The wonder of Nortel Millenium Payphones
The MOB
The High Class Hooligan
http://www.mobsters.net/HCH
By: Nomad

Well Tophat's been pretty patient recently so I figured better hack out
this text file soon so that he doesn't think I'm a complete
hallucinating hack.   First things first though... This text file may
not be 100% percent accurate but its basically a compilation of 3 other
text files (nortel_millenium.txt, nortel.txt, and millenium.txt), and
what I could pump out of the phone operators in my area.  I noticed some
contradictions in the text files so the unsure sections will have both
beliefs stated.  So anyway without further rambling... Behold my friends
a complete and concise text file on the most illusive of all payphones
the Nortel Millenium!

The Millenium is a very distinct looking phone.  The first noticeable
feature is the cool looking 2 line liquid crystal display that scrolls
company slogans and such.  The second noticeable feature is on the lower
right, its a yellow card reader module with the Bell's "Quick Change"
slogan on it, this feature is rapidly becoming standard on all phones in
Canada replacing the old blue card reader which only read the magnetic
strip phone cords as well as Credit cards which would be validated after
use with the Canadian ACCS database.  These new card readers to my
knowledge will read "Smart Cards" AND magnetic strip cards.  The rest of
the phone is a complete mat-black finish with the face of the phone a
shiny aluminum finish, and a shiny blue stripe for the top section.
Under the liquid crystal screen, there are 4 buttons. The first two
control the volume in the ear piece (higher or lower). The next one
controls the languages (English or French). And the last one hangs up on
your n order for you to make another call.  There are also 4 keyholes
present upon close inspection...  2 of the keyholes are on the top left
plate, those are for accessing the display screen, and the one is
located on the lower left panel for accessing the card reader, and the
fourth keyhole is located on the other side where the coin box is
located and its for accessing the coin box.  To access the coin box you
must insert the card reader key and the coin box key as well as enter a
PIN number to open the coin box... this is extra security on Nortel's
side.

Now that we know what a millenium looks like perhaps we'd like to know
about those tough looking armor sections on the sides of it?  Well those
babies are 1/4" Steel and the locks used to secure them are four pin
Medeco(tm) locks with a notched T-Bit bolt.  Now I've had the once in a
life time chance to watch a Bell lineman actually disassemble one of
these puppies, my friends thought I was nuts watching the fat guy take
apart a phone but I learned a lot that day... and it was even in school!
Anyway  the part of the phone that includes the card reader, handset,
keypad, display, and RBOC logo flips down. The hinge is located just
under the card reader.  This whole section is known as the "Logic box."

The Millenium's Logic box is a marvel of modern day technology... When
you pick up the handset on a Millenium and hear a "dial tone", it is not
really a dial tone you are hearing. It is merely a fake dial tone that
the phone produces. After dialing your number, the phone then decides on
what sort of call it is. Is it local, long distance, or overseas?  If it
is a local call, then a synthesized voice asks for the $0.25 and the
display also prompts for the money. Once the money is in, the phone
picks up the real line that it is connected to, and then re-dials the
number that you entered into its memory. The call then goes on as
normal.  However if it's a long distance call, the phone checks it's
rate table for the current rate based on time of day, day of week, and
mileage to destination CO. It then asks for the appropriate amount of
money and continues in the same manner as with a local call. The same
goes for an overseas call.

Now how does that phone dial your number?  This is the first
contradiction of many about these "payphones of the future"  in "NorTel
Millenium: The payphone for the next 1000 years" written by miind he
states that:

"-Magenta Box is out, because the microphone isn't being muted to deter
Red Boxing. White Box is out because when you initially dial the number
on the keypad, it is NOT the DTMF tones that are being stored, but
rather the actual keystrokes. Playing DTMF tones via a White Box into
the mic to dial a number won't work because the phone isn't listening to
the tones, just waiting for electrical pulses from the keypad-"

but "The Nortel Millenium Payphone" written by Twiggy say's that:

"-What *is* possible, however, is tone-dialing from the Millenium
handset. Sure, when you pick up a Millenium, you hear a completely fake
and useless dialtone. The Milleniums have a dialing pre-processor, and
won't let you hear a real dialtone until you have stuck in your card or
your money. But even at that people wondered if the Millenium ever
really lets the handset mic interact with a live dialtone. Surely
enough, pausing until after an operator message allows the tones to work
-- the handset mic DOES work prior to a completed call, which a lot of
people didn't believe. I've made calls from Nortel Millenium phones (the
ones beside Starbucks on Queen St. West, actually) without ever touching
the keypad, which in and of itself is not a big deal, but it is
something we weren't sure could be done with these phones.-"

I personally haven't been able to tone dial from a Millenium Payphone,
but I must admit there is a huge chance that I'm not doing something
just right and its my human error that makes me tend to favour miind's
explanation.

