éffffffffffffffffffffffffffféâ÷
é é Ĝ
é TriTel XP1230 é Ĝ
é Handset Un-Mute & é Ĝ
é Other Payphones é Ĝ
é é Ĝ
é [ Version 1.0 ] é Ĝ
é é Ĝ
é ~pHreakaz0id~ é Ĝ
é é Ĝ
éúúúúúúúúúúúúúúúúúúúúúúúúúúúé Ĝ
ÂââââââââââââââââââââââââââââP
Contacting the elusive -=pHreakaz0id=-
>> Aust Phreaking Forum <<
>> phreakaz0id@hotmail.com <<
>> #ausphreak on Linuxphreaks.org <<
>> http://www.angelfire.com/freak/az0id <<
"The future is not a single national voice network with
limited connection to the outside world. It will be a mass
of interconnecting networks, under many different ownerships,
of different geographical spreads, offering voice, image,
text and data services from which the customer can choose
quickly and easily."
- Tom McKinlay, DG XIII, Eurpoean Commission [DeBony]
-=-=-=-=-=-=-=-=-=
>> Contents <<
* Summation - "TriTel XP1230 Handset Un-mute & Other Payphones"
* TriTel Payphones - The Un-Mute
I. Un-Mute Method for the XP1230
II. The Theory
III. Dispelling the Myths
* TriTel Australia - The Specs
* Protel International & the TrendTek connection
* The Protel XP1230 Payphone - Specs
* Understanding the Payphone Line
I. Payphone Lines
II. Accessing the Line
III. Pricing
* Appendix 1 - PayTel Australia
* Appendix 2 - Siemens Payphones Australia
I. Cityphone Compact
II. Easyset Entry
III. Telstra Interset 751
IV. Diamond (L6 Bluephone)
V. Elasa (Telstra X1/X2)
* Appendix 3 - DORO Zircon Payphones
* Appendix 4 - Vector Technology Corporation (VTC)
* Appendix 5 - Metalwork, Heat Treatment, Tempering
I. Silver Solder Gaff
II. Lock Picks
* Resources & Links
-=-=-=-=-=-=-=-=-=
Somewhere in Australia
May 2002
Tucked away in wooden enclaves or against cement-rendered walls flanked by bright green palmettes we find the TriTel sitting proudly upon its metallic throne. Encased within its plastic aegis, the first TriTel I layed eyes upon beseeched me to lift its Electro-dynamic handset and finger the delicate yet manipulable keypad as I would a sweet-scented woman.
Enough with the shit, on with the show ...
Summation - "TriTel XP1230 Handset Un-mute & Other Payphones"
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
This article basically covers the method of UN-Muting a TriTel payphone handset for clear Two-Way Communication with your accomplice, or whomever has called the phone. It also contains vital information pertaining to these new payphones seen frequently throughout all major cities in Australia. They are particularly fond of Westfield Shopping Centres and have been known to congregate within a variety of other Malls and the like on numerous occasions. Recent sitings of TriTel herds have been reported in Universities throughout Sydney and strays have been spotted roaming at the occasional public venue.
Appendices at the end of the document contain details and various information on other exotic and rare payphones throughout Australia.
TriTel Payphones - The Un-Mute
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
I. Un-Mute Method for the XP1230
(i) From the Caller's point-of-view: When an External party dials the number for the payphone, they will hear two rings followed by a long beep. After this beep the Caller stays connected to the payphone for a period of approximately 2 minutes.
· Anyone attempting to use the payphone will find that they cannot dial out since there is an incoming call occupying the line. The External party at this point will hear only a hollow sound.
· If anyone lifts the handset at the payphone the External party (or Caller) will hear various clicks as it is being manipulated at the source and can actually listen in on the DTMF being played down the line as the End User attempts to dial numbers on the keypad (however, there several seconds of delay between when the DTMF was heard at the payphone and when they are heard by the calling party).
· Whilst in this mode the Caller can actually speak to the Receiving party (at the payphone) but cannot hear any replies as the handset is still muted.
· The Calling party remains connected for 1 or 2 minutes as mentioned earlier, they will stay connected for the duration of this period even if End User's at the payphone lift the handset and attempt to hang it up or disconnect the incoming call. As with telephone lines the Calling party has precedent over the connection of the call.
(ii) From the [Payphone] End User's point-of-view: When the external source is ringing the payphone, for the first two rings there is no indication that a call is coming through. Once the external source hears the long beep, the LCD screen at the payphone displays "Thank You. Please Insert Money/Coins".
· If the Receiving party (person at the payphone) lifts the handset *before* the long beep (ie. during the first two calls only heard by the Caller): then they automatically "by-pass" it.
· If the Receiving party lifts the handset *during* the long beep: they are able to hear the Calling party if they speak loud enough over the beep, but cannot reply as the handset is still muted. Sometimes the Receiving party is cut-off when they first lift the handset, see the following point for details.
· If the Receiving party lifts the handset *after* the long beep: they will be automatically cut out, he/she must then depress the hook-switch and lift the handset again (or press Follow-On in some cases).
· At this point the End User at the payphone can hear everything at the other end of the line but cannot be heard by the Caller. They must dial any random 1800 (Free to Caller) number. After a short pause of 2 or 3 seconds the handset is un-muted and both parties can have a continuous conversation minus interruptions by clicks, beeps or time-delays.
II. The Theory
When studying the XP1230 one begins to understand how it is possible that the Un-Mute method described here actually works. As will be detailed later on in the article, there are several outstanding features that make this payphone distinctly different to that of its rival the Telstra X2 Smartphone.
