==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==
				==Phrack Inc.==
		    Volume One, Issue Three, Phile #2 of 10
==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==

  The purpose of this file is to tell you what you would be dealing with if you
stumble across this system, or if you know of a company that is using this
system.  It doesn't go into incredible detail, and is lacking in areas.  It is
not a guide to hacking into it, just letting you know what you would be dealing
with.  This is to pique your interest in the system.

   So What the Hell is ROLM?
   -------------------------

  ROLM is a "Business Communications System" bought by IBM a few months ago, in
an effort to compete effectively with AT&T, and get a larger share of the
market, in a grand master plan to become "Big Daddy Blue" as opposed to "Ma
Bell".  It is a very complex system, with features such as PhoneMail, A
Super-PBX, Local Area Networks, Public and Private Data Networks, Desktop
Communications, and Call Management.

  The heart of the system is the Controller, called the CBX <Computerized
Business Exchange>.  This controls the entire network accessible through ROLM.
Since 1983, the CBX was redesigned and upgraded to the CBX II.	It is a PBX
with much much more <See 'Introduction to PBX's' available on your local bbs>
to offer, and that is ROLM's claim to fame.  It is light years ahead of the
regular PBX system.


    The CBX II
    ----------

  The CBX II is the core of the ROLM network.  It is computer driven and
expandable from one node, with 165 channels, to 15 nodes providing 11,5200
2-way channels.  The smaller business could have a model with a 16 user maximum
limit, but it can go up to 10,000 users, though this would be quite rare <and
quite God Damn expensive!>.  It can be accessed from outside lines <like you>
as well as HardWired units, with a switching system to prevent busy signals on
a port.  Speed depends on the system in place, either the newer, faster ROLMbus
295, or the older standard ROLMbus 74.	<see Service manuals for exact details>
The larger the system, the faster as well.  It is adjustable to accept
different bandwidths for the various components, such as Telex, Voice, Data,
Mainframe, LAN, Video <ta-da!  Picturefones in reality!>, and anything hooked
up to the system.  Similar tasks can be bunched onto one channel as well, at
high or low speeds.  If multiplexing is used <above>, the maximum speed is
192,000 bps, and if using a single interface, the top possible rate is a
mindboggling 37,000,000 bps, which if you ask me, if just fluff and not too
practical, so they are usually multiplexed.  <Now, what a difference that is
from 300 baud!>.  Using the CBX II network, you might find just about any kind
of mainframe, from HP, to DEC, to VAX, to the IBM 327# series.

   Note : There is a smaller version of this called the VSCBX.


    Phone Mail
    ----------

  This is one of the little beauties of the system, something truly fun to fuck
with.  I called ROLM Headquarters in California to ask specific questions about
ROLM, posing as a researcher, and I got the big runaround, transferred from
department to department.  Maybe you can get further than I.  Their # is
408-986-1000.  The # to PhoneMail from the outside is 800-345-7355.  A nice
computer-generated voice comes on asking you to enter your Extension number
<which each employee has>, and then enter the "#" sign.  Then enter your
password.  If you make around 3 or 4 bad attempts at an Extension of Password,
it will automatically ring another number, assistance I assume, to find out why
there has been an unsuccessful entry attempt.  I haven't played around with
this that much, so leave mail to Monty Python with whatever you find.  Once
entering an authorization # with correct password, you will be presented with
more options, leave messages to other people, and whatnot.  You can hear your
messages, forward them to another person, leave the same message to more than
one person, change your welcome message, etcetera.  The service is for those
business-type pigs who never sit still for one minute, like they are
permanently on speed.

     A Phone Mail Scenario
     ---------------------

  Let's say if Mr.  Greed goes out to meet his secretary at a motel, but
definitely has to get that important message from Mr.  Rasta, who's bringing in
$3 mil in FLake, and can't trust it to the person who would handle it <ie:  the
person filling in for his sec with the tremendous tits who is getting balled by
the dirty old fat man>.  Mr.  Greed would have given Mr.  Rasta his phone # and
he would be forwarded to the Phone Mail network, where he would hear a message
left my Mr.  Greed, to anyone who would call.  Mr.  Rasta would leave his
message and hang up.  Then Mr.	Greed could call up the 800-345-7355 #, punch
in his extension authorization number, and password.  Or, if he was back at the
office, he could get it there through DeskTop communications.  Messages can be
delivered without error, in the person's own voice, without other people
knowing about it.  Therefore, someone with enough knowledge could use an unused
account and use it as his own service, without the knowledge of others.

