORD TO A NEW AND
SECURE 6-11 DIGIT PASSWORD.'

Intro:

Meeting Place is a powerful teleconferencing system designed to accommodate
up to 120 ports in any combination of simultaneous conference calls.
Meeting Place is not generally available to the public, it is designed to
be attached to eXtensions of corporations and companies that require a
private teleconferencing system to communicate with other employees and
associates. Meeting Place can also be found on some direct-dial 800 numbers.
Unlike other teleconferencing systems such as AT&T's Conference service,
Latitude Meeting Place is much more advanced, allowing multi-user
configuration and automated user interfaces. In this phile I will cover all
of the functions and features of Meeting Place, I will also describe how
to 'hack' a Meeting Place system, and gain control of the user-interfaces,
or profiles as they are more commonly called. But before I start I need to
make it clear that if you fuck around with a MeeingPlace system, you are NOT
messing with Bell or AT&T, Latitude MeetingPlace is designed to be installed
on the premisis of a company that requires a Teleconference system, so their
employees and clients can communicate more efectively.. If you over-use a
system the administrator WILL find out. Unlike AT&T conf service, where they
are used to illegal conf calls, a sysadmin of a meeting place belonging to
some small corp is not going to take to kindly to 120 people sitting on his
800 line, taking up his ports. The MeetingPlace Hardware server costs around
$30.000 dollars! Yes that's 30 thousand! So sysadmins do generally get VERY
PISSED if they realise thier system is being used by un-autharised users...
If you need to no more about MeetingPlace just visit Latitude's web site-
www.latitude.com.

Index:

-The Server Stack
-MeetingPlace Server Hardware
-MeetingPlace Server Software
-Digital Signal Processing, or DSP
-MeetingPlace Server Notification Agent
-Conference Scheduler
-Meeting Notes
-Voice Comments
-e.Documents
-Voice Processing Interface
-System Services
-MeetingPlace Conference Server Feature list, and optional features
-Integrated Voice and Data Conferencing
-How to find and 'Hack' a MeetingPlace Teleconferencing system
-The dial-in interface
-The user-profile interface
-The Conference Menu options
-Administrators Prompt Configuration Profile Interface
-Administration and Maintenance of MeetingPlace
-Further Notes and Conclusions

Notes on The Server Stack:

As a conference server, MeetingPlace establishes and co-ordinates multiple
voice connections for a conference call. The conference server can support
up to 120 ports in any combination of simultaneous conference calls. At the
same time MeetingPlace's client/server architecture allows users to
schedule meetings, access in-conference features, review previous meetings
and attach and retrieve documents from their desktops. I will cover these
lovely functions and features later. The server has 2 primary components:
server hardware and server software.

Notes on MeetingPlace Server Hardware:

The MeetingPlace conference server hardware utilises components such as
SCSI disk drives, EISA and MVIP buses and also a Pentium CPU. The system
utilises a distributed processing architecture, multiple buses, DSP/RISC
processing and a telephony grade power supply. The MeetingPlace conference
server provides interfaces such as T1 Trunking, analogue POTS lines and
Ethernet LAN connectivity so the whole system can be connected to existing
voice and data networks, i.e., PBXs. MeetingPlace connects locally to a
customer's PBX or directly to the telephone network as well as to the
customer's local area network. As a conference server, MeetingPlace
establishes and coordinates multiple voice connections for a conference
call through the public switched telephone network. Users are able to
access meeting features either through a touchtone interface available
from any telephone or through the graphical user interface provided by
MeetingTime, Latitude's Windows-based client software.

Notes on MeetingPlace Server Software:

The MeetingPlace Server software was coded in c++, and provides the
conferencing capabilities of the system. The software is composed of several
key modules:

Digital Signal Processing:

The system provides automatic gain control to amplify low-level speakers.
The DSP algorithms detect and remove DTMF tones from the conference call as
participants activate MeetingPlace functions,.. no more toners!. These
algorithms also remove any call progress tones (e.g. busy and dial-tone)
from the call. The DSP algorithms are so sensitive they remove constant
noise sources (such as people whistling) from being injected to the meeting.
The instant speaker algorithm recognises the current speakers and suppresses
noise from all other locations.

