Millennium Payphone - Power Out Exploit V2.0 - By PsychoSpy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

What's new in V2.0....

Added a section on how to turn the power out without 
cutting lines. This was one of the most common questions
people have had after I originally wrote this file.


Intro/Story....

Recently while carousing the halls at my local educational 
facility, I noticed that the LCD Displays on the phone had
gone completely blank. I couldn't believe my eyes! The
power on the phones had gone out! Can we say damn lucky?!?
I then walked up to the phone and picked it up, as I put my
ear to the slightly chilly earpeice, I heard the distinct
noise of the dial tone. You may say "Well hey! What else
do you expect to hear when you pick up the phone?!? You
forgot something you psycho! The Millennium dial tones are
all pre-recorded." Well, that's right, the dial tones ARE
pre-recorded, however, with the power out, the recorded
dial tone isn't played due to lack of power. In fact, you
can hear the physical switch inside the Millennium switch
over. This my friend is a REAL DIAL TONE!! WOOO!!

I then proceeded to try to dial a well known number 
(Clones pager). The damn payphone wouldn't let me though.
It turns out that when the power goes out, the payphone
initializes a failsafe mode which dissables the dialing
of ANY numbers on the key-pad until the 1 and 8 have been
pressed first. This is meant to make it so that you cannot
dial any numbers other than 800, which you could do when
the power was on anyways.


Onto the exploits....

First what you have to do is either cut the power to the 
Millennium, or find one with the power out. The first option
is the most likely of the two. It was out of pure luck that
I found the payphones with the power out. Just be VERY VERY
careful when snipping the power. Make sure you've got rubber
gloves, the wire cutters have rubber handles etc. If you fry
yourself because of this, IT'S YOUR OWN DAMN FAULT!! DON'T
COME CRYING TO ME!!


Now for the real exploit stuff....

The numbers are only dissabled on the physical key-pad. This 
means that we can pull out our trusty tone dialer, and dial 
away any number we please. I actually didn't have a tone 
dialer with me, so I used a mini-audio recorder. To use the 
audio recorder, you just dial 18 and then press record, and 
dial the rest of the numbers with the mic up to the ear piece. 
Then, hang-up, and play the tones back into the phone.

NOTE: The tones must be played as fast as possible. This is
due to the dial-tone going dead in around 10 to 15 seconds.

The second exploit is based on the line seizing exploit on 
the Protel's which The Clone found awhile back. With the power
out, the Millennium no longer protects against this attack.
This means that you can dial a 800 number that will drop you 
to a dial-tone, and will be able to use it. You can also 
try phoning up the operator and pissing her off so much that
she hangs up, therefor giving you an unlimited dial-tone once
again. Once you get this dial-tone, you can dial any number
your little heart desires.


How exactly do I turn the power off without cutting lines?....

This was the most common question after originally writing
this file. I found the answer to this from Kybo_Ren and I 
would like to thank him for it.

Here's the solution for the phones on pedestals and in booths.
Walk up to the phone. See that nice little Bell sign at the 
top? The one that lights up at night? Pry that off. Behind
that there is a little breaker switch. Flip the switch and
voila, the power is out, and you can carry out this exploit.



Outro/Shouts/To Come....

Well, that's it kiddies! Have fun! This is only the FIRST of
MANY files to come in the near future on the Millennium Pay-
phones which have spread across Canada like a technological
plague. Kinda interesting new frontier of phones though. The
Telcos are actually getting somewhat smarter. Who'd of ever 
thought?!!?

Shouts out to The Clone, Cyb0rg/asm, Kybo_Ren, and Niteshade.


-- PsychoSpy
   psychospy@hushmail.com
   ICQ#: 5057653

   11/05/00

Updated: 11/21/00