TriTel payphones work on ROA [R]eversal [O]n [A]nswer, which basically refers to the line polarity being reversed when a number is dialled thus unmuting the handset and charging the End User accordingly (Free to Caller numbers are obviously recognised as such and the payphone cannot charge you). (For further discussion on this matter See the chapter Understanding the Payphone Line).
The payphone is an American Protel XP1230 model which has its own internal recognition software that analyses the actual number itself against the time of day & day of the week with a charging table - this is known as Self-Tariffing.
The reason why the Un-Mute Method works is because when the End User dials the 1800 number, the payphone itself (as an individual entity and not via CLM) analyses the number that was dialled against the time of day and the charging table, within those few seconds it realises that the number is Free to Caller and this is where ROA comes into play. The line polarity is reversed, no money is taken (since it is free) and the handset is un-muted to allow the number to connect. Obviously, the number cannot connect since there is already a call occupying the line.
III. Dispelling the Myths
Over the past six odd months the TriTel payphone discussion has reached a climax, during that period many myths and misconceptions were distributed by pretentious neophytes and other undesirables. Provided are some brief points outlining what, in my extensive experience, are known to be fact:
(a) TriTel XP1230 Ring-tone: this does *not* exist. I have heard of reference to some TriTel payphones in Canberra that are alleged to have a ring tone much like a "hushed" L6 Bluephone. Since there is no evidence to the contrary, the current status quo stands that when TriTel phones are rung the only external indication that there is an incoming call is a message on the LCD screen reading "Thank You - Please Insert Money".
(b) The following payphones *cannot* call a TriTel XP1230 payphone for various reasons:
· Telstra X1/X2 Smartphone (Siemens Elasa)
· TriTel XP1230 (Protel)
When one attempts to dial a TriTel from another TriTel, the line is immediately disconnected but the Calling party is charged 40 cents for the call before it drops out. X2's on the other hand are completely barred from dialling a TriTel XP1230 in some areas, but the vast majority are not barred from calling other X2 Smartphones.
(c) TriTel payphones *cannot* accept Telstra Phonecards: this is true. Even though the XP1230 is infact quite capable of doing so, Telstra has barred access. For further discussion on this matter and consultations with the ACCC, see the link provided at the end of the "TriTel Australia - The Specs" chapter.
(d) Yes, using Bankcards in TriTel XP1230's is perfectly acceptible, there are numerous signs on both the payphone itself and the stand indicating this.
(e) Free To Caller number the Called Party dials to Un-mute the handset can "eavesdrop" on the conversation: this is *untrue* and was confirmed after extensive discussion with numerous phreakers on the Aust Phreaking BBS and over the phone. The XP1230 is Self-Tariffing rather than utilising Customer Loop Metering (See Understanding the Payphone Line) and is designed to analyse the number dialled against the time of day and a pricing chart. Since the number is Free to Caller (ie. 1800-xxx-xxx) the payphone is tricked into un-muting the handset, something which occurs via reversal of the line polarity when the called party lifts the handset - although in this situation the called party is the payphone itself and the handset is already off the hook. Due to the fact that the line is already occupied with a call between the external source and the called-payphone, it cannot actually connect the 1800 number the End User dialled.
TriTel Australia - The Specs
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
John Bucknell - Managing Director
TriTel Australia Pty. Ltd.
135 Darling Street, Balmain East, Sydney 2041 NSW
Ph: (02) 9810 0146 Fax: (02) 9810 2780
E-mail: tritel@ihug.com.au
· Who: TriTel Australia is the only major alternative to Telstra for
public payphones in Australia (see Appendices for others).
· Evolution: Over the past two years TriTel Australia has expanded
from operating payphones in major shopping centres throughout
Sydney and in South Eastern Queensland, to entering the payphone
market across Australia. They are found in Universities, shopping
centres and a few public locations in almost every State and
territory.
· Payphone: TriTel use an American payphone that was proven in the
USA to be "highly vandal resistant" - the Protel XP1230.
· Objective: Deliver real benefits to the Australian public by
offering substantially better rates than Telstra payphones.
Compete with Telstra's long-standing monopoly of the payphone
industry.
For further discussions on Telstra's smartcard technology trial and its associations with TriTel paphones see "ACCC To Monitor Negotiations Over Payphone Service":
- http://www.accc.gov.au/media/mr1999/mr-185-99.htm
Protel International & the TrendTek connection
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
TriTel Australia makes use of the American payphone produced by Protel International, one of the major US payphone manufacturers. The payphone itself was provided through a contract with TrendTek Australia, the supplier of telecommunications products to major carriers, service providers and retail organisations throughout the Asia Pacific region. TrendTek receive the Protel XP1230 model via Galaxy Payphones (Supplier Code N1141). In addition to supplying TriTel with their payphones, TrendTek supplies various products to organisations such as Telstra, Optus, Alcatel, AT&T Australia, Ericsson, Australia Post and Queensland Payphones.
The particular model utilised by TriTel is titled the Protel XP1230 and supports a variety of payment methods and access network connections. Network connection of the various payphones TrendTek offers can be provided via:
· Conventional PSTN copper links
· Cellular Wireless Networks (GSM, CDMA, AMPS)
· VHF/UHF radio links
· Digital Pair Gain systems
Beneath the vast majority of these payphones - just under the cash box to be precise - is a sticker with the following details: "Galaxy Payphones (Supplier Code N1141) TrendTek Australia".
The Protel XP1230 Payphone - Specs
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
The Protel XP1200/1230 Payphone offers a variety of payment options: magnetic stripe, microchip and coins/tokens. The XP1200 model is a coin/token payphone only; the XP1230 model upgrade (distributed in Australia by TrendTek and currently utilised by TriTel) offers both coins/tokens and card technology.