MeetingPlace Server Notification Agent:

The SNA constantly monitors meeting activity and automatically notifies
participants of meetings via specified fax, e-mail, outdial, or pager
numbers. If specified participants may be notified in advance of the meeting
by fax or email. At the time of the meeting, participants may be notified
via pager or outdial. The system can also notify attendees when changes are
made to previously scheduled meetings.

Conference Scheduler:

The conference Scheduler manages all of the resources of the system
(conference ports, meeting IDs, recording space) such that all meetings can
be held without conflict and that ports can be dynamically allocated to
meetings. The scheduler is configured by the system manager and determines:
how early participants may call into meetings, when participants are warned
about meeting and time, how users can extend their call, and when reserved
ports are released when no one shows up.

MeetingNotes:

Allows for the recording and storage of all relevant meeting materials:

Voice comments:

This software enables users to record meeting proceedings, record meeting
agendas and attach voice comments when participants cannot attend a meeting.
The system will provide up to 390 hours of voice storage.

Electronic Documents:

This software allows end users to attach files to a meeting for subsequent
distribution. These files may include presentation slides, spreadsheets or
word processing docs that will be reviewed during the meeting.

Voice Processing Interface:

This is the part of the system you will be interested in. A VPI, is a
simple to use, DTMF tone driven interface where users can schedule, attend
and manage their user profiles. The system has over 800 voice prompts and
provides instructions to assist end users in all aspects of their meetings.

System Services:

An integrated SQL Database running on an OS will provide all system
services. The internal voice file system is optimised for real-time use and
fast response time. The built-in licence management controls simultaneous
MeetingTime client software connections. An SNMP agent provides remote
monitoring services compatible with the MIB II specifications.

MeetingPlace Conference Server Feature List: (optional features)

MeetingPlace Data Conference Option provides integrated multipoint data
conference bridging for Microsoft NetMeeting and other T.120-compliant
endpoints.

MeetingPlace WebPublisher provides a web interface for scheduling, sharing
of meeting materials and access to recordings. MeetingTime client software
provides a Windoze or Mac graphical interface. MeetingNotes provides
integrated recording, file attachment and voice comment capabilities.
MeetingPlace Notification Option provides server software agent that
proactively queues messages for delivery via email and Fax gateway products.
MeetingPlace email gateway provides meeting scheduling and notification and
distribution of meeting materials via cc:Mail, Lotus Notes, MS Mail, MS
eXchange, and other MAPI-compliant and SMTP-based messaging systems.
MeetingPlace Fax Gateway provides notification and distribution of meeting
materials via fax. MeetingPlace FlexMenu provides customisable top-level
menus for the DTMF interface. MeetingPlace SNMP provides remote monitoring
capability from any SNMP management station. MeetingPlace Networked System
provides hardware and software to network up to 8 MeetingPlace conference
servers for centralised administration.

Integrated Voice and Data conferencing:

Working with MS NetMeeting or other data collaboration software,
MeetingPlace can unify voice and data conferencing capabilities into a
single meeting via phone and computer. MeetingPlace automatically brings
together multiple call-in participants and performs robust, high-performance
data conference bridging.

Setting up a data conference is easy. When users set up a MeetingPlace
conference, MeetingPlace automatically schedules the required voice and
data resources. To attend the conference, users simply click 2 buttons on
their web or MeetingTime client interfaces. Clicking the join voice
conference button rings their phones and connects them to the voice
conference. Clicking the join data conference connects them to the data
conference for real-time application sharing or collaboration. Now enough of
the bollocks,

How to Find and 'Hack' a MeetingPlace bridging system:

At the moment Latitude MeetingPlace systems are quite rare, but more and
more companies are purchasing the equipment all of the time. If you live in
the UK, like myself you could start scanning the 0800-96x-xxx, 0800-89x-xxx
exchanges for PBXs and direct-dials into MeetingPlace. If you live in the
US, just start scanning toll-free numbers. When you stumble upon a PBX, try
dialling various eXtensions or even dial 0 for the PBX operator and bulshit
him/her into giving you the eXtension of the conference bridge. You will
know when you have found a MeetingPlace Conference Bridge, because when you
dial into the 800 number/eXtension an automated generic Female voice will
say:

" Welcome to MeetingPlace. To attend a meeting press 1, to access your
Profile press 2... "

Here are the options you will be confronted with:

Main Dial-In Menu:

1- Attend a meeting

When you access this option you will be prompted to enter the meeting ID, in some cases a passcode is also required. You will then
be prompted to record your name so other meeting participants know
who you are when you enter the meeting.

Tips: To find valid meeting IDs, that other people have set up, hit
option 3 at the main dial-in menu (meeting notes) and just
plug in random numbers or try things like 1234 etc. If you
wish to remain anonymous, just hold down # when the system
prompts you to record your name. If you hit #43 the second you
enter a meeting, no one will be able to kick you.

2- Access your profile

When you access this option you will be asked to enter your profile
number. A profile number will give you access to multi-level user
options, i.e.- Set meetings up, edit scheduled meetings, listen to
recorded meetings and many other things. Generally on a large system
employees will be given their own personal profile number so they
can set up meetings when they want. Most profile numbers will be
clustered together and will have a default passcode. What you are
looking for is a profile that has no recorded name assigned to it.
This can be achieved by scanning for valid profiles, when you have
found a valid profile you will hear " You entered [Terry Fuckwitt],
enter your passcode followed by the pound sign. " From here you scan
up and down from the valid profile until you hear " You entered
[xxxx], enter your passcode followed by the pound sign. " This is
where the fun starts, you will have to guess the default passcode.
The default passcode for all MeetingPlace systems is the same as the
profile number, but on some systems the administrator (profile 0002)
would have changed it, try things like 1234, 1111, 4321 etc., note:
If the profile is 4 digits long it doesn't mean the passcode is.
When you have guessed the default passcode you can access any unused
profile on that system and set up teleconferences anytime you want.

Profile Notes:

Always remember to edit the meeting posting notes option so that
meeting details are not automatically posted to other users on the
system. Never over-use your profile, remember the system admin can
see what profiles were used to set up meetings. Try to keep your
profile anonymous by holding down # when it prompts you to record
your name. Do not get greedy and take loads of profiles, you only
need one- the admin will notice a rise in system use.

3- Review meeting recordings and meeting notes

This option will allow you to listen to any recorded meeting, this
can be useful when you are trying to learn more about the company
that uses the specific MeetingPlace system.

9- Hear an overview of MeetingPlace functions and features

This option will describe to you all of the functions and features
of MeetingPlace- For the terminally stupid.

Dictation of MeeingPlace Functions and Features:

2- Profile Main Menu:

[1] Attend a meeting

Prompts you to enter the meeting ID (You can attend a meeting via
your profile number -not
advisable)

[2] Schedule, re-schedule or list meetings

1- Begin a meeting immediately (on some systems this is disabled)

1- Have an immediate meeting with restricted time and people
2- Have a longer immediate meeting with more time and people

2- Schedule a meeting for a future date or time (Remember not to
schedule meetings
to much in
advance, and also
bear in mind the
time-zone the
system is located)

3- Re-schedule, review or delete meetings (You cannot kill a meeting
once it has started)

4- Get a list of the meetings you are invited to

1- Hear the list over the phone

(This will give you a list of meetings that other
people have set up via their profiles, it is
* imperative that you disable the meeting notes
posting option to prevent your meeting details from
being posted to other profiles. On all systems the
meeting posting notes option is activated)

[3] Change profile settings or meeting preferences

1- Change profile settings

1- Change the passcode for your profile
2- Record a name for profile
3- Select a proficiency level of voice prompts

1- Un-abbreviated prompts
2- Abbreviated prompts

4- Enter your phone number (don't be stupid)
5- Enter your fax number (not advisable)
6- Change how you attend meetings

1- Dial into MeetingPlace
2- Have MeetingPlace call you at time of meeting

(The system can phone/fax you and add you to
a meeting you schedule - not advisable)

