From amic@memlane.com Wed Nov 24 18:19:11 1999
Newsgroups: alt.phreaking
Subject: Re: Canadian Payphones.
From: InfinateZer0 <amic@memlane.com>
Date: Wed, 24 Nov 1999 19:19:11 -0700

here

The Nortel Millennium Payphone: Everything You Ever Wanted To Know

First of all you have to know what the Millenniums look like. Millenniums
are those new payphones that have been popping up all around Canada in the
past couple years. For all you newbies that have no idea what they look
like (maybe you shouldn't be reading this file) I'll tell you. There are
two types of Millennium payphones, "Universal", "Card Phone" and "Desktop".
Universal has a coin slot and are the ones you mostly see. Card Phones are
found in places like train stations, airports, etc.  They are exactly like
Universals except it doesn't have a coin slot. You have to use a calling
card, credit card, smart card or cash card. The newer Desktop looks almost
completely different. It looks more like a Vista 3000 phone. It has a port
on the side that you can plug in your laptop. These phones are usually found
in hotels, I found some in an airport. This is what a Universal looks like.
It's black with a silver front and a two line display screen. Under the
display screen, there are 4 buttons. The first two control the volume in the
ear piece (higher or lower). The next one controls the languages (English or
french). And the last one hangs up on your call in order for you to make
another call. (personally, I think this button is pretty useless) At the Top
(where you put in the coins) it's blue. At the bottom, there is a yellow
card reader (I'll get into that later) There are also 4 key holes.

Two key holes are on the top left side of the phone. Those are for changing
the display screen which I'll get in to later. Another key hole is below the
yellow card reader. That key hole is for the coin box. On the side of the
coin box there is yet another key hole. You need both keys to open the coin
box. You also need an access code (or PIN) to get to the coin box. This is
for extra security on Nortel's part.

Speaking about coins, Nortel has also installed a computer inside that
actually reads the coins you put in the coin slot. This means that you can't
use slugs or foreign coins to make phone calls. The computer allows you to
use $1 coins (loonies) but they don't give you change.

Nortel has also put a recording of a dial tone in the ear piece. (and some
operator saying: "Please insert your card") Don't be fooled. You DO NOT hear
a dial tone on Millenniums, EVER! They are all recordings. You put in a
quarter, and enter your number. After you entered the number, the computer
reads the number you entered, and dials it. You do not dial the number
yourself. Because of this recording, most phreaks think that you can't red
box. That is not true. It's just harder. You need to call up the operator
(press 0, dumbass), and tell her that some asshole covered a couple numbers
with gum (or some other excuse why you can't call the number yourself) and
ask her if you could put in a quarter and she can dial the number for you.
She'll say yes. You tell her the number and you play the red box tone. If
you do it right, she'll say thank you and connect you to whoever you are
calling.

Another thing at Nortel in installed was a yellow card reader. These can be
ripped out with a screw driver. You can bring them home, hook them up to
your computer and read/modify cards. These read calling cards, credit cards,
smart cards and cash cards. They make a loud beep if you hang up the phone
and you leave a card in the slot. The yellow card reader also checks your
card against a list of fraudulent cards in a matter of seconds.

The Nortel Millennium Payphone also has a display screen. The display screen
has 2 lines. On the top line, it has the date and time. On the bottom line
it usually has advertisements. Most phreaks would love to change the screen
to display something like: "THiS P4YpH0n3 iS 0WnED bY _______" Well, to do
this, you need the two keys for the key holes on the top left side of the
phone. After you unlock them, you have to enter an access code (or PIN) from
the keypad. (If you do not enter the PIN the computer inside sets off an
alarm, I am not sure if it's silent or a loud beep) After you do that you
can take off the top part of the Millennium. Inside you'll find a port that
you plug a keypad into. Then, and only then, you can change it. I have never
seen anyone actually do these but that is what most phreaks have told me. I
don't know where you can get a keypad or who makes them. If you raid a phone
truck you'll probably find one. I think Nortel makes them but I am not sure.
You need the keyboard to write custom messages on the screen but you can
change what is written on the screen. There are several preset,
unchangeable, messages you can make appear on the Millennium's screen from
the keypad. You can't put whatever you want but you can put other things. To
do this, you must have op codes. Opcodes are short strings of numbers that
are preset functions on Millenniums. However, you must correctly enter a PIN
before you have the chance to input Opcodes. I heard from a phreaker that
what you have to do is dial 2541965 with the hook down. Another (but
unconfirmed) number was 2727378. After you dialled it, you would be asked
for an access code (or PIN). One of the PIN was 25563. I think there's more
than one PIN. After you entered the PIN, you could enter any opcode. Here
are a list of opcodes:

267 # Answer detect
274 # Display brightness control (down?)
277 # Display brightness control (up?)
349 # Unknown - Someone know this one?
636 # Memory Access
688 # Unknown - Possibly the "Out of Service" message
66666 # Motor sound, prompts to open phone - Probably coin removal
996 # "Error has occurred"

You can enter the opcodes above or scan to see if you can find anymore.
There are many other opcodes that I haven't found. However, the first known
"config" number that I said above, 2541965, doesn't work now. I am not sure
if the PIN still works on another number. We are working to find out any
other config numbers. Try your phone number, it might work. If you find one,
send it to me.

The Millennium also has a small computer inside (not surprising) but most
phreaks do not realise the power this small computer has. It keeps a log of
EVERY call made (including 800, 888, 877, 911, 611, 411, 311, and 0) and how
the person paid for the call (collect, card, coin) but that's not all, It
also knows exactly the number of coins in the coin box. It also keep an eye
on all the other systems (yellow card reader, display screen, etc) and if
there is something wrong, it sends an alarm to Bell Canada, and Bell sends a
lineman to check it out. I am not sure of this but I think that it might
have a tracking device inside or maybe every time that it's connected to a
phone line it calls bell and gives it's location. Either way, that means
that if you want to steal the payphone they probably will track you down.
The computer also makes a log about every time a linemen (or phreak) changes
something like the display screen or if someone open the coin box or if
anyone opens the top part (just to look around). So be careful if you try to
mess with it.

Many, many people think that Millenniums can't ring because if you call
them, you get a message saying: "This line is for outgoing calls only" but
they all have a bell inside and they can ring. If you look under the place
where the number of the phone is located, you will see a small speaker. This
is where the ringing comes from.  The only reason that most people thing
that Millenniums can't ring is because only operators can call Millenniums.
When you call up the operator, the op will see 0(+) MIL_CARD or
0(+) MIL_UNIV on her computer screen along with your location. If you want
to hear a Millennium ring, you have to call the op and ask her to call you
back (you must convince her), or you can harass the op until she get so
pissed off at you that she calls you back. I don't think she would call you
back because most ops don't think that they can call payphones so they'll
call the cops. I have also hear from a follow phreaker that 911 operators
will also call you back, but I have never tried. There may be some
Millenniums that have never rung, but they all do have an internal ringer.

Well, that's all I know about the Nortel Millennium Payphone. I hope this
helps you. Later All! Shout outs to 416/905, Korben416, C/NR, XYU416,
Demos416, Hexnix, Mojo, Twiggy, HEX5, and [r]adead.
------------------------------------------------------------------------
If you want more information on Millennium payphones, here are some numbers
for you to call.
800-268-5933 Bell Canada, Payphone Department (Toll Free)
800-4 NORTEL (800-466-7835)  Northern Telecom (Nortel)
214-684-5930 Northern Telecom (Nortel)
416-748-2694 Bell Canada, Payphone Department


Jeremy Shaw wrote:

> Hello.
>
> I'm loving phreaking so far!  Does anybody know anything interesting about
> Canadian payphones.  How to get free calls.  How to allow them to accept
> "in-calls."
>
> Or any other neat tricks for us Canadians involving anything.