Features:
· Line-powered, loop start. 48 VDC line voltage, 20 mA minimum.
· Two Protel [Remotely Programmable Electronic] Coin Scanner models
are available:
ECSII: Accepts coins of up to 27 mm in diameter with a max.
thickness of 2.8 mm.
ECSV: Accepts coins of up to 33mm in diameter with a max.
thickness of 3.3 mm.
· Reads all chip cards conforming to ISO 7816 and magnetic stripe
cards Track 2 conforming to ISO 7810 to ISO 7813.
· Optional SAM authentication (5 slots).
· High Contrast Liquid Crystal Display of 2 lines x 20 characters
per line, 9 mm character height.
· Electro-dynamic handset [High Impact Poly-carbonate], hearing aid
compatible with internal stainless steel lanyard with pull
strength of 450 kg.
· Rugged, Vandal-resistant Construction & Stainless Steel Faceplate
· Magnetic Proximity Hookswitch
· Six function keys for Language selection, Volume amplification,
New Call [Follow On], Redial, Change Card, and Emergency number.
[The last three keys are not yet operational in Australia - pH.]
· Encased state-of-the-art electronics for physical and ESD
protection.
· High Quality Anti-drill Locks
· 4mm Stainless Steel Vault Door
· Anti-stuffing Coin Return
· Call Subscriber Answer includes line reversal, 12/16 Khz, 50 Hz
pulses, DTMF tones.
· Bi-directional communications with the ProNet Payphone Management
System for Call Detail Records and multiple alarm detection.
· All payphone features, including Operating System, are
downloadable from the ProNet Payphone Management System.
· Self-Tariffing - TriTel Australia does not utilise CLM to operate
its payphones. It analyses the dialled number against the weekday,
time and a charging table to determine the call cost.
· Service Difficulties - dial 1800 181 922
· Utilises 1800 REVERSE (1800 738 3773)
· Directory Assistance - Local: 1223 - International: 1225
Understanding the Payphone Line
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
I. Payphone Lines
Standard payphone lines differ in several ways to that of a normal telephone line. In this section I will attempt to outline the main features which distinguish its line configuration.
(1) Dial Tones: Payphone lines have a 60-second dial tone; as opposed to normal lines which have a standard 10 seconds (allowing customers time to insert money and dial).
(2) ROA (Reversal On Answer): refers to the reversal of line polarity when the called party lifts the handset. This is necessary to indicate to the payphone when it should take the money, un-mute the handset and allow two-way conversation.
(3) CLM (Customer Loop Metering): refers to a mechanism for charging calls to mobile phones, long distance and so on. For each timed period the exchange sends a pulse which is used to signal the payphone to deduct another 40 cents (1 meter pulse = 1 local call). Telstra payphones require these meter pulses to operate - this includes their Customer Operated L6 Bluephones and C4 Goldphones.
(4) Self-Tariffing: the [Protel] XP1230 TriTel payphone does not utilise CLM to operate. Instead, it is Self-Tariffing - essentially having its own intelligence, which allows it to analyse the dialled number against the weekday, time and a charging table to determine the call cost which is then displayed on the LCD.
(5) Pre-selected Carrier Barring: the oppressive corporate giant that is Telstra did not allow payphone lines to be pre-selected to any other carrier during the pre-2000 era. In effect, tens of thousands of L6 and C4 operators pay full retail rates for each call. In March 2000 Telstra agreed to create a new line after consultation with the ACCC, it was to be identical to the standard payphone line, minus CLM.
(6) Payphone Lines vs. Normal Lines: payphones such as the TriTel XP1230 utilise a Telephone-style 12 Core cable; whilst the common line you will come across in your own home is a Normal, Austel Approved, Telephone Cable Flat 4 Core. Depending on the area you are in, the copper wires you require for beige boxing are Red and Green or alternatively, White and Blue.
II. Accessing the Line
The vast majority of TriTel XP1230's you will come across are encased in a stand rather than a booth. In many instances the aperture between the stand and the wall it is backed against can vary from a centimeter to an inch. If one is able to locate an easily accessible stand with at least one inch of space, gently pry it slightly wider and take a peek behind the metallic hull. You will notice several chords leading from both the mid-section of the payphone and higher up.
(a) White: the thickest chord (several millimeters short of a centimeter in diameter) encased in corrugated white plastic, is the power source. Do not cut this line.
(b) Blue: thickness of a standard pen, this houses the phone line and is known as a Telephone-style cable, 12 Core.
(c) Green-Yellow (striped): several millimeters in diameter, the thinnest; this is the insulated Earth copper wire.
(d) Black: some TriTel payphones I have come across have a black telephone cable instead, it is a Flat 6 Core cable and is accessed via a hole directly underneath the phone itself but in the actual stand, roughly 5cm in diameter.
(e) Grey: this is also an additional line found inconjunction with Black 6 Core cables on some TriTel phones and is accessed via the same hole as mentioned above. It is understood to be the Flat Earth copper wire in some areas.
If you are able to see the phoneline or ascertain its location, it is possible to create a nice hook out of worked silver solder in order to "fish" the chord out from behind the stand for beige-boxing. (See Appendix 5 - Metalwork, Heat Treatment, Tempering to create your own "gaff").
WARNING. Please make sure you are very certain the line you are about to strip is definitely the telephone line. Colours vary in different areas as I have illustrated above (See d. and e. for some examples of alternatives). A simple, yet effective, method of getting to the copper wires underneath the insulation *instead* of stripping the line or slicing them length-wise with a knife, is to burn off the plastic with a lighter. I *will not* take responsibility for anything you attempt to do based on what you have read - you do so at your own risk.