2- Change meeting preferences

1- Change entry and departure options

1- Change announced entry options
2- Change announced departure options

2- Change security options for all meetings you schedule

1- Change meeting passcode options
2- Change the screened entry option

3- Change meeting notes options

1- Change recording options
* 2- Change meeting notes posting options

3- Record a team name

[4] Review meeting recordings and meeting notes

1- Hear a meeting recording

1- Rewind
2- Pause
3- Fast forward
*- Stop playback
#- Continue playback

2- Hear a roll-call of meeting participants

5- Access meeting comments

1- Record a meeting comment

7- Get meeting info

1- Hear info about a recording

*- Select a different meeting

When inside a meeting all participents have access to many functions such as
dial-out, break-out etc.

Meeting Functions:

[0] Reach assistance (will transfer you to the company operator)

[1] Enter a break-out session

(This will allow you to break out from the
main meeting and talk privately with other
participants, break out sessions can also
be locked. The break out sessions range
from 1-9)

[2] Hear a roll-call of meeting participants

1- Get a list of all of the meeting participants

(By accessing this option MeetingPlace will
play back the recorded names of everyone on
in the conference, and also who was last
speaking)

[3] Add someone to the conference (sometimes disabled by the administrator)

1- Dial a specific phone number

#1- Add the called party to the meeting

(They will be asked to record their name)

#2- Disconnect the called party (they will be informaed they
have been discconected)

2- Get all persons from a team

(if other people have profiles they can be
contacted by entering their profile number,
if they have specified a phone number in
their personal profile the system will call
them and add them to the meeting)

3- Get all missing invitees (will call ALL profile users that your
meeting details have been posted to.
- not advisable)

[4] Meeting admittance options

1- Lock/Unlock meeting
2- Admit the party requesting entry
3- Disconnect the last meeting entrant
4- Return to a lecture style meeting
5- Move all listeners to the waiting room
*- Rejoin meeting

(if you lock your meeting all people inside
the meeting will be notified if someone
requests entry to the meeting, you can
either admit them entry or ignore their
request, they will be forced to listen to
extremely bad taste music until you admit
them, remember someone has to stay in the
main room to admit people if you activate
this feature)

[5] Mute your phone (this is very useful if there are alot of people in your
meeting and some people have a bad line. This option
will eliminate all line noise from your phone line,
to undo this option and speak, just hit #5 again)

[6] Recordings/Comments and other MeetingNotes options

1- Start/Stop recording (participants will be informed that the
meeting is being recorded)

2- Hear meeting name

4- Record/Delete or listen to meeting messages

1- Record a meeting message for all participants to hear

(This option can get extremely annoying if
people keep recording meeting messages, to
skip a lame meeting message just hit *)

[7] Q&A Options (for a lecture style meeting)

1- Get in line to speak
4- Get your position in line (Q&A can be used when you have loads
of people attending your meeting,
40 people all speaking at the same
time can get a bit hairy)

[8] Disabled (admin functions?)

[9] Exit meeting and return to main menu

[*] Rejoin the meeting

Administration notes:

On all systems there will be Administration Profiles, I have only managed
to crack the following admin profile:

Administrators Prompt Configuration Profile Menu:

[9] System manager options

1- Listen to or record voice prompts
(on the system I cracked prompts range between 3 - 1298)

1- Standard un-abbreviated prompts
2- Standard abbreviated
3- Listen to or record system prompts
4- Listen to or record custom prompts
5- Select a different prompt

2- Listen to or record flex menu prompts
} On some systems
3- Test a flex menu application

The administration profiles will have different purposes, some allowing the
user to listen and delete meeting recordings, some will allow the user to
edit the system prompts as dictated above. Theses profiles always range in
the following order:

0001 - engineer
0002 - administrator (The admin profile will give you complete
0003 - ? control over the whole system, when an
0004 - ? administrator attends a meeting via his/her
0005 - ? profile they can do anything they want -
i.e., if the dial-out feature is disabled
they can dial out, they can also attend a
meeting without being noticed, they can
even mute/un-mute your phone. If an
administrator attends a meeting the #2 roll
call option is usually disabled. Basically
if you can access the admin profile you
effectively gain ''root'over the whole
system)

