ÛÛ
'The Comprehensive Guide to Paytel Canada payphones'
Written by: The Clone
On Friday July 14, 2000
ÛÛ
__________
./_CONTENTS_\.
` `
.; Disclaimer
.; PayTel Canada offices
.; Protel Model Phones
.; Intellicall Model Phones
.; Resources
.; Conclusion
.; Contact
.; Shouts
_,_
Disclaimer --
Within the pages of this document is information pertaining to the
technological ins and outs of a huge chunk of the payphone market in Canada.
I am by no way responsible for any damage someone or somebody causes by reading
this document. If you want to break something and risk a fine or prison time,
by all means leave me the hell out of it. In other words, if I in some way AM
contributing to that slight increase in Canadian youth crime, I don't take
responsibility for it. So please, use this information to learn and grow and
not to piss off your phone company, the police department, or national defense.
_-_
'PayTel Canada offices'
Several months ago, in my document titled 'The Complete Guide to the
Elcotel Payphone' I listed off every Corporation that currently has an
account with Elcotel; this included specific account information in
alphabetical order. From what I assume, that information was deemed useful
by my readers so for that I've taken a similar approach with this section.
For now, here is a list of every PayTel office in Canada in order from west to
north - just a good resource for Canadian phreakers who may be interested in
this company.
__
Paytel's national head office is located in Surrey, British Columbia,
with the following branch offices in:
Alberta (Calgary), Ontario (Toronto, Markham), Quebec (Mirabel),
New Brunswick (Moncton) and Nova Scotia (Dartmouth).
Western Canada (Head Office)
2428 King George Hwy
Surrey, BC V4P 1H5
Tel: (604) 542-2010
Fax: (604) 542-2011
Toll-free: 1-877-542-2010
Ontario Region
6 Adelaide Street East
Suite 500
Toronto, ON M5C 1H6
Tel: (416) 504-7400
Fax: (416) 504-7211
Customer Service: 1-800-265-2953
info@paytelcanada.com
Quebec Region
17,000, rue Charles
bureau 100
Mirabel, PQ J7J 1X9
Tel: (405) 433-0001
Fax: (405) 433-1303
Toll-free: 1-877-433-3553
Eastern Region
201 Brownlow Avenue
Unit 57
Dartmouth, NS B3B 1W2
Tel: (902) 468-1716
Fax: (902) 468-1717
Toll-free: 1-877-575-7555
_-_
'Protel Model Phones'
Protel, Inc. of Lakeland, Florida is North Americas leading manufacturer
of smart public payphones. In 1984 Protel introduced the first line-powered
smart payphone in the USA. Protel were one of the first key-players in the
development of the first Customer Owned Customer Operated Telephones (COCOT)
in the early 1990's, and have strived to bring quality yet cost effective
phones to millions of people around the globe.
Protel develops several payphones, though only having slight differences
between them, which are unique and interesting to mess around with for
a couple of obvious reasons; interaction with the phones' diagnostic -
statistical information is possible by using a series of secret codes,
and physical/remote security is fairly weak. This is just the type of
thing any telephone enthusiast loves to read.
Note:
I haven't personally found an abundant amount of these payphones within
Edmonton in comparison to the Intellicall model phones, but keep in mind,
the telecommunications industry is an ever-changing one so who knows what
to expect in the next six months or so. Keep your eyes peeled and lemme
know if you find any Protel Model payphones in your area.
PayTel Canada's Protel Phone
----------------------------
This is one of the few widely distributed Protel phones in Canada:
http://www.nettwerked.net/protel.jpg
Payphones and Accessories
-------------------------
http://www.protelinc.com/PROTELInt/payphone/Fpayph.htm
Protel Locations
----------------
Restaurants - Truck Stops - Schools - Service Stations - Churches -
Airports - Bowling Alleys - Night Clubs - Bingo Parlors - Resorts -
Low-income Housing - Convenience Stores - Apartments - Bars - Lounges
- Hotels - Motels
Features
--------
- When dialing a call on a Protel phone, the phone slowly dials each digit
while it waits for you to finish dialing or finish paying. You'll be able
to hear this in the background, but it is often quiet so open your damn ears!
- Leaving a Protel receiver off the hook for too long will cause the phone
to produce an interesting beeping sound.