    DeskTop communications
    ----------------------

  ROLM has developed a Computer/Telephone integrated device for use with the
Desktop communications.  It is linked with the CBX II through fone lines, thus
accessible by you and me from the outside.  It is not hardwired, though it can
approach hardwired speed.  If you could get your hands on one of these
computer/fones then I think you would have found something very useful at home,
in your general life.  But you could access the network without the special
features of the fone, like one touch dialing, which is designed for the stupid
lazy businessman.  You can access company databases through the network,
mainframes, other people, just about anything as if you were right there and
told your secretary to do it for you.  There is special software used by the
computers or computer/fone but it can be improvised and is just an aid.  It
uses a special protocol <Don't know what, try to get your hands on one by
trashing a sales office>.  What is great is that everything is tied together
through telefone lines, and not RS-232C!  Thus, there is an access
port....somewhere.  Scan the #'s around the office # using ROLM.  How do you
know if it is using ROLM one way or the other.	Compile a list of local
businesses, call them up saying "This is ROLM Customer Support.  We have a
report of a complaint in your CBX II network, let me speak to your supervisor
please." If they say "ROLM?  CBX II?  We don't use that" then just apologize
and go elsewhere.  Or say that you are from ROLM corp and would like to know if
the company is interested in using it to network its system.  Like, if they
have it already, they would say that they had it.  And if they didn't, you
would just give them a fake # <or if you're nice the # for the local sales
office obtainable in the list below>.

  But you know what's REALLY Great?  They have made the network link in mind
for the person with a Computer IQ of about 0.  Commands are in plain English.

Here is a demonstration screen as seen in their brochure:

	   CALL, DISPLAY or MODIFY

	   Display groups

	   ACCESSIBLE GROUPS:
	     [00] PAYROLL	[01] MODEM	 [02] IBMHOST
	     [03] DOWJONES	[04] DECSYSTM	 [05] MIS-SYSTM
	     [06] DALLAS	[07] SALES

	   CALL, DISPLAY OR MODIFY?
	   Call Payroll

	   CALLING 7717  <which would be the ID code for the PAYROLL file>
	   CALL COMPLETE

	   **PAYROLL SYSTEM** <or whatever they want to call it>
	    ENTER ACCOUNT CODE:

  See, nothing is confusing, everything pretty self-explanatory.  There may be
more than one person wanting to do the same thing you are, so if there is, you
would be put on a queue for the task.  It seems that those with an IBM would be
best suited for ROLM hacking, because ROLM is owned by IBM, and the PC's used
by the network are IBM.  A person with a simpler fone/Terminal couldn't access
something like their DEC mainframe, or something like that.  By calling in, you
could not run an application, unless you had a special interface, but you could
access the database, which any dumb terminal could do.

  However, there are security levels.  Thus one with a privileged account could
access more things than one without it.  Like Joe Schmoe in Sales couldn't get
to Payroll .  It seems that for non-IBM's to access some of the parts of the
network, you would need an interface to become the same thing as a RolmPhone.

  Excessive #'s of bad logon attempts, which would be construed as a linking
error would notify the network manager, And if they saw that there was no
hardware error, eventually, they would think of if they were somewhat
experienced, you guessed it, hackers.

   The PBX
   -------

  ROLM has something called Integrated Call Management <from here on known as
ICM>.  Now, when designing ICM, they must have taken into account the abuse
possible in plain ol' PBX's.  So they put in something called Call Screening.
This will enable the company to restrict calls to certain #'s and prefixes.
Calls to non-business #'s or certain areas can be screened out <"No personal
calls on my time, Johnson!">, with the exception of 1 specific # that you want.

  There is a choice of having a codeless, screened PBX, or a PBX where accounts
are assigned to each employee, and the #'s they call get recorded to that
account.  There can be privileged accounts where a large volume of calls would
go relatively un-noticed.  But I don't think that large-scale abuse of this
system would be easy or practical.  Calls are routed AUTOMATICALLY through the
service where the rates are cheaper to the location dialed, which is pretty
fucking cool.  And, the PBX is accessible from the outside, using Direct Inward
System Access, making it AB-useable.

  But what about if there is Equal Access in that area?  It doesn't matter, the
CBX will automatically access the service without you having to worry about it
<hell, this is totally unnecessary for a hack/phreak, cause we ain't paying for
the damn call anyhow!>

  BUT!:  There is a use of Call Detail Recording, where information on all
ingoing and outgoing calls are recorded.

     Conclusion
  ----------

  Not a lot of research went into this file, but it did take a little while to
type up, and all of the information is correct, to my knowledge.  Anyone is
free to expand on this file into a Part II.  It was written to enlighten people
about this system, and I hope this has helped a little bit.

  Sysops:  You are free to put this file up as long as NONE of the credits are
changed!  <this means the Phrack, Inc.	AND Personal credits>.	Please give us
a chance.

  Coming soon, to a telephone near you:  The Return of The Flying Circus.  Look
for it.
		   --Later On
Monty Python		 <01/11/86>