III. Pricing
As mentioned earlier, the corporate behemoth, known as Telstra, charges full retail rates to all payphone operators who are connected to their network. Their payphone division pays an estimated 12 cents per meter pulse, (1 meter pulse = 1 local call). Payphone Operators are thus unable to offer better rates to the End User due to the method by which they are charged.
TriTel payphones do not need meter pulses to operate (they are Self-Tariffing) and are thus able to pre-select to other carriers, theoretically able to offer better rates.
Due to Telstra's control of the Phonecard market (for alternative phonecards see Appendix 1 - PayTel Australia) and their barring of TriTel from allowing the XP1230 to read Telstra SmartCards, TriTel has come out with their own brand of Phonecards which are available at various Newsagents in certain regions of the country, at this writing they are still hard to come by.
Appendix 1 - PayTel Australia
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
Almost half a year ago, whilst researching various exotic payphones available around Australia, I came across the PayTel S400 Satellite Payphone. Although I have never seen one let alone operated one before, I can provide you with quite a detailed amount of information on it (all of which I obtained from their website and am essentially presenting here as a means of preservation and future reference). If any of you Melbournites ever come across any of these, or anyone across Australia for that matter, have a good look at them, try various things and email me with some constructive information (Do they ring? Do tonediallers work on them? Is the handset muted for incoming calls? Are there any barred services and so on).
PayTel payphones are generally found in a variety of locations and are designed for providing remote locations with telephone communication. They utilise wireless technology (Analogue / Digital; Cellular Radio, and/or Satellite) to provide these services in "mobile environments" or where wire connections are not available. They can operate on both credit and phonecards - PayTel is the holder of ISO financial card IIN [I]ssuer [I]dentification [N]umber 836 600. The phonecards use Magnetic Stripe technology encoded with a proprietary data system unique to PayTel. Charges for calls Australia-wide and each of 4 ISD call zones are uploaded into each S400 by data signalling from the PayTel office (think, Telstra MTMS updates).
Locations where PayTel S400 Satellite Payphones can be found and are applied include: Military; Coaches; Outback Tours; Oil Rigs; Trains; Freighters; Mining Camps; Roadside Assistance; Isolated Communication; Liners; Remote Events and Emergency Locations.
PayTel is an entirely Australian owned company and claims to be the only group providing payphones actually designed and manufactured here.
Pay·Tel Australia Pty Ltd
PO Box 456 (4/43 Railway Road)
Blackburn, Victoria 3130, Australia
Phone: (03) 9877 0222, Fax: (03) 9877 9499
Email paytel@melbourne.net
S400 Satellite Payphone - Overview:
· 3rd Generation Coinless Payphone (based on Mk II satellite & cellular
payphones supplied to numerous railway operators across the country)
· "Flash" Memory - payphone operator can change/set phonecall rates, eg.
Subsidy $1 p/min
Cost $2 p/min
Profit $3 p/min
· Features benefits of chosen CAPSAT telephone (phone/credit card phone)
· Payphone Diagnostics performed remotely (data signalling from PayTel
office)
· Allows for pre-paid phone calls
· Operates via Thrane & Thrane Capsat telephone as well as "Inmarsat
· Constructed of strong steel
· LCD (20 x 2) display: Call Duration & Charging Information
· Call payment options: credit cards & pre-paid smart cards (phonecards)
· Payphone Management System provided by PayTel
Further Specifications & Details:
· Measurements: 100mm x 300mm x 380mm (depth x h x w)
· Weight: 5 kg (incl. CAPSAT unit)
· Power: 200-250v AC / 12v DC.
· Solar Power (optional)
· Connection: Voice port & data port, CAPSAT TT-3060, TT-3062A, TT-3062B
· Fittings: CAPSAT unit can be housed in the payphone or separately
· Placement: 4 x 5 mm holes at rear for wall mounting
· Marine protection: Fully cod plated
· Maintenance: Maintenance free, only requires hygiene cleaning
· Call payment: Visa, Mastercard, Bankcard or PayTel phonecard
· Authorisations: Credit Card data sent via modem to PayTel Processing
Unit
· Phonecard personalisation (optional at extra charge)
· Cost of service: 10% credit cards, $6.00 phonecards
· Call charging: Variable according to owner (1 minute increments)
· Call cost: As per Telstra standard billing
· Call information: Duration of call, call cost & remaining call time
credit displayed on LCD
· Enviromental resistance: Indoor application only (recommended)
· Coverage: World-wide Inmarsat coverage according to CAPSAT data
supplied separately
· Usage: Graphically indicated on payphone. English language prompts and
information on LCD
· Customisation: Call charges, card information and other variables
according to the owner
· Cards: Compliant with ISO 7811; PayTel holds IIN 836 600
Appendix 2 - Siemens Payphones Australia
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
"The company is currently the sole supplier to Telstra of owner
operated payphones."
- Siemens
I. Cityphone Compact
The Cityphone Compact is a Multi-chipcard & coin payphone. Siemens claim that their new phone model is "world leading technology" but has not yet been released in Australia at this writing. Quite a sexy phone I might add, silver and sleek (uses Abloy keys I see) but has the same handset as the Siemens Elasa (better known as the Telstra X2 Smartphone). Since they are not yet on the market I am going off what was written at the site re-worded in some cases (See Resources & Links).