Now another common wrong belief is that Millenium's lack a bell or some
sort of ringing function... Well I can tell you all that I myself have
known that they do in fact have bell's ever since grade 9... you see one
of my friends Adam, decided he was going to prank 911 from the school,
and he calls them up and says "help alien's are raping my kittie cat!"
(this did seem funny at the time).  He then promptly hung up and
promptly the phone started ringing I picked it up and then hung it up
again, but it kept on ringing until the principal came to the phone to
tell them they had caught the pranksters.  Anyways the morale of the
story is Milleniums HAVE a ringing mechanism of some sort inside!  And
it is quite loud!

Another interesting thing about these phones is of course their display
screen... wouldn't you like to have a custom message on one? So would
I... now in theory this may be possible but I have yet to hear stories
of anyone actually accomplishing this.  In order to change the display
of a Millenium payphone you must first enter a PIN number from the
keypad of the phone with the hook down.  A  few common numbers have been
in most texts on this subject are: 2541965 and another rumored one is
2727378.  To properly dial these you must leave the phone hook DOWN.
After entering this number correctly you will be asked for a PIN number
(25563 is a well distributed one).  To enter the PIN number do the same
thing as you did to enter the first number, you now should be prompted
to enter an OPCODE... a few known OPCODES are:

267	# Answer detect
274	# Display brightness control (down?)
277	# Display brightness control (up?)
349	# Unknown - Someone know this one?
636	# Memory Access
688	# Unknown - Possibly the "Out of Service" message
66666	# Motor sound, prompts to open phone - Probably coin removal
996	# "Error has occurred"

Now you probably are wanting to know how to create your own messages for
loyal Bell Canada users to see when they dial up on the Millenium right?
Well in order to do this you need to The top/front quarter has to be
unlocked and lifted up and back first. Inside you'll find a port that a
small portable keyboard can be plugged into, and at that point you can
truly go about the alteration of the screen contents.  At the current
time it is unknown to the phreaking community what type of keypad is
needed for the interface, who builds them (most likely Nortel), and what
type of connection is used for the interface... You could probably raid
a Bell truck and grab a keypad but I haven't worked up the nerve to do
this, In Canada the Bell trucks are actually locked.

The Millennium also has a small computer inside but most phreakers do
not realize the power that this small computer possesses. It keeps a log
of EVERY call made (including 800, 888, 877, 911, 611, 411, 311, and 0)
and how the person paid for the call (collect, card, coin) but that's
not all, It also knows exactly the number of coins in the coin box. It
will also keep a log of all the other systems installed on the phone
(yellow card reader, display screen, etc) and if there is something
wrong, it sends an alarm to Bell Canada, and Bell sends a lineman to
check it out. 

It is also very plausible that the Millenium payphone does have some
sort of tracking device installed inside of it that would relay any
interesting information back to Bell Canada, and possibly a gyroscope
level of some sort to sound an alarm if the phone is tipped past 90
degrees.  I must stress though that I have no way of knowing about a
gyroscopic level but it does seem plausible... Its just a rumor that's
been bouncing around the 613 area for a while now.

One more thing I found out recently about these phones is that when you
call an Operator with a millenium they see a  special 0(+) MIL_CARD or
0(+) MIL_UNIV flag denotes your call and subjects you to restrictions;
for example, an operator won't allow you to dial 0 and use a Calling
Card number to call overseas when they see a "MIL" flag on your call.
This is a sort of disturbing finding really when you start to think
about it... trust me just think about it...

These numbers were found in various text files

 1-800-263-7412		# Bell Canada Millenium (Help Line)
 1-800-567-2448		# Bell Canada Millenium (Test Line)
 1-800-461-1747		# Bell Canada Millenium (Voice Test)
 1-800-461-1879		# Bell Canada Millenium (Data Test)
 1-800-772-2141		# Bell Canada Millenium (Setshop)
 1-800-668-4862		# Bell Canada Millenium (Coin)
 1-800-668-6851		# Bell Canada Millenium (Alarm)
 1-800-461-1760		# Bell Canada Millenium (Unknown)
 1-800-361-7874		# Bell Canada Millenium (Unknown)


Well that's all the dirt I could find on Millenium Payphones so far, but
if I find anymore I'll be sure to post them for the community to use,
until the next time, have phun and don't get caught!



Nomad
January 1999 

P.S;
you better make sure that you use a 4 digit date on your text files now
or the "millenium virus" as its recently been tagged will get you! Hehe