- Credit Card slots; some of these phones DO have credit card slots which
accept many major credit cards (ie. Visa, Mastercard, e.t.c).
- Internal Alarms; can be disabled by entering *# and the correct two to four
digit pin code, most likely in default mode and easily bruteforceable.
- Ringers; Protel model phones will most often ring when called.
After five rings a modem carrier will pick up which is sometimes
followed by an automated voice that reads off how much money is in the
phone including the date/time.
Special Features
----------------
- A particularly special feature about the Protel model payphones are the
unique Protel-only *# options that allow any phreaker to learn about the
phones' internal information simply by entering a few codes.
Here are the *#6X codes I'm aware of at this present time:
` *#61 should give you ANI information
` *#62 will ID the software version the phone is utilizing
` *#65 sometimes discloses the phones company's HQ modem number
- in Canada the modem carrier number would belong to PayTel Canada.
` *#68 disables the phone all together
! Tip: by hand-scanning other *# codes (ie. *#0X, *#1X, *#2X, e.t.c.)
you may find more neat options like the ones noted above.
Remote Administration Software
------------------------------
* Expressnet - ftp://208.49.251.4/Xv150.exe - (official Protel software)
ftp://208.49.251.4/XnetV151.exe - ""
* Panorama - http://filexfer.tripod.com
* Pronet - http://www.protelinc.com/PROTELInt/pronet/fpronet.htm
Security Issues
---------------
'Physical Administration'
To my knowledge there are two ways to gain physical administrative powers
on a Protel model payphone, the first way is somewhat easier.
Here's what you do;
` Enter *# and then the correct four digit admin PIN code which are most likely
defaults such as: *#1234, *#5555, *#9999, and so on. Once you enter the
correct PIN code you will have total access to all menus, rate tables,
and will have the ability to alter restrictions on what phone numbers
can be dialed.
` The second way is quite a bit more difficult but is successful nonetheless.
After entering the correct two to four digit *# alarm code, and opening
the phone with the proper keys, you will notice a 'setup' button on the
printed circuit board.
Press the button and immediately you'll be prompted for the correct PIN code.
` Enter *#000000 (6 digits) - at this point you will have total access to
all menus, rate tables, including the ability to alter restrictions on
what phone numbers can be dialed.
'Remote Administration'
Remote Administration of the Protel phone can be both enjoyable and
profitable, if done correctly. In this section, I'll be explaining step by
step on how to successfully take over a payphone or many payphones by
using just a computer with a modem and the proper software.
The first thing you'll need in order to successfully take over a Protel
payphone remotely is the particular payphone's phone number. This can be
accomplished by either writing down the phone number listed on the phone,
or by entering *#61 with the receiver off the hook.
Secondly, you're going to need the right payphone administration software.
Remember; some software which might work for administering one payphone may
not necessarily work for another. The reason for this is that some
software just isn't compatible with the payphones' chip, making it impossible
to even connect to the phone correctly.
Another reason may be that the software you're using doesn't allow you to
enter the necessary number of digits that would be required of you when
prompted for the PIN code. In this case, you'll need software that allows
you to enter a 6-8 digit payphone admin PIN.
The PIN code; because of the fact that most payphone administration PIN codes
(by default) are a series of numbers with only one number and 6-8 digits,
and if we remember that the internal physical administration PIN for the
Protel is *#000000, I would say that the default PIN for all Protel phones
is likely an easy guess.
'Audio File coin return exploit'
Many of the Protel payphones throughout eastern Canada and parts of the
United States which are owned and operated by Bell (called BOCUT's) are
vulnerable to a particularly interesting form of phone fraud.
This vulnerability will allow anyone on one of these phones to make a
local call and then get their money spit back into the coin return.
Now as some of you may already know, as a service provided to ensure customers
aren't being ripped off when they insert that 25/35¢ for a call, phone
companies have what they call a "coin return policy".
This policy states that if a customer inserts his/her money for the call
but are unable to complete the call due to technical problems on the part of
the CO, then the operator must empty out the appropriate change. Now adays
with the advent of new telecom based technologies, all an operator would
be required to do is play a specific frequency into the receiver to
subsequently cause the phone to empty.
What I'm getting to is this; if anyone on a regular quality land-line was to
be called by someone on a Protel model BOCUT, and then the person on the
land-line was to play the coin-return frequency, they could quite possibly
automate what any operator has the power to do. This little exploit is
known as the 'Green Box', but alt.phreaking's 'Cyber Thief' coined this the
'Protel-Box' for the obvious reason that it only works on Protel model phones.
DIY, baby:
==> <==
The frequency in '.WAV' format: http://www.nettwerked.net/freecall.wav
==> <==
Canadian Distributors
---------------------
C. G. Industries Limited
30 Shields Court
Markham, Ont. L3R8V2
Phone: 905-475-5093
Fax: 905-475-5389
http://www.cgil.com
International Connectors & Cable, Inc. (ICC)
16918 Edwards Rd.
Cerritos, CA 90703-2400
Phone: 562-926-0734
Fax: 562-926-5290
Toll Free: 1-800-333-7776
http://www.icc-payphone.com
Palco Telecom, Inc.
7825 Flint Road S.E.
Calgary, Alberta T2H 1G3
(800) 661-1886
(403) 255-4481
Fax: (403) 259-0101
http://www.palcotel.com
Pay Phone Technologies
80D Centurian Drive Unit 8
Markham, ON L3R 8C1
905-947-8216
Fax: 905-947-8209
Toll Free: 1-877-488-0041
http://www.foc-ppt.com
-`-
'Intellicall Model Phones'
`` Using advanced technology and the experience of over
12 years in the industry, Intellicall produces two payphone models
that may both be customized with a variety of options to meet the
demands of your locations. The UltraTel payphone is the economical
workhorse of the industry for those installations that use AC power.
The AstraTel payphone is the proven answer where line power is preferred.
Both are highly robust systems that deliver the long term reliability
required in any successful payphone network. ''
Paytel Canada's Intellicall Phone
---------------------------------
Paytel Canada distributes this model of payphone by Intellicall called
the AstraTel 2:
http://www.nettwerked.net/astraltel2.jpg
Intellicall: 'AstraTel & Ultratel' Audio Samples
---------------------------------------------------
http://www.payphone-directory.org/sounds/wav/web/intvoice.wav
http://www.payphone-directory.org/sounds/wav/web/intavoice.wav
http://www.payphone-directory.org/sounds/wav/web/a.wav
http://www.payphone-directory.org/sounds/wav/web/intring.wav
Payphones and Accessories
-------------------------
http://www.universal-comm.net/intell.htm
Intellicall Locations
---------------------
Restaurants - Truck Stops - Schools - Service Stations - Churches -
Airports - Bowling Alleys - Night Clubs - Bingo Parlors - Resorts -
Low-income Housing - Convenience Stores - Apartments - Bars - Lounges
- Hotels - Motels
Features
--------
[On UltraTel Models]
- After Approximately five rings, a modem carrier will pick up
- Some models of this phone have a scrambled keypad, that is,
when you dial a number, the tones you hear don't match the
numbers you push. After a call is completed, the scrambling ends.
- This phone requires an AC power source to function properly.
- During a call, it will take your money as soon as it thinks
the call is answered. If it is left off the hook too long it will say:
"Please hang up and try again."
[On AstraTel Models]
- After Approximately five rings, a modem carrier will pick up
- It has a 14,400 baud modem, which is very fast for a pay phone.
It runs only on phone line power. If you don't deposit enough for a call,
you will be told to just deposit the difference.
- if you leave this phone off hook too long it will generate a fake fast
busy signal.
Special Features
----------------
Toll Fraud Prevention --
The fraud prevention is this: if you call your friend on an Intellicall
phone (UltraTel & AstraTel models) and your friend answers, the phone will
automatically dial '111'. If you were to call this phone from either the
payphone next to it or from a cellphone; have it ring once, pick it up and
then hang up, and pick it up again you'd get an unrestricted dial tone which
would allow you to use a tone dialer (since the keypad is temporarly disabled)
to make free local calls.
The auto-111 DTMF tones override the dialtone, thus preventing toll-fraud.
Security Issues
---------------
- Internal Alarm Bruteforcing -
Internal Alarm Bruteforcing can be done by firstly entering pound then
a four digit PIN. Because of previous problems involving the disclosure
of alarm codes, I will not be posting it on this article.
Too many people were abusing the #CPC code that was mentioned on the
'Complete Guide to the Elcotel Payphone', and because of that Canada Payphone
changed the PIN and set up a trap (at least in Edmonton) which automatically
caused the phone to dial out for help.
If you wish to bruteforce the PIN then all the power to you.
'Phone Seizing Problems - will give free phone calls'
Well whaddya know, the very same exploit I discovered on the Elcotel 9520C
model payphones works on the Intellicall model payphones as well.
When will these payphone developers and their distributors ever take their
security seriously? The answer is; until the specific fraud being committed
has reached such prevalent levels that the chance of a yearly revenue is slim
to none.
Using a twenty dollar Genexxa 33-Number Memory Pocket Tone Dialer from Radio
Shack, one can easily take advantage of Paytel's incompetence in relation
to call seizing.
-- Typical Scenario --
CALL TO PAYTEL CANADA
Operator: Paytel Canada, how may I help you?
Phantom Phreak: Yes, may I have the number for directory assistance?
Operator: Just a moment...
Phantom Phreak: Thank-you.
Operator: 1-877-542-2010
Phantom Phreak: No no no, thank-you!
* Operator Hangs Up *
* Phantom Phreak is dropped to an unrestricted line, and then proceeds to
play his pre-programmed 7 digit DTMF tones into the receiver allowing him
a free local call. *
Useful Numbers:
The keypad isn't disabled when using these local numbers,
meaning you will not need to go through the trouble of using a tone-dialer:
** 0
** 411
** 611
** 811
** 911 (?)
| see: 'SKANNING' at www.nettwerked.net for a listing of thousands of these: |
* Blocked From Area - Will eventually drop you to an unrestricted line
* Call Cannot Be Completed - Will eventually drop you to an unrestricted line
* Disconnected - Will eventually drop you to an unrestricted line
* Not In Service - Will eventually drop you to an unrestricted line
* Unsuccessful VMB Login Attempts - will usually drop you to an unrestricted
line after several unsuccessful login attempts (not recommended)
Modem Carrier Numbers (AstraTel 2):
519-576-0354 - Kitchener, Ontario, Canada
780-483-9783 - Edmonton, Alberta, Canada
780-456-9983 - 127St/139Ave: Edmonton, Alberta, Canada
905-453-9794 - Halifax, Nova Scotia, Canada (corner of Robie and Young streets)
'Resources'
Resources list -
URL's of web-sites that helped me with the R&D for this document:
-+ GHU - The Grasshopper Unit: http://internettrash.com/users/mtghu/
-+ Intellicall Inc: http://www.intellicall.com/
-+ Pay Phone Directory: http://www.payphone-directory.org
-+ PayTel Canada: http://www.paytelcanada.com/
-+ Protel Inc: http://protelinc.com
-+ Protel Inc (ftp): ftp://protelinc.com
-+ Tatung Telecom: http://www.tatungtel.com/
'Conclusion'
I'd firstly like to thank some people who helped directly and indirectly
with the creation of this document: Cyber Thief, Magma, Miklos, and RT.
Secondly:
Oh you big scary Telecom companies popping up everywhere trying to make
a buck (or should I say 'quarter') off the slowly dying payphone industry
in Canada, without ever paying attention to security. I'm not going to
chant about how you guys should INCREASE your security. See that's just
something honest 'white hat' folks do. The more you make it easier for the
Canadian phreakers to exploit you physically and remotely, the better.
Although I don't mind a challenge every now and again... or do I?
All this STUFF just comes so easily to me... tee-hee.
Def Con 8:
YES! Hack Canada and several of their Canadian friends will be attending
Def Con 8 this year for some good 'ol fashion fun! This will be Hack Canada's
second year attending this crazy Las Vegas conference, and we plan on having
a few surprises for all you people. Look for a lot more pictures and
reviews this year - hell just look for us and share your beer, eh.
PeAcE OuT...
_ Contact me _
E-mail: theclone@nettwerked.net
ICQ: 79198218
IRC: haxordogs.net [#haxordogs]
URL - http://www.nettwerked.net
Shouts:
Hack Canada & Haxordogs
A
P R E - D E F C O N
2 0 0 0
R E L E A S E
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2025 AOH