(i) Semi-supervised multi-chipcard & coin [Indoor] payphone
· Line-powered payphone for coins and all kinds of chipcards
· Integrated security modules
· S-PMS support & software download
· Visually & mechanically compatible with TSP/TMI
· Modular field upgrades from coin to combinations
(ii) Features
· 2 wire analogue telephone line interface
· DTMF & Pulse dialling
· allows Incoming calls
· Card change function during call
· Various Langauge user messages
· Free to Caller numbers list
· Barred numbers list
· Remote charging
· Self-charging based on polarity reversal (PTT optional)
· Up to 5 coin escrow Upper compartment electronically controlled
(iii) Coins
· Coins escrow
· Remotely programmable electronic coin validator
· Escrow capacity: - 4 coin sequential access - 5 coin random access
· Integrated Coin box (700 cc capacity)
· External coin box optional (2000 cc capacity)
· Electromechanical coin entry slide
(iv) Chipcards
· Chip cards with or without enhanced security algorithms (e.g. SLE
4 43X)
· Electronic purse microprocessor cards
(v) Security Features
· Up to four security modules
· Offline operation
· Cryptographic authentication between chip card and payphone
· Reliable store of the charged units
· Black/white list storage
· Integrated anti line tampering unit
(vi) Statistical Data
· Income (charged quantity)
· Number of calls
· Number of invalid telephone cards
· Management System availability
· Other requirements
(vii) Maintenance Features
· Full diagnostics and tests capabilities
· Menu driven program for guided field maintenance
· Displaying of faulty elements, alarms, parameters and statistics
· Maintenance personnel identification
· Failure clearance reports
(viii) Management System
· Compatible with existing management system (S-PMS)
· Integrated 2400 bps modem
· Parameters up- and downloading
· Software download
· Download of security access keys
(ix) Technical Characteristics
· Process Capacity
* 16 bits microprocessor
* 4 Mbits Flash EPROM memory
* 32 kBytes EEPROM memory
* 4 Mbits RAM memory
· Power supply
* Telephone line powered
· Communications
* Integrated 2400 bps modem
· Keypad
* CCITT standard numeric keypad.
* Function keys
* Hot keys
· Card reader
* Conforms to ISO 7816-2
· Operating environment
* Temperature range - 20°C to 60°C
· Display / Instructions plate
* 2 line LCD display with 2x20 characters
II. Easyset Entry
Another payphone soon to be released on the Australian market by Siemens is their latest Indoor coin payphone, the Easyset Entry. All information included here is either quoted or r-eworded from data supplied online from websites found after extensive researching.
This boy in dark-blue comes with optional Integrated Anti Line Tampering security features, which makes for quite an interesting adversary. Please note that any of these "not yet released on the market" payphones are bound to appear in various locations across the country over the next few years, so keep an eye out and keep me posted via email or on the BBS.
(i) Indoor coin payphone; entry model - Features
· 2-wire analogue telephone line interface
· DTMF & pulse dialling
· allows Incoming calls
· 4 different languages for user messages
· Barred numbers
· Free to Caller numbers
· Charging pulses (CLM)
· Self charging with polarity reversal (Push to Talk option)
(ii) Coins
· Remotely programmable coin validator
· Escrow coin storage capacity (2 options):
* 4 coins escrow in sequential mode
* 5 coins escrow in random access mode
· Integrated cash box
· External coin box (optional)
(iii) Security Features
· Reliable collecting scheme
· Integrated Anti-Line Tampering (optional)
· Metal Coin Module
(iv) Statistical Data
· Amount collected
· Number of calls
· Management system access
· Fast dialling keys
· Additional statistics can be implemented on request
(v) Maintenance Features
· Full diagnostics and test capabilities
· Menu-driven program for guided field maintenance
· Display of faulty elements, alarms, parameters and statistics
· Failure clearing reporting
(vi) Management System
· Compatible with existing management system (S-PMS)
· Modem with 1200 bit/s
· Up- and downloading of parameters
(vii) Technical Characteristics
· Processing Power
* 8 bit Microprocessor
* 64 Kbits Flash EPROM
* 32 kBytes EEPROM
* 32 Kbits RAM
· Power Supply
* Line-powered
· Communications
* Integrated 1200 bit/s Modem (V23)
· Keypad
* Standard numerical keypad (CCITT/ITU)
* Function keys
* Fast dialling keys
· Operating Range
* Temperature Range: from 0şC to +50şC
· Display
* 2 lines LCD display with 24 characters/line.
III. Telstra Interset 751
Siemens example of "world leading technology" already available in Australia. A No-Coins payphone that deals in the latest generation of chip cards. I have not yet seen any of these around but they are said to be suited to hotels and hospitals and is obviously the reason why. They look like a dark blue Optus housephone with a Bright Red handset and a chip card sticking out diagonally on the top right-hand corner. Interestingly, this one also has anti line tampering modules.