An admin profile is the ultimate thing to hack on a MeetingPlace system...
If you own one of these (0002) you will own the WHOLE system... I have
noticed in various conferences that if an admin attends through the admin
profile they can drag people to break-out sessions etc, and even disable
all of your tone controls and lock you in there! You know if an admin is
present in a conf because they may mute your phone... When you try to unmute
it it will just keep saying 'muted' all the time. Also if you get
dissconnected and you wern't the last person in, the admin would have kicked
you..

Final Notes:

If you get the suspicion that the admin has found out about your confs, do
yourself a favour.. Don't set anymore up! Let some other lamer do it.
Remember that the admin gets a fax or email from the conf server EVERY time
a conf is scheduled, even if you have disabled the meeting posting notes
option. If you want your system to last a long time don't set to many up in
any one week, limit how many people turn up on your confs and don't drop
numbers on IRC.

WARNING! The administrator can get ANYONES ANI if you dial in direct, don't
be a fool... Use a bunch of PBX's to dial in, the last thing you wan't is a
phone call from a pissed off system admin!

If you can't get into a profile, just gatecrash someone elses meeting, ie-
If you found a meeitng that was scheduled from 6pm - 8pm on a Friday night
don't tell anyone about it, drop into the meeting 5 minutes before it starts
Sit there throughout the whole legit meeting, when they have ALL left, lock
the meeting, and tell whoever you want to attend the meeting... The meeting
will autoexetend all weekend. I had a conf that lasted for 5 days!

Final Tips on how to keep your system alive:

- Whenever you get a profile always note down all of the other conf ID
details other people have scheduled.. This will help you map out when
the system is used. ie- If you want a long conference it is a good idea
to schedule it when it appears that there is no-one else using the system.

- Don't let other people take over the profiles.

- Don't over-use 1 profile

- Don't use your system to dial out

- Don't schedule Meetings for excessive amounts of time -ie 24hrs, just
schedule it for like 1hr, it will auto-extend for days!

- NEVER drop into a legit conf and start hurling abuse at the attendess,
they WILL tell the admin and passcode protect all their scheduled
meetings.

Anyway that's ya lot. You can now hold your own teleconferences for your
own sinister purposes. I am currently working on a more detailed phile for
MeetingPlace teleconferencing, watch this space. If anyone has anything to
discuss about this phile and its contents email me at the following address:

hybrid@darkcyde.org g0d@deathsdoor.com or leave me a voicemail...
UK- 0800-962-481 hit 6 box 2007. US- 1-800-334-1017 hit 6 box 2007.

Shouts :]

The whole of DarkCYDE:

PUBLiC_NUiSANCE - NitrousOxcyde - Red_LED - uV - r00fies - gr1p - SinTax -
Barakis - Onion - VHF - DoeBoy - Mistress - Zomba - Red_Mist - AC-3 - Loco -
FireStarter - Firestart - Elf - DownTime - Aqua - Zer0nine - Sil - Force -
Chimmy - Dougal - Violator - Photek7 - TurboMan - AcidKill - Nommo - vLad -
k-os - Hi-Tek - RepoMan -

The whole of Twisted Nickel:

Digital_Fokus - Zer0_Divide - Nothing - High_Voltage - SIM - Vile - DeadKirt

Other shouts:

UK-h, 9x, Seven7, C00lio- thanx for the info, ICBM, Asphyxia, R0xs, AT&T,
Ironica, British Telescum.

;7)

-Hybrid

___ ___ _____.___.____________________ ____________
hybrid@b4b0.org / | \\__ | |\______ \______ \/_ \______ \
hybrid@ninex.com / ~ \/ | | | | _/| _/ | || | \
hybrid.dtmf.org \ Y /\____ | | | \| | \ | || ` \
---------------- \___|_ / / ______| |______ /|____|_ / |___/_______ /
\/ \/ \/ \/ \/