(i) Desktop payphone for latest generation chip cards
· Analogue chip card telephone with integrated anti line tampering
modules
· Bundled with hotel application
· Free flowing data port
· 12 kHz metering or behind PABX
· MTMS support & software download
· Refurbishment option to "as-new" standard for post-Olympic period
(ii) Features
· Analogue telephone line interface
· DTMF & pulse dialing
· accepts Incoming calls
· Number redial
· Change of card during a phone call
· 4 languages
· 8 Hot-line keys
· Storage of barred numbers
· Storage of non-chargeable telephone numbers
· Charge pulse evaluation 16 kHz (12 kHz optional)
· Self tariffing (optional)
· Data socket
(iii) Cards
· Memory cards with algorithm (eg SLE 443X)
· Microprocessor cards with electronic purses
(iv) Security Features
· Up to 3 security modules (eg SLE 44C80)
· Off-line operation
· Cryptographic authentication between chip cards and terminal
· Secure debiting of call charges
· Reliable storage of charge sums
· Storage of black/white list for cards
· Anti line tampering integrated
(v) Statistical Data
· Revenue
· Number of calls
· Invalid telephone cards
· Availability of the management system
· Use of hot-line keys
(vi) Maintenance Features
· Full diagnostics and tests capabilities
· Menu driven program for guided field maintenance
· Displaying of faulty elements, alarms, parameters and statistics
· Maintenance personnel identification
· Failure clearing reporting
(vii) Management System
· Compatible with MTMS Management System
· Modem communication 2400 bit/s
· Parameter upload/download
· Software and firmware download
· Key download to security module
(viii) Technical specification
· Processing Power
* 16 bit microprocessor
* 4 Mbit Flash EPROM
* 32 Kbytes EEPROM
* 4 Mbit RAM
· Power supply
* Telephone line powered
· Communication
* Integrated modem 2400 bit/s
· Keypad
* Numeric keys CCITT standard.
* function keys
* Hot line keys
· Card reader
* Conforms to ISO 7816-2
· Operating environment - Temperature range 10şC to 40şC
· Display
* 2 line LCD display with 2x24 digits
IV. Diamond (L6 Bluephone)
Made popular at tens of thousands of locations across Australia, from Swimming Pools to Newsagents, Chemists, 7-Eleven and other numerous Convenience Stores, Universities, Schools, Pubs, Petrol Stations and a host of different "indoor type" locations where these Customer Operated coin-only Payphones are in use. Marketted by Telstra as the Bluephone, it has been available in Australia since 1988.
Siemens Communications Pty Ltd
Cnr. Herring and Talavera Rds
North Ryde NSW 2113
Australia
Mail: Locked Bag No. 2500
North Ryde NSW 1670
Phone +61 137 222 Fax +61 1300 360 222
(i) Features
· Aluminium diecast casework
· Fraud resistant (haha)
· All models suitable for wall or desk mounting
· Electronic coin validation for 4 different coins
· Local, long-distance, international, free, barred and operator
facilities
· Follow-on Button
· Decadic (Pulse) / DTMF dialling (payphone identity tone, credit expiry
tone)
· Line powered (no mains req.)
· Self diagnosis of faults
· Owner mode facility allows operation as a normal phone
· Hearing aid facility. Fitted with an inductive coupled hearing aid
adaptor
· 16-character display
· Dimensions: 245mm x 180mm x 310mm (w x d x h)
· Weight: 5 kg
· Operation Range: 0 to 45 degrees Celsius, 10 to 70% RH
· CLM - Called subscriber answer indicated by 50Hz / 12kHz meter pulses.
· Tariff Changing: Pre-set by factory or changed by the owner from the
keypad
· Accepts Incoming calls (has loud ring-tone)
· It is possible to do a 1800-REVERSE call from one Bluephone to another
(ii) Security
· Access to the mechanism compartment and cash container is via a single
keyswitch. A 3rd position on this keyswitch allows use of the
equipment as an ordinary telephone. Cash container capacity 1 litre.
(iii) Coin Handling:
· In-line escrow, capacity 4 coins. Coins are cashed as they are used,
in the order in which they are inserted. Unused coins are returned.
V. Elasa (Telstra X1/X2)
Manufactured in Spain, the Elasa model was originally designed for indoor use only but Telstra has utilised it as both an outdoor and indoor semi-supervised location Payphone. MTMS updates are constantly barring certain numbers that phreakers find and exploit excessively (publicly announcing "sensitive" numbers on places such as a BBS is highly frowned upon - this was how the iPrimus DCX and FAST were barred). There are numerous Workarounds publicised by Zaleth in his article and the Method for Un-muting an X2 Smartphone Handset are also included in numerous articles and is the reason for why it is not included here.
This particular subtitle was included to merely record various other information about the Elasa payphone as well as a list of currently known facts about X2's. The Smartphones are constantly being updated, some are of course not and so the differences vary according to location and other factors.
Facts:
(a) The Ringtone: Yes, it is true that *some* X2 payphones have an initial two-tone chime to indicate that there is an incoming call. The vast majority *do not* have any sort of ringtone.
(b) The Un-Mute: Yes, it is possible to un-mute the handset (refer to numerous other articles detailing this method).
(c) Calling other X2's: It is possible to call other X2 payphones from an X2 and un-mute the handset for two-way communication. Of course there may also exist some X2's that have this capability barred.
(d) Calling TriTel XP1230's: *Some* X2's are barred from calling TriTel payphones.
(e) Workarounds: Yes, these do work and are necessary if you wish to call FAST or the iPrimus DCX.
(f) Tonediallers: Some X2's will only accept tonedialler DTMF if at least 1 digit has been pressed on the actual keypad, others do not accept tonediallers at all.
(g) DTMF Time-delay: Almost all X2 Smartphones have a time-delay between pressing the number on the keypad and hearing the actual DTMF being played down the line (this only occurs after several digits have been pressed). It is possible to find some X2's that are not updated and do not have this annoying feature, they simply play the DTMF the moment you press the keypad for as many numbers as you dial.
(h) Straw-trick: This is pathetic, old and does not work any longer. The vast majority of payphones will not let you complete the call after $1.50 or so has been used up in credit (the line is disconnected and ERROR appears on the screen). I'm am quite sure that it isn't even possible now to do the straw-trick even for that minimal credit (it's been so long...)
(i) MTMS: this is dialled up automatically by the phone when an excessive amount of unconnected 1800 numbers have been dialled sequentially.
Appendix 3 - DORO Zircon Payphones
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
The DORO Zircon is an Indoor Coin-Only type Customer Operated payphone and can be found in a number of places, particularly Clubs, Restaurants, various Shops, Hotels and so on.
DORO Zircon Specifications:
· Exterior: White ABS plastic; compact design; ergonomic handset
· Four memory buttons for fast access to local business
· Redial; Follow-On; Volume Control; Multilingual selection
· Accepts 20c, 50c $1 and $2 coins
· Can be programmed to accept any new coins introduced in the future
· Raising pip on fifth digit to aid the visually impaired
· Can be affixed to a wall or desktop mounted
· Large cashbox capacity
· Backup battery with five-year life
· Liquid crystal display (single line)
· Help-desk coupled with self-diagnostic facility
· Hearing aid compatible
· Rather loud ringtone
· When called, the line connects as soon as the receiving party
lifts the handset
DORO Zircon MX Specifications (includes those above)
· 2mm secure Steel Jacket
· Secure Cashbox Drawer
The majority of this information was taken from the following webpage, which also includes pictures of these Indoor Coin Payphones:
- http://www.activeelectronics.com.au/doro/doro.html
Appendix 4 - Vector Technology Corporation (VTC)
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
VECTOR Customer Operated Payphone's (VT-200M) are found in a majority of places throughout Sydney, particularly associated with Newsagents, Phone stores and other venues in the Chinatown district. They have now spread across the entire city and can be found just as easily in the suburbs. Be it in secure, semi-secure and outdoor locations, they are in in more than 80 countries worldwide.
Vector Technology Corporation
7F,No.87 Chung-Yang Rd, Sec. 3
Tuchen Taipei Taiwan
Tel: (886 2) 22678080 Fax: (886 2) 22678181
Email:sales@vector.com.tw
Key Contact: Mr Joe Ran MANAGER
The payphone itself is slightly larger than the Siemens Diamond model (or as it is more commonly known, the Telstra L6 Bluephone). The VTC's found commonly in Australia are in dark purple ABS Plastic but Vector Technology also release models in Yellow, Green, Brick-Red, Crimson-Red, Cream and so on. The dark purple model is known as the VT-200M and are Coin Only (they are also designed to accept cards, but I have not come across any with this feature activated as yet).
VT-200M (VTC Coins-Only Payphone) - Specifications:
· Power: line Power
· Call Limited: Local, STD, IDD, Internet Gateway Acces - (Minimum
insertion options)
· Call Area define: Local 300 sets, STD 300 sets, IDD 400 sets
· Function Button: Hot line, Barred, Emergency Call.
· Coin release: Avoids coin channel being blocked.
· Tariff Rate: Self Tariff, Or System Tariff by Meter Pulsed 12Khz /
16Khz / 50Hz) - Interfaces with all existing metering signals
(Tariff Rates programmable)
· Service Charge, minimum charge.
· LCD 16 Character - Multipurpose display
· Coin Definition: Max 12 Kinds - Smart coin collection - Multi-coin
operations
· Microprocessor Controlled
· Electronic coin diameter validator (VT-100); Electronic
permeability validator (VT-200)
· Self-diagnostics; Cash Box Monitoring; Coin Jam Release
· Coin recognition: diameter, Material
· Tariff Change: By Keypad / By Remote Control System
· Income Monitor: By Keypad / By Remote control System
· Discount Time: 24 Period (Real Time Clock Request)
· Metal CashBox: default 300Pic, External 2000 Pic
· Frame: ABS Plastic
· Desktop / Wall Mouted
· Access to PABX Systems
· Size: 245mm x 183mm x 315mm (w x d x h)
· Weight: 3.5 Kg
Optional Extras:
· GSM 900/1800/1900 Mhz Triple Band Module
· IC Card Option
· Real Time Clock
· External Cash Box
Function List:
Function 00 - Self-Diagnosis
Function 01 - Local / STD /IDD block control
Function 02 - Local/STD/IDD code/rate input
Function 03 - Tone/Pulse selecting
Function 04 - Duration for incoming call
Function 05 - PBX mode setting & Barred code setting
Function 06 - Warning time setting
Function 07 - Hot line program (2 sets)
Function 08 - Accumulation of coins
Function 09 - Coin recognition program (6 different coins)
Function 10 - Money or time display & metering Signal selecting
Function 11 - Owner's password program
Function 12 - Cashbox monitoring password program
Function 13 - Language Mode program (2 languages)
Function 14 - Taxed rate & rate's program for value
Function 15 - Rate's program for timing
Function 16 - Data copy program
Function 17 - Speed dial program (10 sets)
Function 18 - Auto detection (optional)
Function 19 - Real Time clock setting (optional)
Function 20 - Reduce price / periods program
Function 21 - Carrier Setting (reserve)
Function 22 - Date off & service program
Function 23 - Password program
Function 24 - Simple discount
Function 25 - 0+ program (optional)
Function 26 - RMS
Function 27 - Version no.
Function 28 - Cashbox / Volume Selecting
Function 29 - Internet Gateway Access
VT-200M Additional Information:
(a) Call cost is generally 50 cents per local call, $1 initial call to mobile phones.
(b) Buttons: Follow On, ReDial, Loud.
(c) Payphone line: Standard Flat 4 Core Telephone-style cable, [Austel Approved].
(c) 50 cents must be inserted in order to place a 1800 call, the vast majority of VTC phones I have come across will actually charge you for placing that call - a few simply return the money.
(d) When attempting to dial a 1800 number without money the first digit registers and the DTMF for 1 is played down the line. However, the following 7 numbers (ie. 800-xxx-x) will not register, after which the phone resets and asks again for 50 cents. A mobile phone used as a tone dialler will not work, even after one button is pressed on the keypad. The "Follow On & ReDial" Workaround pertaining to X2's will not work either since the VTC will only register the initial DTMF tone if no money is placed in.
(e) VTC payphones can be rung and the line is connected as soon as the receiving party lifts the handset. The ring-tone is similar to that of the L6 Bluephone only slightly higher-pitched and louder in some cases.
Appendix 5 - Metalwork, Heat Treatment, Tempering
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
I. Silver Solder Gaff
You can purchase pieces of Silver Solder from Hardware supply stores, particularly the larger ones as many of the regular BBC stores in your local area may not actually stock any of it (you'd be surprised). Silver solder is quite literally, solder containing silver - and is a long piece of solder about 3 millimeters in diameter and usually found about a metre long. It is easily recognisable in a brown or shiny grey-brown colour and much more stiffer than flimsy wire coat-hangers or other similar pieces.
A gaff, by definition, is a device for hooking fish; but in the phreaking sense I apply my miniaturised-gaff device to "fishing" phonelines out from the back of payphones, particularly the TriTel XP1230's as they are accessible this way (the stands are sometimes an inch off the wall). Since pieces of silver solder can be quite long it is effective; an accomplice can stand beside you and hold the gaff in place while you have access to the line and do what you will.
· Using a strong and larger pair of pincers bend the silver solder at a point no more than a few inches from one side (as you do not want to lose too much of its overall length). It may take some effort in straightening and bending (sometimes a hammer can assist in getting it to the right angle) so that two halves are parallel with one another and there is roughly 1 cm of gap between them (this provides the perfect hook shape at the bend).
· With the same pair of pincers clip off the shorter half right at the point where the bending stops. Make sure that any sharp edges are smoothed. Keep the long section as straight as possible since it can be quite frustrating attempting to fish for phonelines with a crooked gaff.
____________________________________________________
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ)
Ż
· A pathetic ASCII drawing is provided here for my amusement and also your own. Enjoy. NB. this picture is *greatly* reduced in size.
II. Lock Picks
While this topic is not entirely related to anything else in the article, it was put in firstly as a prelude to a future article covering this area; and secondly since the methods for tempering and manipulating metals applies to both the construction of gaffs and picks. I will attempt to apply the metal treatments for lockpicks to making a perfect gaff (for the obsessed).
Constructing a strong torque wrench is done by choosing a nail that suits the various locks you have been studying. Nails which are roughly .25 cm in diameter, once turned into a torque wrench, suit a majority of locks you may come across. Please note that some Lock Picking articles online refer to the "torque" wrench as a tension wrench. Utilising a propane torch to heat up the nail is ideal, once it glows red gradually remove it from the flame and allow the air to cool it down - this basically softens the metal. You can apply this to the silver solder for making your gaff.
· At the point at which you intend on bending the silver solder for producing the "hook" tip apply a propane torch flame (or gas stove flame if possible) to the area until it turns red as one does when preparing the torque wrench. Once the silver solder has cooled in the air it is soft and easily manipulable.
· Bend the silver solder at the softened point so that two halves are parallel with one another and there is roughly 1 cm of gap between them (exactly as you would in the I. Silver Solder Gaff description).
· With a strong pair of pincers cut off the shorter half right at the point where the bending stops (exactly as you would using the more crude method of gaff construction detailed in I. Silver Solder Gaff above).
· To harden the hook, now that it has been neatly bent and excess silver solder cut off, you will have to temper it by heating the hook end with the propane torch or gas stove flame till it is bright orange. Once it has reached this state immerse the heated portion in a bucket of ice water. You will end up with one of the strongest and finest constructed Silver Solder Gaffs around.
· NB. Make sure that the hook-tip is not too sharp, grind it smooth or flatten it and file down the edges manually (you dont want to be "fishing" a line to see if it is the power source or phone cable and end up peircing the insulation!).
Resources & Links
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
Some of the information included in here was obviously obtained from online sources that I personally researched and has been mainly paraphrased, re-written in comprehensive terms to partially quoted. These pertain to the payphones that I was not able to get physical access to (particularly the PayTel S400 and the four new Siemens payphones).
* Siemens
http://www.siemens.com.au/sections/p_s/ic/ic_payphones/ic_payphones.html
* Pay·Tel Australia
http://www.paytel.com.au/
* DORO Zircon
http://www.activeelectronics.com.au/doro/doro.html
* Vector Technology Corporation
http://www.vector.com.tw/profile.htm
http://showcase.cetra.org.tw/comdex/search/search.asp?midclass=2230&page=11
http://showcase.cetra.org.tw/comdex/search/company.asp?ban=84514030&prodseq=14844&SchClause=midclass%3D2230%26page%3D11
* TrendTek Australia
http://www.trendtek.com.au/
* Protel International
http://WWW.PROTELINC.COM/PROTELInt/INDEX.HTM
Perhaps this will serve to show neophytes entering the scene and wondering how they can start learning more, that the value of research is immeasurable. It may take hours, even days before you find what you are looking for, but the rewards far exceed the cost. The most useful search engine of them all in my own opinion is the wondrous http://www.google.com/
-=-=-=-=-=-=-=-=-=
Until next time, Addio miei amici. I hope you enjoyed the article and found it as helpful as it was informative. Positive feedback is always appreciated.
~pHreakazĜid~
-=-=-=-=-=-=-=-=-=
>eof<
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH
